If you have physical access to a machine, it's pretty straightforward to recover the root password thereby skipping the whole point of having an encrypted drive.

Am I missing something here?

EDIT: It seems that I was mistaken in a fundamental concept of disk encryption. The password for disk / directory encryption is separate from that of the system account passwords.

In the case of Full disk encryption, access to any system password needs to first go through the encryption password.

In the case where only the home directory is encrypted, the user login password is used along with the encryption password to create phrase which is used to encrypt and decrypt the home directory. A forced change of the user password (from a root account for e.g) will not update this encryption phrase and thus the data will remain secure.

  • 4
    Could you add some more information to your question? What root password? The OS root password? You can't access that, as the drive is encrypted.
    – tim
    Commented Feb 22, 2016 at 21:33
  • 1
    On most modern Linux distributions, the root password is hashed using SHA-256 or SHA-512, and then stored in /etc/shadow. For most of us, reversing a SHA-256 or SHA-512 hash is far from straightforward.
    – mti2935
    Commented Feb 22, 2016 at 21:43
  • 1
    @mti2935 What does the Linux root password have to do with the full-disk encryption password? It shouldn't have anything to do with it. Commented Feb 22, 2016 at 21:47
  • 1
    Mark, I agree with you that the root password has nothing to do with the full-disk encryption password, and I agree with your answer below. But, I feel that it is worth noting that it is far from trivial to recover the system root password, as the OP suggests in his question.
    – mti2935
    Commented Feb 22, 2016 at 21:56
  • 2
    @mti2935 Not SHA-256 or SHA-512, actually, but a slow, salted algorithm based on these functions (not exactly PBKDF2, but the same principle). Commented Feb 22, 2016 at 21:56

3 Answers 3


If I was having a conversation with someone about this subject, I'd restate your question as this statement:

If you have physical access to a machine, it's pretty straightforward to bypass or reset the root password, which is the whole point of having an encrypted drive.

The idea being that you can very easily reboot into single-user / maintenance mood and get a root shell without a password. Then, as root, you can do just about anything you want, including overwriting the root password and rebooting with your new password, or just reading all the data straight from the disk.

Or, of course, just pulling the hard drive out and using another computer to copy all the data off of it or make changes to any of the data.

The way to prevent that sort of access is to encrypt the full drive, so an attacker would need to decrypt the drive before getting that root shell or seeing any of the files. In the context of your question, the root password is encrypted at rest so no one can change it or even see the hash until they've first decrypted the drive.

It's also important to separate full-disk encryption from an encrypted home directory. In the latter scheme, none of the system directories are encrypted so you can still boot into a maintenance shell and access all the system files, but the user's files would still be encrypted (hopefully with a separate passphrase!) that you'd need to crack in order to access those files.

  • Thank you - that was the missing piece - FDE comes with it's own password which is needed before getting access to any of the system. Commented Feb 22, 2016 at 22:33
  • Why use a seperate passphrase for /home when encrypting only /home ?
    – Ini
    Commented Sep 19, 2018 at 23:28

If you have physical access to a machine, it's pretty straightforward to recover the root password thereby skipping the whole point of having an encrypted drive.

You might be mixing things up here. Root passwords and full-disk encryption passwords are not the same thing. At least they shouldn't be.

  • Root passwords are what you use to log in as root/admin on your operating system.
  • Full disk encryption is the password used to decrypt the hard-drive so you can even use it.

If someone has physical access to your device, and they don't have your disk encryption password, they cannot unlock the hard drive, and can't get any usable data from it. It'll be garbage.

Even if someone has your root password, they should not have your FDE password, unless you're using the same password for each, which in case, you have an incorrect security setup.

  • I take it 2 folks aren't fans of Jackie Chan. ;) Commented Feb 22, 2016 at 21:41
  • Why is this an incorrect security setup? Lets say 2 passwords are more secure then one, but why call one password an incorrect setup?
    – Ini
    Commented Sep 19, 2018 at 23:30

As others have pointed out, being able to change the root password (or any users account password) will not decrypt the disk. However, if full disk encryption is not used, then an attacker can perform an "evil maid" attack like this:

  1. Make a full copy of the disk.
  2. Boot into the system as root, using a rescue disk or maintenance shell.
  3. Modify/trojan the disk encryption software to capture the encryption password and/or keys.
  4. Post the credentials to an attacker owned server or stash them on disk somewhere for later collection.
  5. Use the captured credentials and the previous disk copy to decrypt and read the data.

Technically an evil maid attack doesn't involve step 1, and involves coming back later to recover the captured credentials and possibly modify encrypted data.

Even if full disk encryption is used, people often don't encrypt the kernel or initial ramdisk. If they do encrypt those, then they often don't encrypt the bootloader, so it can similarly be trojaned with physical access. The bottom line is that somewhere there will be unencrypted code that reads the credentials before decrypting the rest of the disk. To protect against that, the unencrypted bootloader, etc. needs to be stored off the computer, eg. on a flash drive that the owner carries with them. Even this doesn't protect against a hardware keylogger or trojaned BIOS.

Having said all that, disk encryption does protect your data in the case where someone just steals your disk/computer, you send your disk in for warranty, or you sell/give away the disk and forget to zero it. These are the more common risks for most users.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .