As a follow-up to the question in The DMZ, is an encrypted drive (full disk encrypted e.g. LUKS, BitLocker) protected against malware if it is not mounted when using a LiveCD?

The use case is if when no other devices are available and there is a need to inspect potentially malicious files.

The assumptions are;

• The malware is not designed to wipe drives and for malware to wipe a drive it must be executed on the host that has a decrypted volume/partition.
• When a drive is fully encrypted, there are no unencrypted blocks that the malware can write to without mounting the drive.
• Malware can only affect an encrypted drive if it is mounted decrypted.
• If malware is executed, when running a LiveCD, it is limited to memory and cannot affect firmware or BIOS.
• Methods such as dd are not considered to be part of the threat model.

Note: The use of drive is synonymous with disk for the avoidance of doubt.

As a follow-up to the question in The DMZ, is an encrypted drive (full disk encrypted e.g. LUKS, BitLocker) protected against malware if it is not mounted when using a LiveCD?

The use case is that no other devices are available and there is a need to inspect potentially malicious files.

The assumptions are;

• The malware is not designed to wipe drives and for malware to wipe a drive it must be executed on the host that has a decrypted volume/partition.
• When a drive is fully encrypted, there are no unencrypted blocks that the malware can write to without mounting the drive.
• Malware can only affect an encrypted drive if it is mounted decrypted.
• If malware is executed, when running a LiveCD, it is limited to memory and cannot affect firmware or BIOS.
• Methods such as dd are not considered to be part of the threat model.

Note: The use of drive is synonymous with disk for the avoidance of doubt.

As a follow-up to the question in The DMZ, is an encrypted drive (full disk encrypted e.g. LUKS, BitLocker) protected against malware if it is not mounted when using a LiveCD?

The use case is if when no other devices are available and there is a need to inspect potentially malicious files.

The assumptions are;

• The malware is not designed to wipe drives and for malware to wipe a drive it must be executed on the host that has a decrypted volume/partition.
• When a drive is fully encrypted, there are no unencrypted blocks that the malware can write to without mounting the drive.
• Malware can only affect an encrypted drive if it is mounted decrypted.
• If malware is executed, when running a LiveCD, it is limited to memory and cannot affect firmware or BIOS.

As a follow-up to the question in The DMZ, is an encrypted drive (full disk encrypted e.g. LUKS, BitLocker) protected against malware if it is not mounted when using a LiveCD?

The use case is if when no other devices are available and there is a need to inspect potentially malicious files.

The assumptions are;

• The malware is not designed to wipe drives and for malware to wipe a drive it must be executed on the host that has a decrypted volume/partition.
• When a drive is fully encrypted, there are no unencrypted blocks that the malware can write to without mounting the drive.
• Malware can only affect an encrypted drive if it is mounted decrypted.
• If malware is executed, when running a LiveCD, it is limited to memory and cannot affect firmware or BIOS.
• Methods such as dd are not considered to be part of the threat model.

Note: The use of drive is synonymous with disk for the avoidance of doubt.