what is quick formatting in veracrypt?
In veracrypt, I'm going through all the options and attempting to understand them, and I have come to something called "quick formatting". In the volume creation wizard there is an option for "quick formatting". What is "quick formatting" and what does it do? Is there a contrasting "long formatting" if so, what is the difference between the two?
Solution 1:
Basically the gist is that quick format will not write to all the blocks on the drive (or in the container). That means:
- remnants of previous data will remain visible until overwritten and
- it will make it quite evident - based on entropy - that something is going on in the blocks that have been written to versus those that remain as before
Point 2 is what the answer linked from a comment to your question is talking about. The fact that only the locations on the drive that are occupied by metadata will be overwritten by a quick format operation means that you can guess by looking at the entropy of the blocks whether they contain encrypted data or plain text.
Generally in cryptography it's seen as a weakness if any information about the encrypted message "leaks". This is why generally encryption systems will pad out the end of encrypted messages to the multiple of a given block size just to make sure the attacker cannot guess the actual length of the actual message.
That's why the recommendation is to do the full format. And I would also recommend that. Simply because by not doing the full format, you are weakening the initial state of the encrypted volume. This will go away over time as the volume fills up. But exactly that information may be valuable to an attacker.
If however, you are looking for plausible deniability, then you absolutely positively have to do a full format because the entropy of the blocks will let an adversary make assumptions about the contents. Similarly a hidden volume will not be thinkable without doing a full format, because the idea of a hidden volume is to use an alternate key to show alternate data and so from the outside both regions (hidden and not hidden) should be indistinguishable for an attacker. Anything else will - again - weaken the effect of the crypto.
So don't be cheap when it comes to security.
NB: a nice side-effect is that going through this once enables you to do a "full wipe" instantaneously. The way this works (e.g. on some phones) is by throwing away the key material. So you're left with an encrypted volume which no one can make sense of anymore.
What's entropy?
Entropy in computing is a measurement of the randomness of data. Generally extreme compression and encryption will have a relatively even distribution of byte values. Meaning they have both high entropy. Tools exist to map out the "jumps" in entropy (this is used in firmware analysis, for example) and these tools would show - in case of quick format - jumps between the locations on the disk that were written during the quick format operation and those that weren't touched.