An external hard disk drive is connected to a Debian system via USB. The disk is encrypted using cryptsetup LUKS and is properly opened and mounted using luksOpen.

Now, if somebody just unplugs the drive an tries to read the data, does she have any advantage from the fact that the device has not been properly unmounted and closed with luksClose?



But your RAM or swap could perhaps be used to pilfer the key. In the RAM case this requires special hardware IIRC.

There are those complex sidechannel attacks which are no longer so theoretical, but not common. For evilmaid, there's anti-evilmaid, or just control boot from removable media with a password.

I've had some love by hibernating systems, doing a few things, and popping them back on. This is also prevented with a boot password.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.