2

Suppose a Veracrypt container was mounted and dismounted later. Then CCleaner was run, Youtube was used to watch videos, websites are browsed, and so on for 3 hours. Then computer went to sleep (hibernate and pagefile disabled). What are the chances that the container can be decrypted because of whatever is left (master keys?) in the RAM or some where else??

Veracrypt version is below 1.24.

2
  • What OS is this running on? On Linux, it'll be using the kernel's dm-crypt which does wipe keys.
    – forest
    Jun 23, 2021 at 1:09
  • @forest When talking about "pagefile" it should be Windows of some kind.
    – U. Windl
    Jun 30, 2023 at 9:06

2 Answers 2

1

I have not personally verified this but according to Veracrypt Sourceforge:

  1. When the volume is dismounted, we securely wipe the encrypted master keys from memory.

  2. When Windows is shutdown or rebooted, we securely wipe the large memory region that was allocated at startup.

My interpretation is that recovering the keys after dismount would be unlikely.

1
  • Think that is only for 1.24 version... and also RAM encryption must be selected as an option in Veracrypt. May 28, 2021 at 18:45
0

In the current VeraCrypt version 1.25.9, I select these options in Preferences:

  • Use Secure Desktop for password entry.
  • Do not cache passwords in driver memory.
  • Wipe cached passwords on exit.
  • Wipe cached passwords on auto-dismount.

Enable auto-dismount volume after 30 minutes of no read/write activity. Dismount when user logs off.

1
  • While the password is needed only to open the volume, the master key is needed to access (decrypt/encrypt) the data (you don't need the password if you have the master key). So all these password options don't really answer the question.
    – U. Windl
    Jun 30, 2023 at 9:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .