2

As the title asks, and in conjunction, I'm wondering why full-disk encryption is "better" to some folk.

This is not taking into consideration of theft, but rather, something or someone infecting my machine and then being able to exploit my data.

From my understanding, once a user has logged on to their OS, even with their drive encrypted, they're still at risk from having their data accessed in some way(s).

I was looking at this question and now I feel as though I'm not getting the entire picture.

I use VeraCrypt's file container solution to stash my sensitive data on my primary drive (securely). According to VeraCrypt's own user guide, the data I access is never stored in the plain. It is always encrypted, and even when accessed, is only ever decrypted in RAM.

So, this to me takes into consideration of swap files and other insecure placements of my sensitive data throughout my drive.

Even if I were to encrypt my drive, the data has to be decrypted at some point. So, either way, that particular risk will always be there. However, in my case, isn't keeping my sensitive data within the file container sufficient for my "security" needs (ignoring theft)?

If not, can you please explain why I might need full-disk encryption?

  • 3
    With FDE, even the swap files are encrypted - unencrypted data never hits the drive... – Matthew Jan 5 '17 at 16:41
  • AFAIK, Veracrypt is a DISK encryption not a FILE one. What is encrypted is a full filesystem: file data, folder metadata and even the cluster table. Simply it is often used to encrypt a secondary partition (not the initial booted one) be it located on a raw disk partition or on a file from another partition. – Serge Ballesta Jan 5 '17 at 17:13
  • I'm aware of what FDE can do on a minimal level, but how is that any different from the file container method? Supposedly, it doesn't leave any traces on the drive at all. Isn't it doing the same thing then (in a way)? – ThatRandomGuy Jan 5 '17 at 17:57
  • IMPORTANT NOTE: While I have already selected the answer to this question, I HIGHLY suggest reading the other answers. They provide clarification and other practices that are worth investigating. – ThatRandomGuy Jan 6 '17 at 16:23
4

To begin, I'll break down the main difference between FDE and File-level Encryption:

Full-Disk Encryption:

FDE works on the hardware level of a device. It encrypts the entire drive as compared to individual files and ensures that data cannot be read even if the drive is connected to an alternate system. It ensures that a user must have a password to even be able to access a file. This is an important distinction.

File Level Encryption:

File level encryption allows you to encrypt individual files as compared to an entire drive. This allows you to control access to files - I could allow both Bob and Alice to share a drive (bad idea, just an example) and encrypt a file with each of their passwords. This would result in both of them being able to see the file but, importantly, not the contents. In other words - it allows more control.


Let's say I'm a nasty person - I notice that you've left your Veracrypt container unlocked - this means that I can freely read all your files because the container is open - this is the same as FDE except on a smaller scale. However if you had been using File Level Encryption as well, I would have needed another password in order to be able to actually view the files. I might be able to copy them off (depending on my permissions) and crack them at my leisure, but that's a longer process.

In another scenario, if you don't have FDE, I could rip your drive out of your system, clone the entire drive and proceed to crack the files present on it on my system. Or I'd use a bad security file implementation to access your data.

tl;dr: You want FDE if you want to ensure that people will never be able to even read the contents of your disks without a password while you also want File Level Encryption to ensure that you aren't allowing someone to copy unencrypted data off your disk when it's unlocked.

  • Even if they have access to my file, they wouldn't be able to read the contents of the encrypted file without my password/key, right? My concern is that remnants of my sensitive data will be insecurely stored somewhere on my drive. I had assumed that VeraCrypt made sure that didn't happen, but now I feel like I'm not exactly sure what's going on behind the scenes. – ThatRandomGuy Jan 5 '17 at 18:04
  • @ThatRandomGuy - Correct. Without the key, they'd be able to see the files, but not read them.I'm not exactly sure what you mean in the second part of the question, could you please elaborate? – thel3l Jan 6 '17 at 1:05
  • In the link provided, it is discussed among few that this solution might not be well-suited as the data could be stored in other locations on the drive. Using an example: I feel that that wouldn't really apply to something such as a general text file and rather instead with something else, such as a web browser that stores cookies. In my case, I keep my passwords in the file container. Am I correct in thinking this is enough measure to keep the data secured? – ThatRandomGuy Jan 6 '17 at 1:20
  • @ThatRandomGuy - Yep. Your current measures should be secure enough provided you're using a secure algorithm and password. – thel3l Jan 6 '17 at 3:10
3

Full-disk encryption is mostly a matter of convenience: you don't have to worry about determining which files are sensitive, and maintaining that list as things happen on your computer. In many situations, it's a one-time setup, and then everything continues to act exactly the same as before for the user (the encryption key is derived from the user password), but there's now some protection against a stolen laptop. This is particularly useful from a corporate IT perspective.

If you're willing to put in the effort of ensuring that every somewhat sensitive file on your system is covered under file-based encryption, then that provides you more control and is less likely to leave sensitive data in RAM. But it's a lot more work, and relies on you being correct about the list of sensitive files, which can be difficult to do, as many applications will do things like store plaintext passwords in a config file without telling you.

  • I don't think this answers the question, but +1 from me anyway because of the excellent explanation of why you want FDE regardless. When your laptop is lost or stolen, the last thing you want to worry about is what you might have on your computer that isn't encrypted. – TTT Jan 5 '17 at 20:28
3

I agree with you. Specifically:

This is not taking into consideration of theft, but rather, something or someone infecting my machine and then being able to exploit my data.

The attack vector that FDE protects you against (compared with file encryption) is a lost or stolen machine. If your machine is infected, the data is presumably already decrypted and it won't make a difference if you have FDE.

The reason why

full-disk encryption is "better" to some folk

is in the case of theft, not infection. See XiongChiamiov's answer for a good explanation of that attack vector.

In fact, I may take it a step even further and claim that having only file encryption is even better than having only FDE specifically against the infection attack vector because with file encryption it's possible to have certain files encrypted with a different password than the one the infection knows. I actually have some systems that use both FDE and file encryption with different passwords so that I or an attacker/infection can't open certain files without knowing the separate password.

  • I like the multiple layers application. I'll try that out as well. I appreciate the input. – ThatRandomGuy Jan 6 '17 at 1:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.