Let's say someone found a USB drive at their home and wants to try to figure out what it is (and they don't know the encryption phrase). What information could be determined about this encrypted drive, in theory?

For example, is it feasible to determine the date/time that the drive was encrypted or last written to? What other metadata, aside from the drive name, could be extracted?

  • I'm sure you've already explored "cryptsetup status" and "cryptsetup luksDump". Not much there, but there's very little information out there beyond that. Perhaps someone has studied the luks header format and/or the code and can throw more light. – Sas3 Jun 11 '17 at 6:11

That depends.

Obviously, he can get all the data stored in the luks header. That's basically the cipher used for encryption, the salt, the number of keys that can be used to unlock the data and so on.

If you've filled the USB drive with random data prior to encrypting it, that's basically the extent of the information anyone can get.

If you haven't overwritten the USB drive with random data, an attacker will likely be able to determine how much data is stored on the partition, and making assumptions about the underlying filesystem, he could gain insights into the structure of your filesystem (e.g. how many files are stored in how many directories etc).

AFAIK, the date of first encryption or last write can't be determined from the LUKS header.

For someone with very good hardware knowledge, it might be possible to access the wear-leveling protocols on the drive and therefore gain access to previously written data, which, even though encrypted, would give hints about which parts of encrypted partition were changed. I'm not sure what anyone could do with that knowledge.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.