I need to create a "duress" capability on a Linux-based and a Windows-based computer that have encrypted drives. I assume the easiest and quickest way would be to blow away the keys. On the Linux, LUKS encryption has a simple command to clear the key slots making the drive unrecoverable. Is there a disk encryption tool for Windows that provides a method to clear the key slots, or perhaps a way to clear the TPM?
-
I googled "windows clear TPM" and got this from the official Windows documentation: docs.microsoft.com/en-ca/windows/security/hardware-protection/…– schroeder ♦Feb 8, 2018 at 14:07
-
Modern storage devices with SED capability can also instantly wipe all the data by deleting a key used transparently for encryption.– forestFeb 8, 2018 at 14:20
-
Thanks for the reference to microsoft...trustedplatformmodule/clear-tpm.view=win10-psYes, that would be great, but sadly, these are not SED.– RuhgsterFeb 9, 2018 at 14:45
Add a comment
|
1 Answer
You can use the Clear-Tpm Powershell commandlet to do this programmatically, rather than using the TPM management control snap-in.
You could also use ATA Secure Erase on any modern SSD. This tutorial shows you how to trigger an ATA secure erase command on Linux. For Windows you'd need to write your own code to send the ATA commands to the disk - you'll need to consult the ATA command reference (section 1.8 explains how to use SECURE ERASE) and do some DeviceIoControl calls to execute those commands.
answered Feb 8, 2018 at 17:30
-
ATA Security Erase also works on HDDs, not just SSDs. Now that most modern drives of all types support SED, the erasure is extremely quick.– forestFeb 15, 2018 at 2:59