The best portable SSD for Linux is the one whose speed you can reach and whose security you can unlock. A 20 Gbps drive drops to 10 Gbps on most Thunderbolt and USB4 ports, and the password feature on a Samsung, SanDisk or Crucial drive leans on Windows or macOS software that has no Linux build. Once you know where those catches sit, you’ll get a fast drive, plain LUKS encryption and working TRIM.
This guide picks five drives for different jobs. Then it walks you through the Linux side: the USB link, TRIM over UAS, LUKS, ext4 or exFAT, and booting Linux from an external SSD. I went through the LUKS, discard and exFAT steps again on Ubuntu 26.04 in October 2026 with two lab SSDs attached to a VM, and they still hold.
Pick the best portable SSD for Linux
If you only read one section, read this one. Each pick wins for a different reason, and the reason is the thing you’ll notice on a Linux box day to day:
- Best overall: Crucial X10 Pro 2TB. It holds about 1,750 MB/s for over 11 minutes of writing, lists Linux support and has a 5-year warranty.
- Best for any USB port: Samsung T7 Shield 2TB. It runs at full speed on any 10 Gbps port, including most Thunderbolt and USB4 ports, inside an IP65 rubber shell.
- Best pocket drive: Kingston XS2000 2TB. It packs 2,000 MB/s rated into 28.9 g with a 5-year warranty.
- Best Samsung 20 Gbps drive: Samsung T9 2TB. It pairs Gen 2×2 speed with an 88 GB write buffer on the 2TB model and a 5-year warranty.
- Best encrypted drive that unlocks on Linux: Apricorn Aegis Padlock SSD. You type the PIN on the drive itself, so Linux only ever sees a plain USB disk.
Prices for 2TB portable SSDs ran from about $360 to $500 when we checked on 27 October 2026. Check the live listing before you buy, and expect Black Friday to move every number on this page.
Check the specs side by side
The columns below are the ones that change the buying decision on Linux. Rated speed only matters if your port matches the interface column, and the encryption column tells you whether Linux can unlock the drive without help:
| Drive | Interface | Rated read/write | Encryption Linux can use | Warranty | Price band (check live) |
|---|---|---|---|---|---|
| Crucial X10 Pro 2TB | USB 3.2 Gen 2×2, 20 Gbps | 2,100 / 2,000 MB/s | None built in, use LUKS | 5 years | about $365 |
| Samsung T7 Shield 2TB | USB 3.2 Gen 2, 10 Gbps | 1,050 / 1,000 MB/s | AES 256 via Samsung software (no Linux build), use LUKS | 3 years | about $500 |
| Kingston XS2000 2TB | USB 3.2 Gen 2×2, 20 Gbps | 2,000 / 2,000 MB/s | None, use LUKS | 5 years | about $360 |
| Samsung T9 2TB | USB 3.2 Gen 2×2, 20 Gbps | 2,000 / 1,950 MB/s | AES 256 via Samsung software (no Linux build), use LUKS | 5 years | about $430 |
| Apricorn Aegis Padlock SSD 1TB | USB 3.0, 5 Gbps | up to 350 MB/s | Keypad PIN, AES-XTS 256, OS agnostic | 3 years | about $745 |
Every non-keypad drive ends up in the same place on Linux, which is LUKS, so the vendor encryption badge shouldn’t sway you. The Apricorn, on the other hand, costs three to four times as much per terabyte for about a sixth of the speed of the 20 Gbps drives, which is the price of an unlock that doesn’t depend on any host. Skip it unless you hand drives to people on locked-down machines where you can’t install anything.
Read how we picked and tested
We didn’t benchmark these five drives ourselves. Every speed figure here is either the maker’s rating or a named review’s measurement. Specs come from each maker’s product page or datasheet, fetched on 27 October 2026, and prices and stock come from Amazon’s catalog API on the same day. The Linux procedures are different. Every output block below came from an Ubuntu 26.04.1 VM (kernel 7.0) with two 8 GiB virtual SSDs, which shows what Linux does with LUKS, discard and exFAT. Those disks weren’t on USB, so the lsusb -t reading and the udev rule come from kernel and Arch Wiki documentation rather than our own USB hardware, and none of this tells you about a particular drive’s controller. For the USB bridge side (UAS versus usb-storage, and how the kernel decides TRIM), our UASP and TRIM lab on NVMe enclosures has the captures.
A few popular drives didn’t make the list, and you deserve to know why:
- You won’t find the SanDisk Extreme here, because in May 2023 owners reported Extreme and Extreme PRO drives wiping their data, Western Digital released a firmware update for some 4TB models, and Ars Technica saw its own 2TB Extreme PRO units fail, while the new 2,000 MB/s Extreme from February 2026 has no independent review yet.
- You won’t see any drive here chosen for its built-in encryption unless it has a keypad, because the vendor unlock tools don’t run on Linux.
- You can use any of these as a boot toolkit, though a flash stick is cheaper for that job and our USB flash drive picks for Ventoy cover it.
Get the Crucial X10 Pro to run Linux from USB
The X10 Pro is the drive we’d hand to most people, because it’s fast where it counts and doesn’t ask you to install anything. You’ll like it if you have a 20 Gbps USB-C port, want to run a full Linux install from it, or copy big files often. If your machine only has 10 Gbps ports it still works, just at about 1,000 MB/s, and it stays the cheaper buy unless you want the T7 Shield’s tougher shell.
Crucial rates the 2TB model at 2,100 MB/s read and 2,000 MB/s write over USB 3.2 Gen 2×2, with an IP55 rating and a 2 m drop rating, and its product page lists Linux among the supported systems. The part that matters for running an OS or copying a library is what happens after the cache fills. Tom’s Hardware measured it holding between 1,750 and 1,780 MB/s for just over 11 minutes before it settled in the 1,400 MB/s range, which is better sustained behaviour than most drives in this class. There is no hardware encryption to worry about, so you format it with LUKS and move on. Crucial’s footnote says full Gen 2×2 speed needs a USB-C host, so use the included C-to-C cable. It was about $365 for 2TB and in stock when we checked, with a 5-year warranty.
Get the Samsung T7 Shield for any USB port
The T7 Shield is the safe choice when you do not know what port you will plug into next. It’s a 10 Gbps drive, which any USB 3.2 Gen 2 port and most Thunderbolt and USB4 ports run at full speed, so you never pay for bandwidth you can’t reach. Look elsewhere if price matters more than toughness, because the X10 Pro was about a quarter cheaper at 2TB and matches the T7 Shield on a 10 Gbps port.
Samsung rates it at 1,050 MB/s read and 1,000 MB/s write, and the rubber body carries an IP65 rating and a 9.8 ft drop rating. Tom’s Hardware notes Samsung’s own figure of about 1,000 MB/s sustained writes on the 2TB model, so the speed doesn’t fall off a cliff halfway through a backup. Its AES 256 password feature needs Samsung Magician, which only ships for Windows, macOS and Android, so on Linux you’ll ignore it and use LUKS. The 2TB model was about $500 and listed as low stock on 27 October 2026, more than the 20 Gbps picks, so you’re paying for the shell. Check whether the 1TB fits your needs first. It carries a 3-year warranty.
Pick the Kingston XS2000 for pocket speed
The XS2000 is for you if size matters as much as speed. It measures 69.5 x 32.6 x 13.5 mm and 28.9 g, and it still hits 20 Gbps speeds on the right port. It’s the wrong pick if you need encryption beyond LUKS or a drive that shrugs off a fall onto concrete, since the rubber sleeve is the only armour.
Kingston’s datasheet rates the 2TB model at 2,000 MB/s read and write, gives it IP55 with the sleeve on, and lists Linux kernel 2.6.x or newer as supported. StorageReview measured 1,987 MB/s read and 1,792 MB/s write on the 1TB model, close to the rating. It comes with a short C-to-C cable and has no hardware encryption at all, which on Linux is no loss. It was about $360 with low stock when we checked, and Kingston backs it for 5 years.
Use the Samsung T9 for large copies
The T9 is the drive to pick if you want Samsung’s 20 Gbps model for camera footage, VM disk images or a home directory backup. Samsung gives the 2TB model an 88 GB write buffer, so copies up to that size run at full speed and larger ones slow down once it fills. Skip it if the listing still shows a future ship date when you buy, because it was not plainly in stock on Amazon when we checked.
Samsung rates the 2TB T9 at up to 2,000 MB/s read and 1,950 MB/s write over Gen 2×2, with a 3 m drop rating and a 5-year warranty. StorageReview measured 1,566 MB/s read and 1,582 MB/s write on the 4TB model, which has the largest buffer at 180 GB; the 2TB gets 88 GB per Samsung’s launch specs. Like the T7 Shield, its encryption depends on Magician, so plan on LUKS. If you’re curious how it fares for media work, our Samsung T9 review goes deeper. It was about $430 for 2TB.
Use the Apricorn Aegis Padlock for encryption
A keypad drive is the one kind of hardware encryption that works the same on Linux as anywhere else. You type the PIN on the drive, it unlocks itself, and only then does your computer see a USB disk. Pick it if you hand drives to colleagues on Windows or macOS, or can’t install software on the machines you plug into. Pass on it if you only use Linux, because LUKS on a fast drive gives you strong encryption at a fraction of the cost.
Apricorn describes the Padlock SSD as software-free and OS agnostic, naming Windows, Linux, Mac, Android and Chrome. It uses 256-bit AES-XTS encryption with FIPS 140-2 Level 2 validation (certificate #4528). NIST moved all FIPS 140-2 certificates, this one included, to the Historical list in September 2026, so if a policy asks for validated encryption on a new purchase, check for FIPS 140-3 instead. The trade-off is speed: it’s a 5 Gbps drive rated at up to 350 MB/s, and StorageReview measured 338 MB/s read and 314 MB/s write. The USB cable is built in, the shell is rated IP66, and the warranty runs 3 years. It sold for about $745 at 1TB. A 2TB version exists at about $1,330. If you’d rather have a touchscreen than a keypad, the Kingston IronKey Vault Privacy 80 External SSD is also OS independent per Kingston’s datasheet (FIPS 197, XTS-AES 256), runs at 250 MB/s over USB 3.2 Gen 1, and was about $495 for 960GB.
Check the port before you pay for 20 Gbps
A USB 3.2 Gen 2×2 drive only reaches its 2,000 MB/s on a host port that also speaks Gen 2×2, and that port is rarer than the drive. Gen 2×2 is optional in USB4, Thunderbolt ports often run USB storage at 10 Gbps, and owners have reported a T9 linking at 10 Gbps on a Thunderbolt 4 port. Crucial’s own footnote says full Gen 2×2 speed needs a USB-C host. So before spending extra on a 20 Gbps drive, find out what your port actually negotiates.
Plug the drive in and list the USB tree. The number at the end of the drive’s line is the link speed in Mbit/s, and it’s the most honest spec sheet your laptop has:
lsusb -tRead the Mass Storage line like this:
- You’re on a 20 Gbps link if the speed starts with 20000M, so a Gen 2×2 drive can run at full speed.
- You’re on 10 Gbps if it reads 10000M, which caps any drive here at roughly 1,000 MB/s.
- You’re on 5 Gbps if it reads 5000M, which is normal for the Apricorn but on the other drives usually means a USB-A port, a hub or a cheap cable is in the way.
- You have UAS if the driver reads
uas, whileusb-storagemeans the slower Bulk-Only transport and no TRIM by default.
If you see 10000M on a laptop with only Thunderbolt or USB4 ports, the X10 Pro and T9 will still work at about 1,000 MB/s. At that point you’re choosing on price and toughness, and a good 10 Gbps NVMe enclosure is worth a look too.
Enable TRIM over UAS
TRIM over USB works only when the bridge chip reports that it accepts the SCSI UNMAP command and the kernel believes it. When it doesn’t, the drive still mounts and copies files, so nothing warns you that deleted blocks are piling up. The Arch Wiki SSD page puts it plainly: the kernel may not automatically detect this capability. Our UAS and TRIM lab write-up shows why with captures from both drivers. Here you’ll just check it and fix it.
Start by asking the kernel what it thinks of the drive. Our lab disks show 4K and 1G in the discard columns, which is what a drive with working TRIM looks like:
lsblk --discard /dev/sda /dev/sdbBoth lab disks report a discard granularity and a maximum, so TRIM requests will go through:
NAME DISC-ALN DISC-GRAN DISC-MAX DISC-ZERO
sda 0 4K 1G 0
sdb 0 4K 1G 0If your USB drive shows 0B in DISC-GRAN and DISC-MAX instead, read /sys/block/sda/device/scsi_disk/*/provisioning_mode. A value of full means the kernel turned TRIM off. Before you force it on, the Arch Wiki has you confirm the bridge really accepts UNMAP, because forcing it on a bridge that doesn’t can cause I/O errors. Install sg3-utils and check that LBPU is set to 1 in the output (newer builds print it as Unmap command supported (LBPU): 1):
sudo apt install sg3-utils
sudo sg_vpd -a /dev/sda | grep LBPUWith LBPU=1 confirmed, a udev rule can switch the mode to unmap every time you plug the drive in. You need the drive’s USB vendor and product ID for the rule, which lsusb prints. The usb.ids database on Ubuntu lists some Samsung IDs, and 4001 is the T7:
awk '/^04e8/{f=1;print;next} /^[0-9a-f]/{f=0} f && /T7|T9|SSD|PSSD/' /usr/share/hwdata/usb.idsThe PSSD T7 line is the one the rule below matches. The YP-T7 and YP-T9 lines are old Samsung MP3 players, not the SSDs, and the T7 Shield and T9 have no entry here, so take the ID from lsusb on your own drive:
04e8 Samsung Electronics Co., Ltd
4001 PSSD T7
5027 YP-T7
503d YP-T7F
5055 YP-T9
507f YP-T9J
61f3 Portable SSD T3 (MU-PT250B, MU-PT500B)
61f5 Portable SSD T5
8002 Portable SSD 500GB Model Number: MU - P8500B
8003 Portable SSD T1Create the rule file:
sudo vim /etc/udev/rules.d/50-usb-ssd-trim.rulesAdd one line, with your drive’s vendor and product ID in place of 04e8 and 4001:
ACTION=="add|change", ATTRS{idVendor}=="04e8", ATTRS{idProduct}=="4001", SUBSYSTEM=="scsi_disk", ATTR{provisioning_mode}="unmap"Check the syntax before you rely on it. A typo in a udev rule fails silently, so this is the step people skip and regret:
udevadm verify /etc/udev/rules.d/50-usb-ssd-trim.rulesA clean file reports one success and no failures:
1 udev rules files have been checked.
Success: 1
Fail: 0Reload the rules, then unplug and replug the drive (or run sudo udevadm trigger) and check lsblk --discard again. Non-zero values mean you’re done:
sudo udevadm control --reload-rulesOne more catch is the weekly timer. Ubuntu enables fstrim.timer, but the service it starts only trims what’s in /etc/fstab and stays quiet about devices that can’t trim:
systemctl cat fstrim.service --no-pager | grep -E '^ExecStart'The --quiet-unsupported flag hides failures, and per the fstrim man page --listed-in uses the first non-empty file it’s given, which is /etc/fstab on most systems:
ExecStart=/sbin/fstrim --listed-in /etc/fstab:/proc/self/mountinfo --verbose --quiet-unsupportedA portable drive that your desktop auto-mounts isn’t in fstab, so the timer never touches it. Run sudo fstrim -v on its mount point after big deletes, or add it to fstab with nofail if it lives on one machine.
Use LUKS instead of vendor encryption
Hardware encryption versus LUKS is an easy call on Linux: unless the drive has its own keypad or touchscreen, LUKS is the only one you can unlock. Samsung’s portable SSD security software is now part of Magician, which ships for Windows, macOS and Android, and SanDisk’s password software targets Windows and macOS. LUKS works on every Linux machine, desktop file managers such as GNOME Files ask for the passphrase when you plug the drive in, and with AES-NI the cost is small.
Formatting wipes the drive, so confirm the device name first. In our lab the two portable disks were sda and sdb, and the serial column is what tells them apart from the internal disk:
lsblk -o NAME,SIZE,SERIAL,ROTA,DISC-GRAN,DISC-MAXThe internal disk here is vda, and the two 8G disks are the targets. On a laptop the internal drive is usually nvme0n1, but on many desktops sda is the system disk, so match your USB SSD by its real size and serial before you go on:
NAME SIZE SERIAL ROTA DISC-GRAN DISC-MAX
sda 8G PORTSSD01 0 4K 1G
sdb 8G PORTSSD02 0 4K 1G
sr0 4M QM00003 1 0B 0B
vda 20G 1 512B 2G
├─vda1 18.9G 1 512B 2G
├─vda13 1023M 1 512B 2G
├─vda14 4M 1 512B 2G
└─vda15 106M 1 512B 2GA new drive arrives with a partition and an exFAT file system, and your desktop mounts it the moment you plug it in. cryptsetup refuses to format a disk with a mounted partition, so the first attempt on a factory drive fails. We repartitioned a lab disk the way drives ship and mounted it under /media to show it:
sudo cryptsetup luksFormat /dev/sdacryptsetup warns about the existing partition table and takes your YES and passphrase, then stops because the partition is mounted:
WARNING: Device /dev/sda already contains a 'gpt' partition signature.
WARNING!
========
This will overwrite data on /dev/sda irrevocably.
Are you sure? (Type 'yes' in capital letters): YES
Enter passphrase for /dev/sda:
Verify passphrase:
Cannot exclusively open /dev/sda, device in use.Unmount every partition on the drive (a “not mounted” message for one of them is harmless), then clear the old partition table so it doesn’t linger next to the LUKS header. wipefs lists each signature it erases, including the backup GPT at the end of the disk:
sudo umount /dev/sda?*
sudo wipefs -a /dev/sdaThree signatures go, and the kernel re-reads the now empty disk:
/dev/sda: 8 bytes were erased at offset 0x00000200 (gpt): 45 46 49 20 50 41 52 54
/dev/sda: 8 bytes were erased at offset 0x1fffffe00 (gpt): 45 46 49 20 50 41 52 54
/dev/sda: 2 bytes were erased at offset 0x000001fe (PMBR): 55 aa
/dev/sda: calling ioctl to re-read partition table: SuccessNow create the LUKS2 container, replacing sda with the device you just confirmed. You’ll type YES in capitals, then the passphrase twice:
sudo cryptsetup luksFormat /dev/sdaThe prompts look like this, and the passphrase doesn’t echo:
WARNING!
========
This will overwrite data on /dev/sda irrevocably.
Are you sure? (Type 'yes' in capital letters): YES
Enter passphrase for /dev/sda:
Verify passphrase: With cryptsetup 2.8 the defaults are LUKS2, aes-xts-plain64 with a 512-bit key, and argon2id for the passphrase, so there’s nothing to tune. Open the container and look at what Linux now sees:
sudo cryptsetup open /dev/sda portable
lsblk --discard /dev/sdaPeople get caught out right here. The raw disk still supports discard, but the encrypted mapping on top of it reports 0B:
NAME DISC-ALN DISC-GRAN DISC-MAX DISC-ZERO
sda 0 4K 1G 0
└─portable 0 0B 0B 0That is dm-crypt blocking TRIM by default, on purpose. Make a file system, mount it and try a trim to see the result for yourself:
sudo mkfs.ext4 -L portable /dev/mapper/portable
sudo mkdir -p /mnt/portable
sudo mount /dev/mapper/portable /mnt/portable
sudo chown "$USER": /mnt/portable
sudo fstrim -v /mnt/portableThe trim fails even though the SSD underneath supports it:
fstrim: /mnt/portable: the discard operation is not supportedOne command solves it. Per the cryptsetup-refresh man page, it turns discards on for the open mapping and stores the flag in the LUKS2 header, so you will never have to pass it again. It asks for the passphrase once:
sudo cryptsetup refresh --allow-discards --persistent portableThe before and after on the lab drive:
After the refresh, the header’s Flags line reads allow-discards, the mapping reports 4K and 1G, and fstrim releases 7.8 GiB. To prove it sticks, close the container, open it again with no extra flag and read the device-mapper table:
sudo umount /mnt/portable
sudo cryptsetup close portable
sudo cryptsetup open /dev/sda portable
sudo dmsetup table portableThe allow_discards at the end of the line came from the header, not from any flag we typed:
0 16744448 crypt aes-xts-plain64 :64:logon:cryptsetup:8aa70826-e244-424e-b44f-8384878da79e-d0 0 8:0 32768 1 allow_discardsThe cryptsetup man page warns that allowing discards can make file system activity visible on the device, such as which blocks are free, though not what’s stored in them. For a backup or travel drive that’s a fair trade for an SSD that stays fast, but if you’re protecting against someone imaging the drive and studying its free space, leave it off. You can check what encryption costs on your own CPU, too:
cryptsetup benchmark -c aes-xts-plain64 -s 512Our lab host is an older Core i7-6700, and it still encrypts at about 2,340 MiB/s in memory:
# Tests are approximate using memory only (no storage IO).
# Algorithm | Key | Encryption | Decryption
aes-xts 512b 2339.9 MiB/s 2347.1 MiB/sThat is above the rated speed of every drive on this page, so LUKS won’t be your bottleneck on a CPU with AES-NI. Running grep -o -m1 -w aes /proc/cpuinfo prints aes if yours has it. If you’d like the drive to unlock without typing at all on your own laptop, the same LUKS container can be tied to a TPM, as in our LUKS and TPM2 guide, though for a drive you carry around a passphrase is the safer habit.
Choose ext4 or exFAT
Use ext4 for a drive that only ever meets Linux, and exFAT for a drive you share with Windows or macOS. exFAT has been in the mainline kernel since Linux 5.7, so any current distro reads and writes it. It has no Linux permissions or symlinks, though. That matters more than people expect, and the lab shows how. Unmount and wipe the drive first as in the LUKS section, then format it as exFAT, again replacing sdb with your own device. If you’ll share it with Windows, create the partition from the list further down first and format /dev/sdb1 instead. The tool comes from the exfatprogs package, which minimal installs may need to add with sudo apt install exfatprogs:
sudo mkfs.exfat -L SHARED /dev/sdbexfatprogs discards the whole device first, which is a free TRIM on a new drive:
exfatprogs version : 1.3.2
Discarding blocks: done
Creating exFAT filesystem(/dev/sdb, cluster size=32768)
Writing volume boot record: done
Writing backup volume boot record: done
Fat table creation: done
Allocation bitmap creation: done
Upcase table creation: done
Writing root directory entry: done
Synchronizing...
exFAT format complete!Mount it the obvious way with sudo, then try to create a file as your normal user:
sudo mkdir -p /mnt/shared
sudo mount /dev/sdb /mnt/shared
touch /mnt/shared/test.txtYou’ll get a permission error, because a root mount makes root the owner of every file and exFAT has nowhere to store anything else:
touch: cannot touch '/mnt/shared/test.txt': Permission deniedUnmount and mount it again with your own user and group IDs, which is what your desktop does for you when it auto-mounts the drive:
sudo umount /mnt/shared
sudo mount -o uid=$(id -u),gid=$(id -g),umask=022 /dev/sdb /mnt/shared
touch /mnt/shared/test.txt && ls -l /mnt/sharedNow the file belongs to you. Notice the execute bits on a plain text file, because exFAT can’t store Unix permissions and every file shows the mount’s mask:
total 0
-rwxr-xr-x 1 lorna lorna 0 Oct 27 08:55 test.txtSymlinks do not work at all, which breaks rsync backups of a home directory and most dotfile setups:
ln -s test.txt /mnt/shared/linkThe error says permission, but the real reason is that exFAT has no symlink type:
ln: failed to create symbolic link '/mnt/shared/link': Permission deniedPick the file system by what the drive will do:
- You should pick ext4 for backups, a Linux install or anything with symlinks and permissions.
- You should pick exFAT for a drive that moves files between Linux, Windows and macOS.
- You should give a shared exFAT drive a partition table first with
sudo parted -s /dev/sdb mklabel gpt mkpart SHARED fat32 0% 100%and format/dev/sdb1, because Windows only gives a drive letter to a basic data partition, which the fat32 type sets. - You should reformat a new drive before using it as a backup target, because many ship as exFAT, the Crucial X10 Pro included.
To turn the same drive into an ext4 backup target, unmount it and format it again. Replace sdb with your own drive, because this wipes it:
sudo umount /mnt/shared
sudo mkfs.ext4 -L backup /dev/sdbOn a terminal, mkfs.ext4 first warns that the disk holds an exFAT file system and asks you to confirm with y. It then discards the device before writing the file system:
mke2fs 1.47.2 (1-Jan-2025)
Discarding device blocks: done
Creating filesystem with 2097152 4k blocks and 524288 inodes
Filesystem UUID: 90156797-465a-43aa-89a1-e4253c1b0c64
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632
Allocating group tables: done
Writing inode tables: done
Creating journal (16384 blocks): done
Writing superblocks and filesystem accounting information: doneOne setting is worth changing on a data-only ext4 drive. mkfs.ext4 reserves 5% of the blocks for root. On our 8 GiB lab disk that was 104,857 blocks, and on a 2TB drive it is about 100 GB you can’t use. A portable drive does not need that reserve, so drop it:
sudo tune2fs -m 0 /dev/sdbtune2fs confirms the change, and the space is yours straight away:
tune2fs 1.47.2 (1-Jan-2025)
Setting reserved blocks percentage to 0% (0 blocks)Keep the reserve on a drive that holds a running Linux install, where it stops a full disk from locking root out. If you’d rather keep backups on spinning disks, our external hard drive picks for Linux backups cover the cheaper per-terabyte option.
Run Linux from an external SSD
A 20 Gbps SSD is fast enough to run a full Linux install from USB, and even the X10 Pro’s 1,400 MB/s floor after its cache fills is well above the roughly 600 MB/s ceiling of a SATA SSD. The X10 Pro is the best external SSD for running Linux in this list, with the T7 Shield as the pick when you’ll boot it on machines whose ports you don’t know. A live USB is a different thing: it boots an ISO and forgets your changes, and a cheap stick handles it fine. Our Ventoy multi-boot guide covers that.
A full install to an external drive has one trap: the installer may put the bootloader on your internal disk’s EFI partition, so the external drive won’t boot anywhere else and the laptop stops booting without it. Avoid it with these steps:
- You can unplug or disable the internal drive during the install, which leaves the installer only one EFI partition to choose.
- You should create an EFI system partition on the external SSD itself if the installer offers manual partitioning.
- You can install GRUB with the
--removableoption, which the Arch Wiki GRUB page describes as writing toEFI/BOOT/BOOTX64.EFIso the drive boots on another computer even without its own boot entry. - You should mount by UUID in fstab, never by /dev/sdX, because the device name changes from one machine to the next.
- You’ll need the TRIM udev rule inside the initramfs too if the root file system is LUKS on a drive that needs it, as the Arch Wiki SSD page notes, or TRIM stays off for root.
We couldn’t find official Ubuntu or Fedora documentation on bootloader placement for external targets, so the reports you’ll find come from users who hit it. Checking with lsblk and the installer’s summary screen before you click Install is the cheapest insurance you’ll get.
Common questions about portable SSDs on Linux
Does TRIM work over USB on Linux?
Yes, if the drive runs on the uas driver and its bridge reports UNMAP support. Check with lsblk --discard: non-zero DISC-GRAN and DISC-MAX mean it works. If they’re 0B, set provisioning_mode to unmap with the udev rule above, and remember that a LUKS container also needs --allow-discards.
Can I use Samsung or SanDisk hardware encryption on Linux?
Not in a practical way. The password tools for Samsung’s T7 Shield and T9 and for SanDisk’s drives ship for Windows and macOS (Samsung adds Android), with no Linux build. Use LUKS on those drives, or buy a keypad or touchscreen drive such as the Apricorn Padlock or the IronKey Vault Privacy 80, which unlock before the computer ever sees them.
Do I need to format a new portable SSD before using it on Linux?
You do not have to, since Linux reads the factory exFAT. You should, though, if it’s going to hold backups or a Linux install, because exFAT can’t store permissions or symlinks. Reformat it as ext4, or as LUKS with ext4 inside if it leaves the house.
Is a 20 Gbps drive worth it on a Thunderbolt laptop?
Often not. Many Thunderbolt and USB4 ports run USB drives at 10 Gbps, so a Gen 2×2 drive runs at 10 Gbps speed there. Run lsusb -t with the drive plugged in. If the speed reads 10000M, buy whichever drive is cheaper on the day, or look at a Thunderbolt NVMe enclosure instead.
