Does LUKS encrypt data as it is written? If I reinstall Linux with encryption, what happens to files that were already on the drive?
The sensitive files were written after the current encrypted installation was set up. I have backups, but I want to keep the files private while the laptop is being serviced.
Yes. Data written through an unlocked LUKS volume is encrypted as it is written and decrypted when read. That applies only to data stored inside the encrypted volume. A separate unencrypted partition is not covered.
A reinstall does not go back and encrypt old plaintext that was outside that volume. It may overwrite some old data, but you should not assume it wipes the whole drive.
If those files were always inside the encrypted volume, remnants of them on the drive should still be encrypted. Reinstalling is not needed to make those remnants encrypted.
The distinction is whether someone can unlock the old volume. Reformatting or deleting a partition is not necessarily a secure wipe, and whether old key material remains accessible depends on what the reinstall actually overwrites. Keep the old passphrase private and don't assume a new installation alone has securely erased everything.
Check the installer's disk options carefully. Creating an encrypted installation and wiping the drive are different operations, and the available choices may depend on the installer and how you partition the disk.
If you need a wipe rather than just an encrypted reinstall, look into the drive manufacturer's supported erase method or a firmware erase option, if available. Confirm your backups first because that should be treated as destructive.
Answers are reviewed before publication.
r410!staple_6:
So the old files aren't encrypted a second time during installation. They were already encrypted when they were written?
6x~opstate_318:
Right, provided they were written inside the LUKS volume. Any leftover encrypted blocks remain encrypted, but that is separate from securely removing the old volume's ability to be unlocked.