11

I have a dual boot PC, where the Win10 (uncompressed) partition is encrypted with BitLocker. I was curious about making this test (and also encryption took quite a short time in my opinion), so while running Linux I did this:

# cat /dev/nvme0n1p3 | strings -25       
Remove disks or other media.
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
... some (very few) lines of garbled characters
# 

The time it took makes sense according to the partition size and type of disk, and about the garbled text, I guess that a there is a small chance that encrypted data could happen to form a short text string

In that partition there are of course lots of plain text files, so is it safe to say that with this test it's 100% sure that all information is encrypted?

8
  • 2
    That really depends on the size of the disk and the probability of the strings... Consider the probability of random bits producing a string then find the probability according to your size. If you really wonder that is encrypted, take a snapshot and decrypt yourself.
    – kelalaka
    Nov 22 at 10:37
  • 12
    A good test of what, please? Nov 22 at 22:55
  • 4
    It's probably fine if you're trying to distinguish between "either encryption or compression is turned on," and "both encryption and compression are turned off." For any other purpose, it's extremely suspect if not outright wrong.
    – Kevin
    Nov 23 at 1:04
  • 1
    I'm sorry, I failed read right to the end of the Question. Nov 23 at 16:21
  • 2
    Addressing "encryption took quite a short time", that is entirely possible if the drive supports hardware encryption, which means the data is already encrypted and all bitlocker needs to do is replace the blank key-encrypting-key with a new one. Unfortunately there are known issues with such drives so you may wish to force software encryption instead (default as of late 2019), or at least update the drive firmware.
    – Bob
    Nov 24 at 14:28
11

The test may be good or not, depending on what you need.

If you need to make a distinction between a known good encryption (bitlocker is pretty much acceptable for a lot of purposes) and a plaintext data, it is good.

The situation is much more frequent than you think.

It is probably better to use something like hexdump -C /dev/nvmexxx | less

A lot of filesystem structures are pretty much recognizable and low entropy that one can see even before reaching to the actual file data. E.g. a FAT32 table will have a sequences looking like xxxAxxxBxxxCxxxDxxxE ...

On the other hand, it is pretty much useless if you need to make a distinction between good and bad encryption. ... unless you are a trained cryptographer and you look for a particular pattern. In this case, you know the answer to this question anyway.

1
  • 2
    Thanks. No, I don't really want to make a distinction between good and bad encryption, I just did what an average user may do if they found a lost external disk drive and couldn't mount it but wanted to take a peek
    – golimar
    Nov 23 at 7:21
39

No, this is not a good test, not at all.

If you do the same with a zip file, or a docx, or a PNG, you won't see text strings, but the file is not encrypted. Not being able to see plaintext does not mean the file is encrypted.

Believing that garbled means encrypted can lead to wrongs assumptions. If you take a look at a terrible XOR cipher with a single byte key you may think the result is encrypted.

Lots of plaintext means for sure that the drive is not encrypted. Lack of plaintext does not mean anything.

11
  • 17
    If your drive have NTFS compression enabled, you would see garbage on an unencripted drive too.
    – ThoriumBR
    Nov 22 at 13:44
  • 4
    In other words, compression can look like encryption, if your test is just "is the plaintext visible". But it's not at all secure, so mistaking one for the other is a problem.
    – Bobson
    Nov 22 at 18:57
  • 16
    You cannot distinguish Compression from PRP by looking at the result from strings.
    – ThoriumBR
    Nov 22 at 21:14
  • 1
    OP literally ran strings to check: cat /dev/nvme0n1p3 | strings -25
    – ThoriumBR
    Nov 23 at 14:07
  • 3
    @kelalaka The question is not about randomness, it's about strings. Nov 23 at 17:30
3

Of the 256 values in a byte, 92 (126-32, 13, 10) are visible ascii characters. So there is about 1/3 probability that a random value is considered eligible by strings.

So the probability that 25 bytes in a row are visible characters is approximately (92/256)^25 =~ 0,000000000007739 which is approximately 10^-11. This is comparable to a terrabyte, so you should expect to see a few strings if dumping a harddrive full of randomly distributed data.

6
  • It's a 329 GiB partition and it showed about 5 lines of "text"
    – golimar
    Nov 23 at 8:11
  • 2
    @golimar Some of those might have been from the Bitlocker metadata, which is not encrypted (it can't be; it tells the OS how to derive the decryption key) and contains some amount of human-readable text (not 25 characters in a row, I don't think, but enough to have an impact on the odds of finding such a string).
    – CBHacking
    Nov 23 at 8:24
  • 1
    @golimar seems like a pretty reasonable guess that it's encrypted or compressed then. or it just isn't storing any text for some reason, like a drive full of pirated movies with filenames under 25 characters.
    – user253751
    Nov 23 at 13:08
  • For fun, exercise: what is probability to find hello in 329 GB of random-looking bytes? What is the probability to find at least one english word in these 329 GB? (let's say from the top-1000-english-words dictionary)
    – Basj
    Nov 25 at 8:53
  • @basj Well, you have 1/256 for each character instead of 92/256 so feel free to do the math. Nov 25 at 8:58
2

the Win10 is encrypted with BitLocker.

It means that the disk is fully encrypted, by design. Unless there is an in-progress encryption process, where some files are not (yet) encrypted you can rest assured the drive is safe. You could check for the BitLocker partition ID in the GUID table

I guess that a there is a small chance that encrypted data could happen to form a short text string

That looks like a bit of the infinite monkeys theorem. Ideally, encryption generates cipher text where each bit has a 50% probability to appear. That means a good cipher is like putting all possible n characters strings (typed on stripes of paper) in a ballot and randomly picking one. Intuitively...

So there is an infinitely low, but > 0 chance that cipher text appears to be like a plain string. E.g. you could even read hello somewhere in the text, just because random bytes have formed the ASCII for hello, which doesn't mean someone is greeting you or there is an unencrypted file.

While there are more odds of winning the hardest lottery around the world (6 figures over 90), mining plenties of cryptocurrency, you have a > 0 chance to spot a text looking meaningful to you.

I guess that the experiment itself has little to no scientific validity.

1
  • 3
    Imagine doing what OP did and seeing plaintext in the output...
    – ThoriumBR
    Nov 23 at 16:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.