Access encrypted system/files with rootkit

Question

I have encrypted files that I need access to but I believe the BIOS/UFEI/hardware or recovery partition have a rootkit or keylogger now in order to get my encryption password for the encrypted system partition.

1. Can they install a rootkit/keylogger on a VeraCrypt encrypted system partition?

2. How do I access it without compromising it?

3. Is there a software that could detect and clean the rootkit/keylogger from the recovery partition and BIOS/UFEI/hardware before I access it?

Thanks

Answer 1

I have encrypted files that I need access to but I believe the BIOS/UFEI/hardware or recovery partition have a rootkit or keylogger now in order to get my encryption password for the encrypted system partition.

Boot from a Linux recovery disk and connect a large enough USB device.

Then, copy the still encrypted disk as a physical disk on the USB device.

Thus, you have not supplied any sensitive information to the untrusted system.

Finally, boot a trusted computer with a clean install of whaveter OS you need, with appropriate drivers for the encrypted disk, keeping it disconnected from the Internet (ensure it hasn't a working WiFi chip), and connect the cloned USB device. Decrypt and use.

You have now disclosed the sensitive information, but done so on a device that is trusted and not connected to the Internet.

If speed isn't an issue, a small Xiantec or Zotac or even Raspberry Pi unit might be able to suit your needs for under USD 49,99.

To prevent the possibility of the trusted device somehow saving the information and transmitting it somehow later on, you can dispose of the whole unit by melting or pulverizing disk, motherboard and any external cards that might have a programmable memory on them. More spectacular methods also exist.