1

My method for editing encrypted text files is to decrypt them in a RAM drive, edit them, and then encrypt them.
What I'm worried about is information from my text files being transferred to non-volatile memory drives (for example by the creation of temp files in the drive in which Windows is installed).

How could I edit text files directly in a RAM drive without having information from the text files being transferred to non-volatile memory drives?

  • You mean a RAMdisk? – tungsten Sep 12 '19 at 18:26
  • Yes, I mean RAMdisk. – avraham Sep 12 '19 at 18:29
  • 2
    I think the main issue would be if the OS decides to swap the text editor memory to disk. There are commands (for example VirtualLock) in the various operating systems to allocate/designate a buffer that is "secure" against the OS swapping it to disk, but I am not aware of any text editors that are programmed to take those precautions. – user Sep 12 '19 at 19:09
2

A slightly radical approach, but if you really want to ensure that no (unencrypted) information from those text files ends up on non-volatile memory drives, I recommend you to use a Live CD (such as Knoppix), and only from there, mount the hard disk, copy the encrypted files to a ramdisk (everywhere else will be in-memory), decrypt and edit as needed.

The main advantage of using a live disk is that by having the whole OS in-memory you are barring most of the potential leaks, such as unexpected temporary files or the OS deciding to page the text editor. You will mostly only need to:

  • Ensure that the distribution you are using in the Live CD does not automatically mount a swap partition you might have in your disk.
  • Copy the encrypted file itself to a different location than the mounted drive, for safely decrypting and editing. If you feel extra paranoid you could even unmount the normal disk before decrypting and remount after deleting the plantext version, but it isn't needed.
|improve this answer|||||
  • Some Live CDs do automatically mount swap. Others don't. That's why I mentioned it. Not having Linux swap partitions (as he is likely not to have on his Windows box) is a way of ensuring one isn't mounted automatically. It is a bit more complicated on WIndows, as it uses a pagefile (pagefile.sys) instead of a dedicated partition, so it isn't as simple to disable as a swapoff. He could change the maximum pagefile size to 0, but it may require a reboot and if it happens to be non-zero, Windows might even decide to use it anyway. – Ángel Sep 12 '19 at 23:08
  • Clearly I didn't finish reading the answer before commenting... – AndrolGenhald Sep 12 '19 at 23:10
  • @AndrolGenhald heh, no problem. That made for an easy reply :) – Ángel Sep 12 '19 at 23:14
  • @drewbenn I mentioned that in the "If you feel extra paranoid...". The point is that while a program may automatically save some confidential data in a subfolder of /home even that is in a ramdisk. It is highly unlikely that they decided to automatically save data in /mnt. They might if saving the temp file at the same location as the original file, but since we are copying the encrypted file outside that point for decryption (suppose to /home/live/Desktop), editing the decrypted file there, such temporary file would also be on the Desktop, not anywhere near /mnt. – Ángel Sep 13 '19 at 16:52
1

Probably not the exact solution you're looking for, but using full disk encryption would ensure that swaped files are always stored in an encrypted volume.

In the case of Windows as the swap partition is actually a file in the regular filesystem - which is encrypted by FDE - it would be encrypted

For *nix systems you should make sure that the swap partition is inside an encrypted volume

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.