3

If you encrypt a device using a passcode, the data stored on the device cannot be retrieved using forensic discovery.

What about the passcode itself? Is that encrypted too?

Can forensic analysts simply retrieve the passcode in authentic form and use it to decrypt the rest of the device?

1

The specifics of the device are very important here. Generally speaking, however, (when talking about devices that implement reasonably secure encryption mechanisms) when you encrypt a device with a password, that password is not in fact stored anywhere. The standard process is that when the password, when entered, is run through a key derivation function in order to deterministically create key-encryption-key, which is then used to decrypt the the data-encryption-key, which was randomly generated by the device, and what is actually used to encrypt and decrypt the data on the device. Without the key-encryption-key, you can't decrypt the data-encryption-key, and can't recover the data.

-1

Exactly the opposite of your question is true...lets take a windows device for example. The OS itself has a passcode that prevents you from logging into it as a user/admin/etc. If you were to extract the hard drive from the device or boot to a different OS on the device you can view all the data on the drive without the hindrance of the OS asking for authentication.

For encrypted volumes, decryption is not possible without the keys involved in the encryption. For encrypted volumes, guessing the OS password and getting it by chance has higher odds than cracking the disk encryption.

I hope that answers your questions.

-1

You haven't mentioned which platform, but seeing as you used the term passcode I'll assume iOS. Other platforms are probably similar.

There's considerable detail about the encryption and security features of iOS here: https://www.apple.com/business/docs/iOS_Security_Guide.pdf

Specifically:

In addition to unlocking the device, a passcode provides entropy for certain encryption keys.

...

(NSFileProtectionComplete): The class key is protected with a key derived from the user passcode and the device UID. Shortly after the user locks a device (10 seconds, if the Require Password setting is Immediately), the decrypted class key is discarded, rendering all data in this class inaccessible until the user enters the passcode again or unlocks the device using Touch ID.

Basically, the passcode is used as a decryption key - if the wrong passcode is entered decryption will fail. If decryption succeeds then the passcode is valid.

Can forensic analysts simply retrieve the passcode in authentic form and use it to decrypt the rest of the device?

No, you'll only be able to decrypt the other keys by knowing the passcode first.

-2

Also, this is a common issue with AES encryption. If you have the AES key you can decrypt whatever was encrypted. So alternate encryption techniques such as Elliptic Curve Cryptography are used to protect the AES key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.