1

I need to create a "duress" capability on a Linux-based and a Windows-based computer that have encrypted drives. I assume the easiest and quickest way would be to blow away the keys. On the Linux, LUKS encryption has a simple command to clear the key slots making the drive unrecoverable. Is there a disk encryption tool for Windows that provides a method to clear the key slots, or perhaps a way to clear the TPM?

3
  • I googled "windows clear TPM" and got this from the official Windows documentation: docs.microsoft.com/en-ca/windows/security/hardware-protection/…
    – schroeder
    Feb 8, 2018 at 14:07
  • Modern storage devices with SED capability can also instantly wipe all the data by deleting a key used transparently for encryption.
    – forest
    Feb 8, 2018 at 14:20
  • Thanks for the reference to microsoft...trustedplatformmodule/clear-tpm.view=win10-psYes, that would be great, but sadly, these are not SED.
    – Ruhgster
    Feb 9, 2018 at 14:45

1 Answer 1

2

You can use the Clear-Tpm Powershell commandlet to do this programmatically, rather than using the TPM management control snap-in.

You could also use ATA Secure Erase on any modern SSD. This tutorial shows you how to trigger an ATA secure erase command on Linux. For Windows you'd need to write your own code to send the ATA commands to the disk - you'll need to consult the ATA command reference (section 1.8 explains how to use SECURE ERASE) and do some DeviceIoControl calls to execute those commands.

1
  • ATA Security Erase also works on HDDs, not just SSDs. Now that most modern drives of all types support SED, the erasure is extremely quick.
    – forest
    Feb 15, 2018 at 2:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .