Let's say I have to leave my computer unattended and turned off for a while with some strangers, is it possible for someone to clone my HDD and SSD data?
6 Answers
Nothing
On a bit-level, nothing stops an attacker with local access from copying the bits on your hard drive or SSD. In fact, there is hardware designed to create exact images of disks and SSDs, though this is usually done for forensic purposes.
How useful those bits are depends on how your hard drive is set up. Without any encryption applied, the attacker can use the filesystem present on the disk image to read the files - just how your computer would do it. Even without an intact filesystem, techniques like "file carving" can be used, where common headers for files are searched. Basically, you look for something that looks like the beginning of an image, and then attempt to read the next sectors as if they were an image. And in the end, you may end up with a usable image, or junk.
This can be protected against with encryption. Generally, there are two kinds of common encryption methods: File-based encryption and full-disk encryption. File-based encryption means the contents of some files are encrypted, and full-disk encryption means everything on the whole volume is encrypted.
With both of these, the problem now becomes key management. For full-disk encryption solution like BitLocker, keys can be generated with a passphrase and an additional TPM component. For file-based encryption, as it is used on modern Android phones, you can either use a similar approach, or use individual keys for each file, depending on your requirements.
-
3You can actually lock a disk with a password without even needing to use encryption. It's obviously not useful to an attacker who can remove the physical platters in a lab, but it's fine against someone who is going to plug in the SATA port and try to read off data.– forestCommented Jul 2, 2021 at 2:04
-
3I'd suggest to change the answer's title from
NothingtoEncryptionbecause it does stop an attacker from getting a usable clone drive Commented Jul 2, 2021 at 7:20 -
15@usr-local-ΕΨΗΕΛΩΝ Technically, encryption doesn't stop anybody from copying a disk (which is what OP asked). It's still possible - just pointless. IMO that's a less confusing way of explaining it because it doesn't make it seem like encryption somehow magically changes how the drive works. Commented Jul 2, 2021 at 7:55
-
6@usr-local-ΕΨΗΕΛΩΝ the question didn't ask about usefulness. And an encrypted image could still be useful to the attacker, if they can get at the key or even bruteforce a weak password. Yes, the latter will be expensive if a long key and good deriving function is used, but not out of reach for some actors – once you have a copy of the disc contents, that can be distributed to a server farm. Commented Jul 2, 2021 at 8:26
-
8@usr-local-ΕΨΗΕΛΩΝ I purposefully phrased it that way, to drive the point home that cloning can't be prevented.– user163495Commented Jul 2, 2021 at 11:47
Physical access is usually a huge security issue, depending also on your threat model or, in other words, what the attacker is willing to do with your machine.
Full disk encryption is a great security control if your machine is stolen (while turned off), to prevent the attacker from reading the contents of your HDD. You will never use the stolen machine anymore, it's gone. But if the attacker is able to compromise your machine, for example by replacing the disk and the OS (and show a fake prompt), or by installing a hardware keylogger, etc. and then you are going to use that machine again, then full disk encryption won't help. In theory some encryption methods don't protect integrity, so a very skilled (and lucky I guess) attacker could even be able to change some data on your encrypted HDD. And some encryption methods don't encrypt everything, but there might be unencrypted stuff on your disk (like bootloaders, etc.) that could be compromised (unless you have secure boot turned on, I guess).
If the attacker in your scenario is only going to turn on the PC, see it's encrypted, and give up, then full disk encryption is going to be enough. You might also want to disable boot from external devices, and password-protect the firmware. However if the attacker you are dealing with is willing to disassemble your machine, replace hardware, or spend a lot of time and resources to pull off the hack, then full disk encryption won't help you much (but it's always a good thing to have by default, anyway!)
-
1Eh. Bootloaders may not be encrypted, but in a Secure Boot system they're signed, so even though they're readable, they can't be modified and continue to work. Commented Jul 3, 2021 at 0:58
-
BITD when I was working COMSEC the typical defense against physical access was intrusion detection along with automatically "zeroizing" any writable media (writing patterns of 0s and 1's repeatedly).– T.E.D.Commented Jul 4, 2021 at 18:25
-
"But if the attacker is able to compromise your machine," - which is a REALLY different question if the machine uses a TPM to make sure that the keys are not stored in a retrievable way.– TomTomCommented Jul 4, 2021 at 20:20
Time.
Yes, someone could clone your entire hard drive, but this usually takes a long time. An attacker would have to open your computer's case, remove the drive, plug it into a dock, clone its contents, then return it to the case and hope you don't notice. Or alternatively, boot your computer using removable media, and then clone the drive over the network or to some other form of removable storage. Either way, it takes a fair amount of time and effort, so the attacker would have to be confident that you're not returning any time soon.
Far more convenient would be browsing the drive and cherry-picking files that look interesting. That requires a different level of access, but less time.
Both attack vectors can be impeded by encryption, as mentioned by others. The cherry-picking method can also be impeded by obfuscation, such as hiding your top secret files in a directory named "Financial Reports, 2004-2005" (unless, of course, your top secret files actually ARE financial reports, in which case you should hide them under "Pirated episodes of My Little Pony"). Encryption can definitely help here, too, but remember that someone who has access to your computer also has access to the post-it notes stuck to your screen, so be very careful with your password.
-
2A quick look around some recent articles and forums shows that a 500GB drive can be cloned in less than 30 minutes. When you say "this usually takes a long time", can you quantify that a bit? You are saying that time is the biggest factor, but 30 minutes is not a lot of time. And time would be a "detection" control, not a "prevention" control, which is what is being asked. So, no, time does not prevent disk copies.– schroeder ♦Commented Jul 2, 2021 at 11:43
-
1"and hope you don't notice" -- is this a requirement? Once the data is copied, does it matter if it is noticed? And how much evidence might there be? At most, scratches around the screws, if you happen to look under your laptop for them.– schroeder ♦Commented Jul 2, 2021 at 11:44
-
1@schroeder : it depends. If your situation is that you go to a bathroom break and are afraid that a friend or a family member or a collage will use that opportunity to snoop around, then 30 minutes is a very long time nobody would risk.– vszCommented Jul 2, 2021 at 22:54
-
@schroeder I mean notice them in the act. If you left your PC somewhere and you come back to find someone with a screwdriver leaning over it, you're going to be suspicious.– rosuavCommented Jul 3, 2021 at 0:59
-
Not sure what hardware is cloning that 500GB drive in 30 minutes, but (a) my drives are all >1TB, and the time goes up linearly with the capacity; (b) if you're doing it over network then it's capped on network speed too; (c) there's also the time to set everything up.– rosuavCommented Jul 3, 2021 at 1:01
Yes, it is possible to clone drives using some external connector (SSD/HDD usb connectors/Tableau Hardware) and software (osf/winhex). Cloning can be done in both states. It takes 30 - 40 min depends on size of hard drive and respective machine.
Bitlocker (whole disk encryption) can help to manage risks.
An often overlooked part of Information Security. Lock the PC down by disabling external ports (USB, Serial, etc), and physically secure the PC so they cant take it or open it. Have a chassis intrusion switch that is tied to an alarm, and put the machine in a secure enclosure.
You could protect the drive with a password (I mean a bios unlock password, sometimes called DriveLock or ATA password, not a bitlocker-type full disk encryption). Such drives won’t accept any commands until unlocked. However it’s not very reliable and replacing the drive logic board is know in some circumstances to dwarf this protection.
FDE alone won’t protect attackers from copying the disk image, but they might not be able to get the encryption key.
-
1"However it’s not very reliable" - it actually is if you use encoding discs. Which are standard in enterprise. Replacing the board will mean the drive has a different encryption key... and can not read the data. This (hardware level drive level encryption) is also amazing for a millisecond delete - the drive just generates a new key, all the old data is irrevocably lost. STANDARD in enterprise drives, pretty much all drives have a version supporting this.– TomTomCommented Jul 4, 2021 at 20:22
-
You are thinking of self encrypting drives, thats yet another feature (and also not reliable since drives are k own to lie about it). SED is also used by BitLocker if the drive claims to support it,– eckesCommented Jul 4, 2021 at 20:31
-
1"also not reliable since drives are k own to lie about it"-they may, but the datasheets of suppliers do not. As in: Can you imagine how much legal problems you get when you lie on a datasheet as producer? And data gets stolen...– TomTomCommented Jul 4, 2021 at 20:34
-
Check for example the paper from Meijer and van Gastel “Self-encrypting deception”– eckesCommented Jul 7, 2021 at 17:50
-
Just went through it and I would not consider ANY of the given examples in that paper relevant. As in: all are not meant to be server level safe drives - heck, I was not even aware they do support encryption (the Samsung Pro) and most are cheap end user stuff. I was talking about things like this: seagate.com/files/staticfiles/support/docs/manual/…, which are SOLD self encrypting - in special versions that cost a little more than the normal one.– TomTomCommented Jul 7, 2021 at 17:56
evil maid attack. As the other commenters have said, the defense against this type of attack is full disk encryption. See security.stackexchange.com/questions/223597/… and security.stackexchange.com/questions/159173/… for more info.