Is forensics possible with full disk encrypted drives?

I know that because we don't zero-fill our drives when we delete a file or the file system leaves a trace of a file usually forensics like recovering a deleted file or finding out that the file existed is possible.

Does that also apply to full disk encrypted drives?


If the attacker manages to obtain multiple disk image of an FDE encrypted drives over time, FDE may leak the location and sizes of the sectors that changed between the images.

Depending on what other information that the attacker already have available about you, they may be able to infer what kind of information is was changed.

Also, XTS which is the cipher mode most commonly used for full disk encryption leaks the penguin over time because of the way the tweaking works. Writing the same data to the same block will write the same encrypted block. If a certain block flips between two possible values, they may be able to infer when that flip happens and possibly which value turns into what. More information on this.

Finally, this is probably not relevant for the forensic scenario, but since XTS is not authenticated, a sophisticated attacker may also fiddle with the encrypted disk to modify the data in it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.