2

This is more of an educational question and not so much an attempt to perform a specific task.

A) When encrypting a disk, does this generally mean that all data is encrypted, file metadata, data, everything, or does this happen in a smarter way?

B) Once you plug in a disk I can imagine that some autorun file fires up a program (found local to the disk probably) that requests a password which it will use for the decryption process upon demand. So when you are trying to access a file, the disk will decrypt it first with the password you provided earlier using the decryption software on the disk. How does the respective OS know when you've accessed a file on the disk and what program to use (in this case the one on the disk) to decrypt the file? In the same logic, how does it know when you wrote a file on the disk so it can encrypt it transparently?

C) Are there any encryption mechanisms that simply encrypt the filesystem tree hierarchy but not the data? I understand this might sound like a bad solution as the actual data of the files still reside on the disk and therefore it can still be accessed but it could maybe be a very fast way to encrypt drives with HUGE volumes of data and keep them safe from most of the non-tech savvy population? This would only be used for not so sensitive data of course.

Improve this question
1
  • C) is a flawed design. when encrypting the file system you risk corrupting the data you want to protect. which isn't even encrypted. Beter use full sidk encryption that does both.
    – LvB
    Jul 10, 2017 at 8:44

1 Answer 1

Reset to default
2

A) If you (the application you are using) correctly implements a full disk encryption then yes everything on the disk is encrypted that would normally be accessible via the OS (such as file, metadata, filename, ACLs, etc ... and the whole OS itself). It encrypts at the block level on the hard drive.

B) If its full disk encryption you supply the encryption/decryption application the decryption key at first use (either on boot or when you connect it to the computer) at this point the key remains in volatile memory and the OS/application handles the encryption and decryption transparently as any when the files are accessed.

C) This would be application specific implementation. It may be someone can recommend one, but product recommendations tend to be out of scope on this forum. But looking at the example I am not sure I am aware of anything that does do what you ask as it doesn't actually encrypt the data.

Improve this answer
4
  • So generally full disk encryption is the most common way to go ( from what im also reading online as well). I understand why my use case is a little "uncharted" since Im looking for a very light form of quick encryption that would deter someone with no tech knowledge from reading the data but not really someone that knows a little more about how these things work.
    – Return-1
    Jul 10, 2017 at 10:49
  • 1
    The major problem with C is you are not encrypting the data. Even though you say an attacker might not have the skill the 'advantage' you are looking for doesn't seem to exit, there are way more negatives. Whenever I am choosing a security solution I always start from assuming the attacker has the resources and skill for any attack, then from that I assess the risk and decide which attack vectors are not worth focusing on as the likely hood of it happening doesn't justify the cost/time. Full disk encryption is almost certainly the best option in this case. :)
    – ISMSDEV
    Jul 10, 2017 at 11:12
  • I normally agree but ( -delving a little into my country's status- ) the likelihood in my case is that someone breaks into the summerhouse where the disk is and mistakes it for something of value and grabs it. It is very very unlikely that they would go through the effort to decrypt it, they wouldn't even know what encryption is. With a cost/time analysis blocking direct access in the simplest way without spending hours to encrypt would cover me 99% But i fully understand this might be too specific a case and thats why there's no obvious answer. Thanks so much your patience and help : ) .
    – Return-1
    Jul 10, 2017 at 12:02
  • Adding a little about point A: It depends on the method that you use. E.g., the system ecryptfs (for Linux) doesn't encrypt the metadata of the files and folders, but it does encrypt their names and contents. Full-disk encryption (really full-partition encryption, though that's another discussion) is available on Linux, Windows, Mac and others, and encrypts absolutely everything, even how full the partition is. Also, a modern computer has AES encryption built into the chip, so the speed cost of encryption and decryption is negligible and is well worth having.
    – Paddy Landau
    Aug 5, 2017 at 11:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.