Breaking full-disk encryption on a computer that's rarely used

Question

I'm writing a story where a security expert has been kidnapped and tasked with gaining access to some files on a stolen computer protected by full-disk encryption, and I'd like some ideas for ways he might accomplish that. The encryption is software-based, and the character has physical access to the entire computer.

The people that kidnapped the character don't know who has the encryption key, so the $5 wrench method is out. The computer has not seen use for a very long time, and is only used occasionally (on the scale of once every couple of years), so introducing a keylogger or some other method that relies on capturing user input to find the key won't be useful. The character knows that he's going to be killed if he doesn't manage to get access to these files, so he's pretty motivated to try anything that might work, even if it would ordinarily be too tedious or fiddly to bother with. He has about a week to produce results.

The computer in question is an alternate-universe system basically equivalent to a 1998 PC, running the fantasy equivalent of Linux. The character is attempting to break into it with roughly 2008-level technology. He definitely doesn't have access to enough computing power to brute force the key in a reasonable amount of time.

So, what are some approaches the character might take? From what I've read about full-disk encryption, cold boot attacks are a method for breaking it if you have physical access to the machine, but since this one hasn't been used in a long time I don't believe that's an option.

Answer 1

In 1998, DES3 was still considered to be a standard for security (fips 46-3 wasn't withdrawn until 2005). But it was already crackable by brute force within days. Your problem however is access to computing resource - if the gun were pointing at my head, my next thought would be to look at a way of distributing the operation via javascript from a busy site...

However if the gun were pointing at my head, then the first thing I'd do is check for post-it notes. The next place I would think to to look for a way into a machine which probably hadn't been patched for 10 years is a vulnerability database - security tools don't have a good security record.

Answer 2

1. If it's used that rarely, then the password must be written down, or easily memorable to the owner of the computer. If it's the latter, then it may be guessable if you know the identity of the owner. If it's the former, look for the bit of paper hidden somewhere.
2. If it's rarely used, then the keys on the keyboard should be fairly clean. Do some keys have smudges of dirt where the owner has typed their password? This won't be enough by itself, but it limits the guesses needed.
3. Is the password checking algorithm flawed? For instance does it reject a password that is wrong in the first character a few microseconds quicker than a wrong last character? If so, then the expert can guess the password one character at a time.

Answer 3

There are a number of factors that could make this possible.

• If the whole disk that is encrypted is a) bootable & b) a known OS & Version then there are known locations containing known files with a reasonable file size.
• Given a limited number of possible encryption technologies and that the password prompting must be unencrypted you could fingerprint that section, (after either removing the drive or booting from an external drive), to know which encryption program was used and from that further limit the range of ciphers, (possibly down to one).
• Possible plot cheap trick the software &/or organisation password rules may severely limit the number of possible passwords and the cracker may know these rules, (I have worked at places that had a fixed length for passwords and a set of case and content rules that conflicted with the encryption software password rules to the point where there were only a few tens of thousands of possible passwords I'm not saying where).
• As others have stated if the machine is used only once or twice a year then the password must be memorable.

The combination should make a rules based dictionary attach doable within the timescale.