Encryption - how to secure files - decrypting exposes them on SSD

Question

Let's say I have an encrypted file. Now I decrypt it but since my computer only has SSD, i decrypt it on the SSD drive. Say, I make changes or I finish using the decrypted file so I encrypt it again. But since I am on SSD, there is no way of properly purging the file from the drive without purging the whole drive (and who knows whether that can be trusted). From this, it seems the whole concept of encryption is only useful for transportation but not for secure storage because inevitably, once I need to decrypt I create a vulnerability which is not easily handled. Or am I wrong, is there some simple way?

I was then thinking about software like TrueCrypt (or VeraCrypt today) which can then mount an ecnrypted container, but the problem is, I have no idea what is happening to the file that is being opened, edited etc, is it only read into memory without being decrypted to some temporary space on hard drive and then once changes are made encrypted again without the use of HDD?

Another ideay that came to my mind was to create a special partition for such files and encrypt that partition (but again, am I safe to assume that the files never leave that partition? Of course not considering that I copy them somewhere, but more likely some application using tmp etc).

Can someone help? How I can secure certain files/directories for such instances that the computer is stolen/hacked because even if I encrypt them, certain I use often, make changes, once decrypted, they are exposed even after they are encrypted again?

If this is a known topic, I do apologize and please send me to appropriate places to learn (but I really did not find any information on how to work with encrypted files, also I am not a developper or system programmer so I need something less obscurely written).

Answer 1

There are several strategies:

1. You can set up a ramfs/ramdisk for temporary area to decrypt your data. When using this strategy, you'll need to research carefully that any programs you use to decrypt/encrypt and edit your files don't make any temporary files outside of your ramdisk area.

2. You can set up a full system encryption. With this scenario, any persistent storage attached to this machine are encrypted, so you'll never leave any trace of unencrypted data. This is a lot easier to manage than ramfs/ramdisk, but requires significant initial setup.

3. Use a Live CD. Most LiveCD set up are configured so any writes you do to the files are done on an overlay ram-based filesystem. When using this strategy, take some extra precautions and mount all other persistent storages as read only.

Answer 2

First of all, you can't trust SSDs to delete anything, even if they provide secure delete on paper.

Now there are several things you can do. First of all, if the file is encrypted using PGP or something else that requires the file to be stored on disk when decrypted, use VeraCrypt container to store it in. Make sure the software you use does not decrypt it in temporary folder and then move it, like WinRAR likes to do, if you drag and drop.

Then, you can work with the file out of the VeraCrypt container with any application that does not write temporary files to disk, or at least writes them next to the original file. Most programs will store all the data they need in memory, but be careful about more complex programs, as they often like to do backups while editing.

Last, you need to make sure the data is not swapped from memory to the disk. If you have enough RAM, the best option may be to just turn off swapping altogether.

And as a fail-safe, it might be a good idea to use VeraCrypt for FDE (full disk encryption). That way, even if it somehow leaks to the SSD, it will at least be encrypted using the disk password.