When using SanDisk's SecureAccess software to access your 'encrypted' usb key, it requests you give it a location to extract the files to - expecting you to give it a folder to write them out to.

Isn't this incredibly stupid, as you've just created an unencrypted copy of your files, and written them to a disk which now could be 'recovered' even after you delete them?

I feel like I must be missing some obvious fact about this that infact means it is secure, but I can't think of any

  • What about encrypting it again before you delete it? And what about not writing it out to another disk, but edit the version on the USB. And the purpose of encryption in this case is that the data is stored safe (which it was), and it can get secretly transported (which it could). If you're storing information which absolutely should never be recovered, you could also consider only opening it in a LiveOS. – O'Niel Jan 2 '17 at 14:18
  • Are you sure it's extracting, and not just mounting a drive under the folder? Windows supports using folders as mount points. – Bob Jan 2 '17 at 14:27
  • @Bob well the file is readable, so even if it's mounting it, it's leaving the unencrypted version on the usb disk instead. What I'd expect is that it'd mount a ram disk and extract it to this? – djsmiley2k TMW Jan 2 '17 at 14:28
  • @djsmiley2k If it's just mounted, then it's probably being decrypted on the fly. There's no technical reason for "extraction" to be involved in the process at all - in fact, having an "extraction" step would make mounting the drive take far too much time. If it mounts in under 30s and you have >1GB of encrypted data, it cannot possibly be "extracting", assuming typical drive read rate of 10 MB/s. An analogy would be mounting a Truecrypt volume. – Bob Jan 2 '17 at 14:38

If it's useful to decrypt files to a local folder or not depends on your use case

If you use it to provide a secure offline way to transport files from one computer to another it seems perfectly fine to me. The transportation phase is secure, what the receiver does with it is no longer the responsability of the usb disk encryption

If you want to ensure that the files aren't accessible (Without the decryption key) once you have copied them, then you should be copying the files to an encrypted partition (Full disk encryption, a VeraCrypt partition, etc) or use another layer of encryption over the files, like an encrypted 7z file

I never used SecureAccess but I'll be surprised if it doesn't have a feature that doesn't need to decrypt the files on the fly without storing them in a persistent storage

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.