As a follow-up to the question in
The DMZ, is an encrypted drive (full disk encrypted e.g. LUKS, BitLocker) protected against malware if it is not mounted when using a LiveCD?
The use case is that no other devices are available and there is a need to inspect potentially malicious files.
The assumptions are;
- The malware is not designed to wipe drives and for malware to wipe a drive it must be executed on the host that has a decrypted volume/partition.
- When a drive is fully encrypted, there are no unencrypted blocks that the malware can write to without mounting the drive.
- Malware can only affect an encrypted drive if it is mounted decrypted.
- If malware is executed, when running a LiveCD, it is limited to memory and cannot affect firmware or BIOS.
- Methods such as
ddare not considered to be part of the threat model.
Note: The use of drive is synonymous with disk for the avoidance of doubt.