Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Assume one day you receive the following error from TrueCrypt:

enter image description here

is that a reason to worry that someone may have removed the disk (in my case disk 0) and used it offline and then put it back into the laptop or am I too paranoid?

Note: the above option fixed it, but the question is what would disable the automatic mounting in the first place. Especially since we're talking about the boot drive here.

Also note: I am using Intel Matrix RAID to cache the boot drive, in case that changes something.

share|improve this question
add comment

1 Answer

I did some digging and it turns out if this is your main hard disk (containing the partition of the OS), it is highly unlikely that removal and reattachment to your laptop would leave anything but a physical trace.

Unless you keep track of the HDD S.M.A.R.T counters for how many times the device has been powered up (Which we normally don't keep track of), before and after your suspected problem its difficult to say if the drive was removed and accessed offline.

And paranoia is always relative to risk. In some cases you DO need to be paranoid. But as long as you are using a decently strong Encryption Key and do the best to make sure that no one else has access to that key, you should be fine as brute-forcing a strong key would in any case take a considerable amount of time.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.