I need to create a "duress" capability on a Linux-based and a Windows-based computer that have encrypted drives. I assume the easiest and quickest way would be to blow away the keys. On the Linux, LUKS encryption has a simple command to clear the key slots making the drive unrecoverable. Is there a disk encryption tool for Windows that provides a method to clear the key slots, or perhaps a way to clear the TPM?
You can use the
Clear-Tpm Powershell commandlet to do this programmatically, rather than using the TPM management control snap-in.
You could also use ATA Secure Erase on any modern SSD. This tutorial shows you how to trigger an ATA secure erase command on Linux. For Windows you'd need to write your own code to send the ATA commands to the disk - you'll need to consult the ATA command reference (section 1.8 explains how to use SECURE ERASE) and do some DeviceIoControl calls to execute those commands.