1

It seems that full disk encryption entails that files can only be written to disk in an encrypted way.

  1. If a file has been deleted on a system with full disk encryption, can it be recovered if the disk has been unlocked?
  2. Same question but for information that has been written to swap space instead of being deleted?
  3. Same question but for information that has been written to RAM instead of disk?
1
  1. Yes and no. Yes, you can recover a deleted file, depending on how you deleted it. Disk encryption does not affect your ability to recover deleted files any more than an unencrypted disk because encryption happens at the driver level (usually) as the data is being written to disk. So, if you delete a file in Windows, and the OS marks that file for deletion, you can still recover. If you are using an OS that wipes the file with zeroes (several *NIX OS's) then no. But it doesn't have much (if anything) to do with FDE. Where you might run into issues more so than an unencrypted disk is how your encryption method deals with reboots and setting up the crypto after reboots. It could cause disk writes and re-writes that might lessen your chances of recovery.

  2. Swap space is treated the same way. Full disk encryption is encryption. Period. Swap space is no different. The data is (should be) encrypted at rest, and only decrypted on the fly as it is read from disk.

  3. RAM is not encrypted. Address space for important system operations is randomized, but not encrypted. Portions of the ram may be encrypted, but the whole is not (or at least... I have never heard of this). RAM being volitile is largely protection enough. No power? no data. It's a different problem than persistent (disk) storage that can be unplugged, taken elsewhere, and have the data taken off of it. Additionally, most operating systems have preventative measures that stop you (or a rouge application) from copying out more memory than belongs to you. Linux, for example, won't let dd blindly copy the contents of your RAM to disk. It stops it at 1MB. (dd if=/dev/mem of=/mnt/ramdump.bin)

0

Assuming no additional technologies are in action (e.g., thin reclaim tech such as this and this):

If a file has been deleted on a system with full disk encryption, can it be recovered if the disk has been unlocked?

  1. YES, deleted files can be recovered from FDE disks - when the disks are mounted properly (i.e., the recovery software has access to decrypted block data). This holds good even after your reboot the system several times.

Same question but for information that has been written to swap space instead of being deleted?

  1. Depends, mostly NO. Assuming encrypted swap, the most common way of encryption for swap space involves throwing away the keys. So if you reboot the system even once, the swap space is most likely differently scrambled. If it's unencrypted swap, the answer is YES.

Same question but for information that has been written to RAM instead of disk?

  1. Complicated because the question has issues (what do you mean "delete" information written to RAM?), but mostly YES. RAM is not encrypted, you can recover data that is just laying around. Unless you implied an encrypted RAM disk in which case #1 caveats apply. I'm also not sure what happens to RAM across reboots without powering down.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.