2

I'm not sure what dumping physical memory to disk during a BSOD does exactly, but is there a chance that it dumps all data from RAM to the HDD un-encrypted, because I doubt Truecrypt works during a BSOD? On the other hand if the whole disk is encrypted there is nowhere to dump that much data as the whole disk appears full and RAM is a few GB's.

2

Most operating systems, including Windows, can be configured to write debugging information and contents of the system memory to so-called memory dump files (also called crash dump files) when an error occurs (system crash, "blue screen," bug check). Therefore, memory dump files may contain sensitive data. VeraCrypt cannot prevent cached passwords, encryption keys, and the contents of sensitive files opened in RAM from being saved unencrypted to memory dump files.

https://veracrypt.codeplex.com/wikipage?title=Memory%20Dump%20Files

This is no different for TrueCrypt.

As the links shows, memory dumps can be disabled.

  • Thanks. I'm wondering though how is it possible to write stuff to a fully encrypted HDD? Doesn't it appear full with no free space to write? How does Windows see the folder where to write the dump file, when everything is encrypted? – kat Sep 7 '16 at 9:43
  • The OS does not talk to a process (they have been killed at the time of a BSOD) which does the encryption, but to a kernel driver. The driver acts as a layer between the OS and the disk driver. This remains active on a core dump. – Yorick de Wid Sep 7 '16 at 9:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.