Modes of encryption for hard drives? What are the currently recommended modes of encryption for large disks? Basic requirements would seem to be that you can update an encrypted sector independently of others, which rules out most standard modes of operation except CTR. For example are there any problems with taking the counter to be the current block number + some initial offset that could be stored for example on the first block.

What security models are usually considered for disk encryption? Is IND-CPA-security (as offered by CTR) enough?
The standard for full-disk encryption (FDE) is XTS mode or ESSIV-AES-CBC.

XTS tweaks each block within each sector differently (and hence avoids ECB's problems) and is considered the best choice available at the moment.

ESSIV-AES-CBC works by using AES-CBC with the IV being the hash of the sector index. The problem with this mode is that you can flip bits at arbitrary positions if you can accept the previous block being "destroyed"(completely scrambled), which you can  very often. F.ex. one could tweak down attack security critical bits and hence compromise the online-security of the system.

CTR would be a really bad idea for disk-encryption as you'd have the same problems as with CBC but you'd also loose "poor-man's-authentication" (-> at least one block gets scrambled), as you can know flipped bits at arbitrary positions without any problems.

What would be optimal for disk encryption would be a mode that turns a small block blockcipher (->AES) into a very large block cipher without too much speed penalties. (2 calls at max) That's was Bitlocker's elephant diffuser tried.

The best solution in my eyes would be to simply have a blockcipher with a very large blocksize that is considered secure. In my personal opinion, Threefish(-512/-1024) would be a nicer option than AES, but it isn't adopted.

You might be interested in this.