As a follow-up to the question in The DMZ, is an encrypted drive (full disk encrypted e.g. LUKS, BitLocker) protected against malware if it is not mounted when using a LiveCD?

The use case is that no other devices are available and there is a need to inspect potentially malicious files.

The assumptions are;

  • The malware is not designed to wipe drives and for malware to wipe a drive it must be executed on the host that has a decrypted volume/partition.
  • When a drive is fully encrypted, there are no unencrypted blocks that the malware can write to without mounting the drive.
  • Malware can only affect an encrypted drive if it is mounted decrypted.
  • If malware is executed, when running a LiveCD, it is limited to memory and cannot affect firmware or BIOS.
  • Methods such as dd are not considered to be part of the threat model.

Note: The use of drive is synonymous with disk for the avoidance of doubt.


It's protected in the sense that malware cannot be installed on the unmounted encrypted drive. However it's still possible for the encrypted drive to be damaged or destroyed if the drive can be written. A simple dd to the raw unmounted drive can destroy it.

 ----  Edit  ----

If the encrypted drive is a bootable drive, then there is an unencrypted boot partition that could in theory be modified in an "Evil Maid" equivalent.

  • Thanks. I elaborated the question that commands such as dd are not part of the threat model as this resembles wiperware – Ryan Jan 11 '20 at 18:43
  • 3
    @Ryan: it is still possible that the malware does not wipe the device but instead encrypts the (already encrypted device) with a key only known to the attacker. While the attacker has no access to the unencrypted data themselves they can still demand a ransom to allow the user access to the drive again. This would not be wiperware but ransomware. – Steffen Ullrich Jan 11 '20 at 18:54
  • 1
    @Ben - The reason I ruled out dd is because the data on the disk while sensitive isn't critical for an availability perspective i.e. if data is lost as a result of a disk being wiped, it can be restored from backup. – Ryan Jan 11 '20 at 19:24
  • 1
    @SteffenUllrich - Gotcha. If the data is considered to be sensitive but not critical from an availability perspective, would it be fair to state that the risk of a disruptive attack against an encrypted drive such as a wipe or encryption is low or a non-issue? The primary objective is to protect the underlying encrypted files from being compromised or exfiltrated. – Ryan Jan 11 '20 at 19:49
  • 1
    @Ryan: "Is forward secrecy an issue with to consider?" - I don't think that this makes any sense in the context of disk encryption since there is no key exchange involved here. But you might check at Cryptography to get better experts about this topic. – Steffen Ullrich Jan 11 '20 at 20:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.