Disk encryption is a special case of data at rest protection when the storage media is a sector-addressable device (e.g., a hard disk).

learn more… | top users | synonyms

3
votes
1answer
2k views

Full Disk Encryption within a VM, how secure is it?

Just a quick query on basically how to secure a VM for a home computer for a number of uses (such as securing work related data in a good enough fashion whilst in its native environment). I'm not ...
3
votes
3answers
2k views

Securing my USB flash drive with Truecrypt and FreeOTFE

I want to know if I encrypt my flash with Truecrypt "Encrypt a non-system partition/drive" option and then mount it and then make a container with FreeOTFE on the Truecrypt encrypted drive and then ...
2
votes
1answer
403 views

Is Dual Factor possible during boot with whole disk encryption on Mac FileVault 2

Mac FileVault 2 is the default disk encryption for newer Macs that occurs in the EFI pre-boot phase. The challenge here is that most smartcard drivers are loaded after the OS loads. Is anyone aware ...
0
votes
1answer
806 views

Another method to erase hard drives securely? [duplicate]

Possible Duplicate: Use truecrypt to make data unrecoverable The other day I was thinking, and I looked up this question because I was pretty sure a question similar to this had been asked. ...
1
vote
1answer
97 views

Determing and deciphering an encrypted drive (knowing the password)

I have a Western Digital external drive (my passport essential 500GB), which comes with a little software that allows you to encrypt your data (which I did sometime ago). Unfortunately, this software ...
3
votes
2answers
570 views

Possible implementations of networked+encrypted filesystem

Is it possible to implement scheme where remote server just share its filesystem (or resizable container file in it) and it's locally encrypted and mounted? And what is best practical method? (On ...
9
votes
7answers
1k views

Encrypt Virtual Machine in the cloud

I am no expert when it comes to security in virtualized environments. However a problem I always saw is: What happens if the host OS gets hacked and an attacker gains administrative privileges? How ...
4
votes
1answer
724 views

Can a Bitlocker To Go user pin be brute forced?

I have a external hard disk and protected a partition on it with Bitlocker To Go. I printed the recovery code but I lost it. I can't remember the user PIN either. If I could only know the first ...
3
votes
1answer
401 views

Does setting a firmware password add security if FileVault 2 is enabled?

On an up-to-date OS X computer with FileVault 2 (whole-disk encryption, minus the recovery partition), is any security gained by setting a firmware password, as well?
4
votes
2answers
3k views

What does HP DriveLock do to your password?

While looking at various hard drive encryption methods, I discovered that HP's "DriveLock" is not quite the standard ATA security system. While I did get confirmation from HP that it does indeed use ...
10
votes
6answers
5k views

How secure is FileVault 2 while the computer is in sleep mode?

How secure is Apples disk encryption FileVault 2 when someone has physical or network access while the computer in sleep mode or is running a screen saver? Are there ways to circumvent FileVault 2 ...
4
votes
2answers
476 views

Detect changes in /boot when using full disk encryption

When running a fully encrypted linux system using dm-crypt, the /boot partition has to be unencrypted to boot, as far as I know. I've setup a server that can be unlocked remotely by connecting to a ...
2
votes
1answer
296 views

How does disk encryption mounting work with large disk and low RAM?

For example with Truecrypt or bitlocker, when my hard disk contains 500 GB encrypted data and 256 MB Free RAM, how is the data decrypted/disk mounted when I turn on my computer? If the entire disk is ...
2
votes
1answer
345 views

Is using decrypt_derived more secure than a keyfile?

Say I have two partitions on a Linux system, a root partition (/) and a /home partition. Both of them are encrypted with LUKS. The /home partition needs only to be decrypted if / is unlocked and ...
3
votes
1answer
566 views

Reasonable (BruteForce) Attempts/Second Estimate?

I've read various articles on password strength and passwords vs pass phrases (including the one from XKCD and its thread here), but most of those articles seem to be focused on online passwords, and ...
18
votes
4answers
12k views

Multi-boot with full hard drive encryption and pre-boot authentication

How would I set up a multiboot system which supports full hard drive encryption and pre-boot authentication. I have a system with Ubuntu, Windows 7, Windows XP, and I would like to install Red Hat. ...
5
votes
2answers
3k views

Full disk encryption and multi-factor authentication

All serious full disk encryption schemes I have looked into use a static password for authentication. For example, TrueCrypt supports two-factor authentication with keyfiles, but not for system ...
6
votes
7answers
4k views

Physical computer security, how to disable USB ports when the computer is 'locked'?

Lets say my PC & server is in an environment where a theoretical attacker has physical access to the machine while I'm not there. Now the data is encrypted on the hard drive with TrueCrypt. ...
0
votes
2answers
389 views

In TrueCrypt Hidden / Normal overriding?

If I have a normal TrueCrypt volume, and I want to create a Hidden volume inside of it, how do I stop the 2 from overriding each other? Or do I just have to manually make sure the inner volume does ...
7
votes
3answers
377 views

Erasing a hard-disk, encrypting it as alternative?

I was pondering about this, sometimes people ask me to erase data on their drive. So I use a shredding program, which takes a long time. However what if instead of shredding all the files, I'd just ...
5
votes
3answers
3k views

TrueCrypt -vs- MacOS encrypted sparse image - equally secure? Other alternatives?

I'm currently trying to find my personal best solution for storing passwords and other sensible data. Recently I've used 1Password on iPhone and Mac but I'm not really satisfied with its predefined ...
4
votes
2answers
264 views

Securing data on laptop's hdd

I was wondering which is the best way to secure/encrypt data in the hard disk on a laptop that runs Ubuntu Oneiric? Setting LVM encryption? I am mostly concerned about having my laptop lost or what ...
5
votes
1answer
2k views

Device versus file based encryption in TrueCrypt for a flash drive?

Are there security tradeoffs to be considered in deciding between encrypting an entire flashdrive with TrueCrypt versus storing a file encrypted container? The security goal is to be immune to the ...
4
votes
2answers
3k views

How expensive is it to guess a 15 character password, and should I be worried?

I'm currently using AES encryption (at home) on GNU/Linux (one of LUKS AES-256 variants with xts) and on Windows 7 (Truecrypt) with a 15 characters password (alphanumeric lowercase only plus _). ...
3
votes
2answers
240 views

Advice on buying an encrypted disk

How do I find an encrypted disk to buy? What factors should I be aware of in selecting one? Is there any proof that buying one likely to draw any attention? How do I know there's not a backdoor? ...
5
votes
4answers
346 views

How do you guarantee that you don't lose a keyfile?

I am toying with the idea of adding keyfiles to various things that I encrypt. However what's been keeping me from adopting them is guaranteeing that I don't lose the keyfile while still keeping ...
4
votes
4answers
773 views

Are backups of truecrypt volumes with different pass phrases a security risk?

Lets say that I periodically change the pass-phrase on a truecrypt volume. The volume is regularly backed up, so my backup system has many copies of that volume, many of which have a different volume ...
4
votes
2answers
749 views

What cryptographic module does Sql Server 2008 use to run in Fips 140-2 compliant mode by default?

One can configure Sql Server 2008 to run in FIPS 140-2 compliant mode, in the same manner as running Bitlocker in FIPS 140-2 compliant mode. Which is to activate FIPS 140-2 compliant mode in the ...
2
votes
2answers
270 views

What does “if the Crypto Officer performs this operation” mean in this BitLocker security policy?

In the document Windows Server 2008 R2 BitLockerâ„¢ Drive Encryption Security Policy For FIPS 140-2 Validation, in the section 6.1.2 FIPS 140-2 Security Rules bullet point 2 it says: BitLockerâ„¢ will ...
6
votes
2answers
1k views

Is BitLocker on a virtual machine still FIPS 140-2 compliant?

BitLocker can be used as a cryptographic module to fulfill FIPS 140-2 security level 1 compliance. In a common setup, USB thumb drives can be used to unlock drives encrypted by BitLocker on startup. ...
43
votes
7answers
54k views

Are there actually any advantages to Android full-disk encryption?

So, since Android 3, devices can perform boot-time, on-the-fly encryption/decryption of the application storage area (NOT the SDcard/removable storage) - essentially full-disk encryption. This ...
0
votes
3answers
1k views

Why do some LUKS tutorials mention overwriting the partition with random data?

On a lot of tutorials on luks encryption, people say to override the partition with random data, so that data is not recoverable after encryption. I don't understand that. Will the random data be ...
4
votes
1answer
3k views

Is it possible to auto mount entire truecrypt drive

Truecrypt can easily automount if your drive is not entirely encrypted and your data is a standard file. However I have my entire removable storage encrypted and so to the OS, it is seen as an ...
3
votes
3answers
392 views

Encrypting an email server's local drives or filesystems

Planning to deploy a remote hosted mailer (Zimbra based) I need to make sure the local data on the machine is encrypted. Currently, the plan is to use the built in LUKS to encrypt /opt/zimbra and ...
6
votes
1answer
2k views

loop-aes or dm-crypt for linux hard encryption?

loop-aes and dm-crypt are both used by partman-crypto for linux hard encryption, but dm-crypt needs no patch to kernel and is more supported. dm-crypt keeps it's key on first hard block, is it a ...
6
votes
3answers
2k views

Is it possible to infer that a hidden truecrypt partition is likely to be present

Truecrypt contains a feature that let's you create a hidden volume. It's said that it can't be proven if a hidden volume exists. However, is it possible to infer from the state of the data on the ...
11
votes
5answers
3k views

What does Amazon's S3 Server-side encryption protect against?

Amazon's S3 storage service offers server-side encryption of objects, automatically managed for the user (Amazon's Documentation). It's easy to enable so I'm thinking "why not?", but what kind of ...
2
votes
2answers
474 views

How to make a certificate encrypted flash drive?

I was wondering if it possible to encrypt a flash drive (or any other external medium) using certificates instead of a password. The idea is to have a number of encrypted pendrives that can be used on ...
5
votes
2answers
910 views

Have anyone tried to extract the encryption key from a SSD?

After reading this forum thread it does not sound like encrypted SSDs provide much protection at all - specifically encryption only occurs between the controller chipset and the NAND storage. Why is ...
10
votes
5answers
10k views

How secure is NTFS encryption?

How secure is the data in a encrypted NTFS folder on Windows (XP, 7)? (The encryption option under file|folder -> properties -> advanced -> encrypt.) If the user uses a decent password, can this ...
4
votes
1answer
351 views

How to encrypt an entire portable HDD, so that it cannot be read/written without the password for it?

I use a portable USB drive (Seagate FreeAgent Go Flex) to keep all my personal stuff, and though the HDD company does offer a password scheme to control access to it, that would work only on windows, ...
5
votes
5answers
1k views

Is there any way to write-protect a USB or hide its contents from deletion without hardware modifications?

Data on external storage devices are not secure, I understand that. Despite hardware modifications they can still be hacked etc. However files can be hidden (steganography) or encrypted. I'm ...
2
votes
1answer
408 views

NFS and encrypted File systems

Can a NFS mounted file system be used for encrypted /home, and can the encrypted Home Directories be mounted/decrypted for the user when they login?
6
votes
3answers
1k views

SSD (Flash Memory) security when data is encrypted in place

I'm surveying current techniques on flash memory security. I've learned that the non-in-place update of flash memories prevent us from adapting the same encryption techniques that we used on hard ...
7
votes
7answers
1k views

Is there any asymmetrically encrypted file system?

Is there a file system providing a directory where everybody can write, but only the directory owner can read the files? In theory it could be done by encrypting using the public key while writing, ...
6
votes
2answers
685 views

Do Flash memory (SSD) architecture impacts encryption techniques?

I'm working on encryption techniques on SSD's and my question is: does the erase before write architecture of SSD's has anything to do with the encryption technique? What are the problems I might ...
3
votes
2answers
2k views

Truecrypt hidden partition deleted original drive data

Help! I created a hidden partition within a harddrive encrypted using truecrypt, and instead of creating a second partition, it seems to have deleted all of my data instead. what did i do wrong? I ...
9
votes
2answers
3k views

For LUKS: The most preferable and safest cipher?

I'm about to encrypt two of my hard drives using LUKS, since I can't really do it myself I use the guide on the Arch Linux wiki (which can be found here). In an example in the guide the cipher ...
4
votes
2answers
134 views

Can my /boot be compromised if I Suspend my notebook?

So if I use e.g.: LUKS, and I always suspend my notebook, then are there any methods to modify the unencrypted /boot? It contains the kernel! Or if someone tries (evil maid) to modify the /boot then ...
6
votes
1answer
2k views

Using TPM for full disc encryption?

E.g.: Can I make a better full disc encryption with e.g.: LUKS using the TPM? How?