Chapter 12. Encryption 661
You can use the MDisk by Pools view to show the object encryption state by clicking Pools → 
MDisk by Pools. Figure 12-76 shows an example in which self-encrypting MDisk is in an 
unencrypted pool.
Figure 12-76   MDisk encryption state
When working with MDisks encryption, take extra care when configuring MDisks and pools.
If the MDisk was earlier used for storage of unencrypted data, the extents can contain stale 
unencrypted data. This issue occurs because file deletion only marks disk space as free. The 
data is not removed from the storage. Therefore, if the MDisk is not self-encrypting and was a 
part of an unencrypted pool, and later was moved to an encrypted pool, it contains stale data 
from its previous life.
Another mistake that can occur is to misconfigure an external MDisk as self-encrypting, while 
in reality it is not self-encrypting. In that case, the data written to this MDisk is not encrypted 
by Storwize V7000 because Storwize V7000 is convinced that the MDisk encrypts the data. 
At the same time, the MDisk does not encrypt the data because it is not self-encrypting, so 
you end up with unencrypted data on an extent in an encrypted pool.
However, all data that is written to any MDisk that is a part of correctly configured encrypted 
pool is going to be encrypted.
Self-encrypting MDisks
When adding external storage to a pool, be exceptionally diligent when declaring the MDisk 
as self-encrypting. Correctly declaring an MDisk as self-encrypting avoids waste of 
resources, such as CPU time. However, when used improperly, it might lead to unencrypted 
data at-rest.