1

I have a Windows laptop machine with a traditional hard disk drive and I used it for a year and then I turn on the full disk encryption (Including system and non system partitions) using veracrypt fde. Password is secure and is only in my head. In near future I have to travel to a country where I believe I'll be asked to reveal the password by airport officials to decrypt the contents of drive (they can also copy data bit by bit from my drive). To avoid that I don't want to carry any data on the hard drive and it's OK for me to destroy the information rather than handing over to government officials. I have also read the Electronic Frontier Foundation guide on this but that emphasize more on wiping the drive.

Question:

Using Ubuntu live USB, simply quick formatting the whole drive will make it impossible to read contents? I know quick format doesn't write any new data and old data is still there but as encryption keys are derived from the password and with out it the encrypted data still present in the drive will be useless to authorities? or do i have to rewrite whole drive with zeroes or random data? which is a bit time consuming.

Improve this question
2
  • To be clear, you've encrypted the drive with a strong password, no useful data was on the drive before it was encrypted, and you want to make it so that even with the password, no data can be recovered?
    – AndrolGenhald
    Feb 15, 2019 at 18:25
  • One quick question - when you turned on FDE, did you encrypt the entire drive, or only the in-use portions? Because the OS is going to shuffle things around as it needs to - this used to be more common with defragging - which might mean that you have outstanding hidden copies.
    – Clockwork-Muse
    Feb 15, 2019 at 18:44

3 Answers 3

Reset to default
1

Provided that your password is strong, and the laptop is set up to require your password on startup (ie it is not setup to auto-login) then your data will be protected.

It sounds though, like your concern is not about the encryption itself, but about rubber hose attacks, as per XKCD:

XKCD $5 wrench comic

So what you're really after is plausible deniability that there is any data on the drive at all (ie you want to be able to say "What password? This drive is empty" and have them believe you).

To that end, a quick format will probably be enough to get through airport security because the laptop won't boot. But if the airport people become suspicious and seize your laptop then it will be quite clear to any forensic analyst that there is encrypted data on the drive, and they may mount a legal case in order to compel the password from you.

So it depends on the level of risk you're willing to take. Your options are, starting with the most secure:

  • Travel with no hard drive and install one / buy a USB stick and make a bootable OS once you arrive.
  • Fully wipe the drive according to the EFF recommendations.
  • Soft wipe (aka quick format) the drive.
  • Leave it as-is and hope they don't ask you for the password.
Improve this answer
1

Full disk encryption works (in brief) by generating a random key to encrypt all the data (data encryption key, aka DEK), then encrypting that key with another key derived from a password (key encryption key, aka KEK).

For most people, it should be plenty sufficient to overwrite the encrypted DEK to prevent decryption of the drive. The easiest way to do this is to wipe the volume header, unfortunately it doesn't seem that veracrypt provides an easy way to do this.

One option may be to put some random data in a file (eg head -c 32 /dev/urandom >keyfile on linux), and use it as a keyfile. Deleting that file will then make it impossible to decrypt the drive. (Take this with a grain of salt though, I've never used veracrypt myself, and I can't vouch for the safety of this suggestion.)

If you're worried about them physically tearing apart the drive and directly accessing the chips (or disks) the above solutions won't be sufficient. HDDs include extra storage for when sectors fail, and if you're terribly unlucky the sector containing the volume header may fail and be remapped, leaving the failed sector still recoverable. SSDs are even worse in this regard, as they overprovision space and use wear-leveling algorithms, meaning writing to the same sector several times will likely be going to different physical locations.

In this case your best bet is to wipe the drive fully, but even this doesn't guarantee that some data could potentially be recovered. You can also use the ATA Secure Erase command, but be aware that some implementations of this have been known to be flawed.

Improve this answer
0

Since you say you are worried about being compelled to divulge the password I would suggest wiping the drive or if the data is extremely sensitive destroying the drive and getting a new one.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .