8

If you were installing such operating system as Ubuntu, you would have seen an option to encrypt your home directory or the whole hard drive with an AES 256bit cipher.

When your laptop is totally shutdown it is absolutely impossible to read the data that is encrypted. However, when your laptop is fully on, obviously all data is unencrypted and can be read by anyone.

What I would like to know is what happens when you lock the computer? Is the data in RAM protected somehow or is the data STILL readable but just behind a password? What I am saying is if you lock your laptop, is your data in RAM still as safe as on your Hard drive when it is fully powered down.

Improve this question
2
  • 5
    When your computer is powered on but locked, it almost always keeps the encryption key in RAM. That's why cold boot attacks are a problem, they can be used to extract secrets from RAM in computers you have physical control over.
    – Natanael
    Jun 25, 2016 at 18:16
  • 1
    laptops are usually safer against "cold boot" attacks because the ram is soldered on the mobo and can't be removed to a specialized device. if your laptop has firewire or esata, it might be possible to steal the keys with a DMA attack.
    – dandavis
    Jun 26, 2016 at 5:59

2 Answers 2

Reset to default
5

Short answer is "data STILL readable but just behind a password". It is rare that anything in RAM is encrypted, simply because it would require some sort of a password to decrypt, and most passwords would reside in RAM anyhow.

Going a bit further with this, the decryption password for the majority of disk-encryption programs would actually also (ironically) reside in memory.

Keep in mind that Full-disk encryption (or your home directory) applies only to your drive (HDD or SSD), not your memory.

Improve this answer
2
  • 1
    ... I'd like to throw in swap partitions since you mentioned memory. In case of unencrypted swap partitions, memory contents could be extracted even after a full shutdown and power-off. Assuming of course that the swap was used, i.e. memory was full at some point. So, encrypt your swaps!
    – Potaito
    Jul 7, 2016 at 16:21
  • 1
    Even better, full disk encryption would be easier to implement, and it would already cover not only swap partitions, but also any slack and residual data left here and there over the years.
    – Zack
    Jul 7, 2016 at 17:18
2

The encryption key for full disk or partial disk encryption are stored in RAM while the OS is operational.

How are the disk encryption keys protected when a laptop is locked?

If the device is shut down, then RAM is cleared, thereby securing your keys.

If RAM is really cold, it will last awhile longer, so one technique to extracting RAM is to freeze the device, and then quickly reboot to a specialized OS to capture such information.

If your device has been off long enough, especially at room temperature, then the RAM is completely inaccessible.

In stand-by mode the RAM is kept alive as long as power is available. Hibernate on the other hand qualifies as a true shut-down.

One of the commenters pointed that you one should check whether Swap partitions are encrypted. If they are not, then you have partially defeated the strength of your full disk encryption.

However, when your laptop is fully on, obviously all data is unencrypted and can be read by anyone.

If you have 'locked your screen', then it is not completely accessible. Even if the key is in RAM, it is very tricky to get the data out. One may also be able to attack your device via a USB interface, but this is tricky as well. There is the possibility you are running a vulnerable network service, so the WiFi or Ethernet interface is another possible attack vector.

What I would like to know is what happens when you lock the computer? ... if you lock your laptop, is your data in RAM still as safe as on your Hard drive when it is fully powered down.

No, the only way to get the true safety is a full shutdown or hibernate (again, make sure Swap is encrypted also)

Is the data in RAM protected somehow or is the data STILL readable but just behind a password?

RAM is not encrypted. ☺

Improve this answer
2
  • RAM is not encrypted. If it were, that would be horrible. ;)
    – Dan
    Jul 7, 2016 at 18:30
  • AMD Ryzen Pro 3000 desktop CPUs offer full RAM encryption ("AMD Memory Guard")
    – neuhaus
    Nov 8, 2019 at 8:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.