Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it possible to combine the security of full-disk encryption (e.g. Truecrypt) with the honeypot-like performance of anti-theft tools (e.g. Prey)?

In other words, is it feasible to have both strong encrption and a hope of locating one's laptop were it to be lost or stolen, or is this akin to "having one's cake and eating it too?"

It seems to me that the very nature of full-disk encryption necessarily prohibits one from implementing a Prey-like approach to notebook recovery.

share|improve this question

2 Answers 2

up vote 7 down vote accepted

Disk encryption is about preventing access to data, unless a specific authentication token (e.g. a password) is presented. Full disk encryption is about doing that on the whole disk, including the OS, so the machine won't even boot without the password. If it does not boot, then, in particular, Prey won't work.

What you can do is to allow the machine to boot on a minimal OS which uses Prey and controls a virtual machine, which is the actual machine you use for all your usages. That VM will use full-disk encryption.

This should be doable with reasonably low overhead with Xen: a minimal low-RAM dom0 system, which runs Prey and has no disk encryption, and the actual domU system which allocates most of the physical RAM, contains your files and applications, and uses full disk encryption. Note: if you want to do that with Windows as domU, you will need a computer with supports the hardware x86 virtualization instructions (AMD-V, Intel VT-x...); this is not necessarily a given on Netbooks.

share|improve this answer
    
I like your thought process here... I am coming up with some exotic configurations and have thought of Xen, wouldn't mind comparing notes... Check out my profile for contact info. –  Tek Tengu May 4 '13 at 10:08

I remember hearing about LoJack for laptops in the past. I did some research, and they claim they have some BIOS-integrated feature that would allow tracking, I'm not sure if this could be succesfully combined with full disk encryption

From a PC Mag Review:

Persistence Furthers Along with the main application agent, LoJack includes an invisible component called the Persistence Module. This component is embedded in the BIOS of many computers from the company's OEM partners, which include Dell, Gateway, HP, and Lenovo, among others. Absolute software maintains a lengthy list of laptop models that include BIOS support.

The embedded software remains dormant until you install LoJack for Laptops and make a successful connection with the monitoring center. Once activated, the module monitors the system to make sure the application agent is present and running. If the thief wipes the hard drive or even replaces it with a different hard drive, this module restores the application agent. That's persistence!

I was hoping this was some GPS-enabled + pager sending chip, not just software. There seems to be a few other vendors with similar software. I found a similar discussion on this topic from Slashdot which may be useful. It would seem there may be some potential if you can get the protection to be implemented at the BIOS level, which then works even with a new hard drive.

Though, I would imagine backing up your data frequently/continuously and getting home or renters insurance will be cheaper and easier - just replace the laptop with a new one instead of recovering and reload your data without waiting for recovery of the protected physical asset.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.