Is a file shredder/secure erase necessary when you have full disk encryption turned on?

Question

The password manager that I use has instructions to migrate to a new file format:

• Export existing passwords to a temporary text file
• Change password manager to new format
• Import passwords from temporary text file
• Securely erase the temporary text file

My hard drive is an SSD (solid state drive), which has it's own issues when it comes to securely deleting files (see https://serverfault.com/questions/199672/secure-delete-on-ssd)

Given that I also have full disk encryption turned on, is it safe to just delete the text file normally?

Is there a more secure way to do this (use a RAM disk, export to USB stick then destroy USB stick after the data has been imported?)

Answer 1

I would still recommend using secure delete in your scenario. Should your machine be compromised when you are logged in (malware etc), full disk encryption will not protect you from a undelete operation via C&C malware for example.

SSDs have problems erasing files but a number of manufacturers provide utilities for their drives to securely erase a file and while not always perfect has been reviewed to perform well. Furthermore, if your drive supports TRIM, normal Windows 7+ delete should also function fine when the recycle bin is cleaned. This post helped me understand a lot more last year, hope it helps you: https://raywoodcockslatest.wordpress.com/2014/04/21/ssd-secure-erase/

As for a more secure way to delete the password file, sure there are plenty of other creative ways but that all depends on your appetite for pain.

Damn good question, thank you for that!

Answer 2

If you're concerned about a threat of a future compromise of the system and an attacker extracting the information, then secure delete will help, but you should also worry about things like search indexing (Spotlight/Windows search) and backup.

If the system is currently compromised, then the secure delete doesn't matter. Malware can read the plaintext passwords, and may have a function to scan newly created files. (Of course, if the system is currently compromised, then you're in a bad state regardless.)

If the system is not compromised, then FDE will probably protect you from losing the disk, but there are concerns. Searching on FDE forensics can be interesting, for example, http://articles.forensicfocus.com/2014/09/23/recovering-evidence-from-ssd-drives-in-2014-understanding-trim-garbage-collection-and-exclusions/

Answer 3

For a SSD disk it is probably not enough secure to delete or rewrite the file.

You can do following:

1. On your SSD you would need to rewrite with zeroes or random all free space (multiple times) after deleting the file, to be at least statistically close to be sure the data gets deleted. There are tools which offer such option. But you will be never sure 100% as switching write-blocks algorithms for each SSD can vary. (This can take a very long time depending on your drive size and amount of free space and can degrade your SSD HDD.)

2. Filling rest of your SSD HDD with a big files is a good option. DVD ISO file could be a good one. In that case no free blocks are available to be switched, so everything gets overwritten.

Carefully, some damn OS are sensitive for "no more space on disk C:". In that case a combination of 1) and 2) is an option for you as just a small part of the disk is cleared with zeroes multiple times.

If you are mad for security, better would be to:

3. Not to use your SSD HDD for file transfer, use an cheapest USB stick and scratch/destroy it afterwords (most quick way including anti-stressful hammering the stick) or

4. Use old good magnetic HDD via USB and securely delete the file traditional way. (standard time, in minutes it could be done)

If you already did the copying file to your SSD, unfortunatelly, options 3) and 4) will not help you.

My favorite is option 2) as you do not need anything else. Good luck with cleaning.

Answer 4

Certainly saving your passwords in clear text is not wise, especially on the SSD. You will have to securely erase the whole drive to get rid of the traces afterwards.

If you absoluetly have to deal with passwords in clear text, this site provides reasonable instructions on how to proceed. Basically, you'll need to create a temprary encrypted container and save your plain text passwords there, destroying the container once the import is done.

Using a RAM disk is not recommended, because I doubt ramdisk drivers are designed with security considerations in mind (e.g. is there a garantee that RAM drive contents are never swapped to SSD if you're low on memory?) I'd recommend at least disabling the swap during the migration if you choose to export to RAM disk.

Saving on a USB stick doesn't really solve the problem, but replaces it with a different one (how to securely erase the USB stick). Make sure you have the tools to securely erase the stick before you save your plaintext passwords on it.

As a final note, I'd suggest to simply avoid using password management tools which force you to export passwords to plain text during migration. For example, LastPass has an encrypted format for data interchange between different versions.