3

My question relates to this old thread on the Veracrypt forum (I didn't get any response when I posted there, so here I am):

https://sourceforge.net/p/veracrypt/discussion/general/thread/bf48efbd/

I wanted to clarify my understanding of what was said in the above thread:

(1) If a Veracrypt volume is mounted, and I permanently delete (shift-del) a file from inside that volume, and the volume stays mounted, someone (with the right tools) can recover the deleted file from the hard drive just as they would be able to do with a file deleted from a normal, unencrypted hard drive.

(2) If a Veracrypt volume is mounted, and I permanently delete (shift-del) a file from inside that volume, and then the volume is dismounted, someone cannot recover the deleted file from the hard drive the way they would be able to do in (1) above . . . but they may still be able to exploit data leaks to recover the contents of the file in a different way.

Is this correct?

Thanks!

Improve this question

1 Answer 1

Reset to default
1

The key part of your question is the answer: "... someone (with the right tools) ...".

Can someone steal the drive, open it and retrieve the Data by ANY means. Can they just plug it into their own Computer, create their own circuitry to access the Disk or RAM, can they use an Electron Microscope; yes.

This is the importance of the encryption method. If you took encrypted data from someone else and stored it on your Computer would someone then simply steal your Computer and be able to read the Data easily; no.

If the Drive has Hardware Encryption then the ability to access the Data provides encrypted Data, if it takes a 1000 years for them to decrypt it then you may not be concerned.

If the Data, at any time, was in an unencrypted form then it has a possibility of being read easily. In a Hardware Encrypted Drive the Data is stored protected by the Drive, hopefully the Drive has Tamper Protection too.

Deleted Encrypted Data on the Drive has a chance of being read, in it's encrypted form. It's the point where it is decrypted that it becomes vulnerable.

If you have a Spreadsheet Program (Software) that encrypts it's Data in Memory before writing it to an 'Encypting Disk Driver' (a Driver, not a Drive) which then writes to a Hardware Encrypted Drive each point in the chain takes off a layer of the onion.

It's the attacked end (in your question, the Data Storage) that will likely yield what it holds. With a Hardware Encrypted Drive the Data is encrypted.

Deleting a File should not decrypt it. It could though, the Driver for the Drive could intercept deletion requests and read the File looking for Keywords; if valuable Keywords were found the Driver could compress and encrypt the Data, sending it by WiFi to another location.

It's like you asked: with the right Tools ...

That doesn't mean everyone has such Tools or the ability to use them. Hardware Encryption and sleeping on your Laptop are sufficient for all but the most paranoid, that leaves Waterboarding; but if you don't know the Code neither will anyone else.

I think that covers everything. Questions and Solutions.

Improve this answer
2
  • Thanks Rob, I appreciate your detailed reply. I'm still confused though - are you able to relate this back to the 2 scenarios in the original question and let me know if these are both correct? In other words, if we're looking specifically at file deletion and not any of the other ways that data may leak etc, do these scenarios paint an accurate picture?
    – user141712
    Mar 19, 2017 at 0:06
  • Deletion and unmounting do not "guarantee" deletion. EG: If you believed whatever was on the Screen you would have accepted my answer - if your Computer writes on the Screen "Good job JayT, you deleted the File correctly and no one will ever be able to undelete it" would you accept that? - Erase and overwrite with patterns of bits that prevent physically reading the device are what is needed (assuming your device is not tampered with).
    – Rob
    Mar 19, 2017 at 3:05

You must log in to answer this question.