1

How does full-disk encryption work when the disk or system unexpectedly loses power? I assume that it doesn't just quickly re-encrypt the data in a split-second, so how does it protect data on the disk after power loss?

Does it keep most data encrypted and decrypt files when they are accessed? If so, wouldn't this also leave some files unprotected after power loss?

In this case I am not talking about a specific type of full-disk encryption, just the idea of power loss protection in general.

  • The only thing it does is make the data un-readable if someone turns your computer off, and runs off with your hard drive or a copy of it. Otherwise it does offer any other protection. – cybernard Dec 24 '16 at 3:33
7

Full disk encryption ensures that data is never present on the drive in an unencrypted state, so sudden power loss does not result in any unencrypted data remaining on the drive. When your computer has to access data, it will read the encrypted data, then use the key you provided (also in RAM) so the data that gets stored in RAM is decrypted. This ensures that decrypted data is only ever present in RAM.

Hard disks and solid state drives are non-volatile, meaning the data they store is permanent. After a power loss, the data is still there. RAM on the other hand is volatile. The type used in modern computers, called DRAM, is composed of a transistor connected to a capacitor. A charge in the capacitor signals a binary 1, and no charge signals a binary 0. Every 64ms, the capacitor is refreshed so it does not leak electricity and loose its bit. When a computer loses power, the capacitors are no longer refreshed, and they begin to lose their charge. DDR2 DRAM will lose power in less than a minute, and DDR3/DDR4 DRAM will lose power in a couple seconds. Compare this with magnetic media, which can retain their polarity for half a century or more, or solid state flash media, which can retain their charge for around a decade without power.

You may have heard of cold boot attacks. It's a type of attack that exploits the fact that RAM does not lose its power instantly, but takes a couple seconds to lose power. If RAM is put in an extremely cold medium, this process can be slowed down to several hours. So unless someone freezes your RAM modules within a second of you powering off your computer, there will be no trace of the key or any unencrypted data on your system.

  • Wow, I never knew that it was only decrypted in RAM, I always thought that the entire drive (or portions of it) were decrypted as necessary. This was really enlightening! – esote Dec 24 '16 at 19:35
2

Full disk encryption sits between the filesystem and the storage drive and seamlessly translates between the drive's encrypted sectors and the decrypted ones which it presents to the filesystem (which in turn translates those to files and folders). When the filesystem writes a sector the FDE layer encrypts that sector and passes it on to the drive which stores it.

No unencrypted data is ever stored to the disk, so there is nothing to encrypt during a power loss as everything is already encrypted.

0

Power outage is still unsolved problem in full disk encryption. Most vendors employ journaling or transaction logs to resume encryption once the system is back online but its not completely effective. Infact if your boot partition has unfinished encryption it can get corrupted then you may lose whole data. The encrypted volumes have a single point of failure in the information at the beginning of the volumes that maps the password to the encryption key for the data.

https://www.wilderssecurity.com/threads/solutions-to-truecrypts-fatal-flaw-power-outage-data-loss.356380/

  • 1
    This is just an implementation issue - TrueCrypt and Windows don't play nice together. On a correctly implemented FDE solution (Windows' BitLocker, Apple's FileVault, Linux' LUKS) there are no issuew regarding power outages. – André Borie Dec 24 '16 at 18:02
  • +1 to André. Moreover, I don't think that "most vendors employ journaling for encryption". – Ángel Jan 6 '17 at 21:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.