20

I need to take my desktop into a PC repair shop and leave it for a few days. It would be easy for them to copy the drives without me knowing. I am running Windows 10 with a password but this doesn't actually encrypt the drive. I have multiple SSDs in the PC. I considered just taking the SSDs out but this isn't a good idea because I want them to fix cabling issues (someone told me installing a new power supply is easy but I disagree).

I thought about encrypting sensitive files and encrypting them with Veracrypt but this doesn't seem to be a great idea. I would have to:

        a) find each file;
        b) encrypt it and then decrypt to use;
        c) securely wipe the unencrypted file.

Is there a better option?

12
  • 9
    I want to mention that you should also make a backup of your files if you haven't done yet. You don't know what happens to your data at the repair shop.
    – user11909
    Apr 22 at 8:41
  • 20
    What is being repaired?
    – user253751
    Apr 22 at 10:14
  • 2
    This question should probably be migrated to SuperUser and the title changed to "How do I replace my power supply?" OP just needs to provide some pictures of their current situation and I'm sure someone can quickly get them going. The risk of data loss with encryption is too high based on OPs estimated skillset per the comments.
    – MonkeyZeus
    Apr 22 at 16:51
  • 11
    @Nat it's quite common for repair techs to be busted looking at naked photos. It's not common for them to install delayed-reaction crypto-miners.
    – user253751
    Apr 22 at 17:47
  • 2
    @user253751: There're stories about malware-gangs recruiting folks with access to devices to run scripts to do such things (example).
    – Nat
    Apr 22 at 19:51

9 Answers 9

25

Swapping the SSDs for blank (or at least empty of anything-you-care-about) ones would work, though of course then you'd have to swap them back afterward and that has some potential to mess up the cabling (depends on your case). It also requires some SSD(s) you don't care about.

Actually encrypting the drive is a good option. You can use Bitlocker (the Windows built-in disk encryption feature), though depending on your hardware and your Windows edition you might need to upgrade some stuff and/or change some settings to make this work (by default, Bitlocker wants a TPM, and I'm not sure if it's available on Home editions or not). You might be able to use "Device Encryption" even on Windows 10 Home; this is just BitLocker under the covers, but with less user control over its behavior (and in particular, it does require TPM 2.0, which many but not all modern machines have built into their CPUs). Alternatively you can use a third-party encryption utility. Veracrypt (among others) is able to perform full-volume encryption (same as Bitlocker) such that the OS and data are inaccessible without a password or USB key. In either case, the shop would still be able to turn the computer on, though not to get very far; they'd be stopped at or before the Windows login screen. However, all the data (not just specific files) on the disks would be encrypted at rest.

Finally, depending on the shop and the machine in question, you could remove the SSDs while whatever else gets fixed, and then bring them with you and ask the technician to install them while you watch. Installing SSDs takes very little time in most cases, especially for a trained and experienced technician, and can be done without ever letting the SSDs or machine out of your sight. Of course, if the SSDs are SATA and the shop doesn't know you're going to install a bunch of SATA SSDs, they might not run the power and data cables where you'll need them, which might slightly increase the time to install them. Not by much, though. Replacing the PSU on most cases really is quite easy, with cable management being the only tricky part at all and still not that hard (unless your case layout is really inconvenient or the cables are too short, which sometimes happens).

10
  • 5
    From Microsoft: "BitLocker encryption is available on supported devices running Windows 10 or 11 Pro, Enterprise, or Education." - No Windows 10/11 Home Apr 22 at 8:39
  • 7
    Depending on the level of security desired, simply using the inline encryption provided by the Windows implementation of NTFS. This only encrypts file contents, not filesystem metadata, but if you just care about a handful of specific files it’s much quicker than FDE and should not require any special Windows license or additional software. Apr 22 at 11:46
  • 1
    If you decide to remove and re-fit the disks yourself, make sure you let them know you're doing that, how many disks there are, and where they go - so they can make sure they run the appropriate power/data cables.
    – Gh0stFish
    Apr 22 at 14:14
  • 6
    @IanKemp: I beg to differ. I was swapping disks long before I was swapping power supplies.
    – Joshua
    Apr 22 at 16:42
  • 2
    @JohnD I hope you're not confusing CPU power with PCI-E power cables, which is a mistake I've learnt of recently and it's apparently easy to make if your cables are not labeled properly. New power supplies should have all sets of cables. Take note how the bottom pair of pins is different: one goes to the motherboard (CPU power), another to the GPU qph.fs.quoracdn.net/…
    – Lodinn
    Apr 23 at 19:34
15

For the most part, you can't. If you want to be able to trust that your computer hasn't been tampered with, it needs to remain in your physical custody. I know someone told you this before and you disagreed with it, but replacing the power supply in a PC case is really no harder than replacing the surge protector strip under your desk; it's just a matter of unplugging and replugging cables (albeit with different plug types on them). As long as you take good notes/pictures of what goes where, you can't really mess it up. If you have concerns about the safety of your data handing the computer over to a shop, I really, cannot recommend strongly enough, figuring out how to do this yourself and avoiding the issue entirely.

If you do really need a shop to work on your computer, like if it's something more difficult you can't do yourself, take the drives out or at least use full disk encryption with the key not stored anywhere on the PC, but derived from a password you have to enter at boot time. I believe this can be done with Bitlocker on stock Windows these days but I'm not a Windows expert by any means so look to other answers for how to do that. Of course this will do nothing to mitigate the possibility of keyloggers or firmware-level malware that might be installed (with or without the shop's knowledge; it's possible their systems are infected by somebody else's malware) while they have your PC.

File-level encryption will help if your only concern is reading/copying certain sensitive data, but it will do nothing to prevent installation of backdoors/spyware that would let someone take your data the next time you use the computer, or (more likely) not-intentionally-malicious but harmful changes to your PC done by an incompetent and/or irresponsible technician during the time they have it.

12
  • 2
    What makes you sure installing a power supply is easy? I tried and there was a socket on the motherboard I couldn't find a matching cable for (there were several similar ones but none fit).
    – JohnD
    Apr 22 at 15:25
  • 10
    @JohnD: It's at least easier than figuring out how to secure your data/privacy in a way you can be confident in. It's also possible to take photos to a shop and make sure you have the right product, ask them questions about it, etc. without hiring them to do the work and leaving your PC there. Apr 22 at 16:40
  • 2
    @JohnD It's normally only 2 headers on the motherboard that are populated by the PSU - it's very normal for there to be unused headers. There is a compatibility requirement though as the main power cable varies in size. Apr 22 at 16:53
  • I copied where the previous PS was connected. I'm seriously asking, are all power supplies supposed work with all motherboards? Obviously things like the CPU require a specific socket so is it similar for power supplies?
    – JohnD
    Apr 22 at 17:45
  • 4
    Standard ATX power supplies all have the same main board connectors; a big 20+4 connector and one or more 4/8 pin connectors. However major OEMs (ie Dell, HP, etc) often use proprietary designs with different connectors and won't work with standard PSUs as a result. Apr 22 at 19:52
11

I work at a computer repair place.

It would really help if you told us what kind of work you're having done on it. You mentioned replacing the power supply; is that all that's being done? Because, yes, replacing a power supply really is super easy. At my shop, if someone buys the power supply from us, we'll install it for free, right in front of the customer. Unless they have something weird going on, it shouldn't take more than 10 minutes (and that includes the time it takes to remove the old PS).

If there's any other work that needs to be done, the answer will really depend on the nature of that work. Removing the drives or encrypting them are the best options in this scenario, but that might not be possible if the tech needs to access the drive as part of the repair (for instance, installing drivers or removing viruses). In that case, you'll need to either back the files up to a flash drive and delete them, or use file-level encryption.

(If you do remove the drives yourself, make absolutely sure that you tell the tech that you did this.)

The answer also depends somewhat on the nature of the data you want to protect:

  • Are you worried about them stealing your online banking data? Log out of your online bank(s), clear all browsing data, copy any password documents to a flash drive and delete them from the computer, then (if you want to be really sure) use a program to zero out the free space on the drive. (Note: If you do have passwords saved in a document somewhere, they really should be put in an encrypted password safe app anyway, so this might be a good opportunity to do so.)

  • Are you writing a novel/screenplay/video game/D&D campaign that you don't want to leak? All those files should be grouped together, so it should be fairly simple to encrypt them or copy them to a flash drive, then securely erased.

  • Do you have confidential customer information from your employer? That might be a little more complicated, but, again, your options are encryption or moving them to a flash drive. (Then again, if you're using your computer for work, you might be able to get your company's IT department to help you instead of taking it to a shop, so you don't have to worry about leaking confidential info in the first place.)

  • Is it just your collection of furry midget porn? I wouldn't even worry about that, because, trust me, they've seen worse. (Though it would be polite to warn the tech about stuff like that, lest they unexpectedly get an eyeful of something they really didn't want to see.)

7
  • What makes you sure installing a power supply is easy? I tried and there was a socket on the motherboard I couldn't find a matching cable for (there were several similar ones but none fit).
    – JohnD
    Apr 22 at 15:26
  • 3
    @JohnD Because I've done it dozens of times. It's never taken me more than 10 minutes, and rarely takes more than 5. (Like I said, I work at a computer repair shop.) Apr 22 at 15:37
  • 2
    If OP does not know how to replace a power supply, the chances of them knowing how to not just move off or encrypt sensitive data, but also ensure that any remnants on the disk were properly scrubbed, are basically zero. Just doing the former without the latter is providing nothing but a false sense of security. Any nosy tech can run PhotoRec and scrounge around for salient data. Apr 22 at 18:02
  • 1
    @R..GitHubSTOPHELPINGICE Yeah, I didn't know that they'd tried to do it themselves when I posted this answer. It's still good advice (at least, I think so), so I'm going to leave it as-is. Apr 22 at 18:32
  • 1
    I think it should come with a caveat that it's only a solution with suitable expertise, and otherwise dangerous advice to rely on. Apr 22 at 19:48
6

I have multiple SSDs in the PC.

Cool, take a picture and print it.


I considered just taking the SSDs out

Yes, do this.

If you're afraid of breaking something then have the technician remove them and give them to you to bring home.

When you go to pick up your computer then just bring your drives and they will re-install them.


but this isn't a good idea because I want them to fix cabling issues

If the technician has a picture of where your SSDs are then it's trivial to pre-route the cables to those locations.


someone told me installing a new power supply is easy but I disagree

Yes, it really is trivial; for a technician. Your disagreement is unfounded.


It really depends on what's being fixed.

If you have a fierce virus or a corrupt Windows 10 installation then you kind of have to trust them to be professional. If you have sensitive stuff and don't want them freely snooping around then back up your stuff, delete it from your drives, and run trim a few times. You're very unlikely to be a worthwhile target for a data recovery procedure.

If you're having a hardware issue and nothing happens when you press the power button then just take out the drives. If the technician gets to a point where they boot into the BIOS then your problem is resolved as far as they're concerned.

If a motherboard replacement is required then you will likely need to re-install Windows from scratch and bring your files over. I would imagine they would coordinate such an endeavor with you.

7
  • What makes you sure installing a power supply is easy? I tried and there was a socket on the motherboard I couldn't find a matching cable for (there were several similar ones but none fit).
    – JohnD
    Apr 22 at 15:25
  • 4
    I just guided a complete beginner through buying and installing a replacement PSU in his PC because his previous one blew up. It is incredibly simple. Power supplies today, especially modular ones, come with cables for everything - cables are cheap and they don't want to spec themselves out of a customer. The cables also will physically not plug in to any place they're not supposed to go, so the only way you can get it wrong is by forgetting a plug, which just means that hard drive or whatever won't turn on. If you need help going through this process yourself, please feel free to contact. Apr 22 at 15:51
  • @JohnD Your question suggests that the repair shop will be replacing the power supply, is this not true? Please indicate what work the repair shop will perform. Installing a power supply is trivial for them; trivial for me too. Sorry if you thought that statement was directed at you.
    – MonkeyZeus
    Apr 22 at 16:39
  • @AdamBarnes "come with cables for everything" mine came with many cables but none fit the motherboard.
    – JohnD
    Apr 22 at 22:30
  • 2
    That is incredibly surprising to me - motherboards take a 24 pin ATX connector as standard, and some require an extra 4 or 8 pin ATX connector if they're particularly high end. Unless you're on some particularly esoteric server hardware, I don't know of a single motherboard that doesn't follow this pattern. Apr 23 at 2:54
4

One approach is to use a bootable USB drive to erase everything on the SSDs and hard drive. Then erase free space on those devices using something like cipher.exe /w for a HDD or an SSD-specific tool that accounts for wear-levelling.

You could maybe install some bootable OS on the HDD for testing.

Then take the computer to the repair shop.

When you get it back, wipe it again and restore Windows and your apps and data from any of your regular backups. (As the first step in this plan, you might want to test a few of your onsite and offsite backups if you haven't done so recently)

2
  • 1
    Does cipher.exe /w use the SSD manufacturer's secure delete method? Due to wear leveling it's recommended to use the manufacturer's tool to delete the drive. Apr 23 at 21:55
  • 2
    @Nathan. good point, I'll amend the answer. Apr 23 at 22:08
3

You might be able to set an ATA password for the SSD(s). I believe that most desktop UEFI/BIOS firmware implementations do not have an option to do that (laptops generally do), but you might be able to find a tool that can run from a USB boot drive to set that password. The hdparm tool of any Live USB Linux distribution would be able to do that, for example.

Please note that in general this will only password-protect the drive, it will not actually encrypt the data. A really determined attacker (like certain 3-letter agencies) would still be able to bypass the lockout [1], but I would not expect the average computer tech to spend that kind of effort.

The advantage of this option is that you don't need any kind of OS support - the data on the drive is basically unmodified. Once you get your PC back, you remove the password and all is as before.

The obvious disadvantage is that if something goes wrong, you lose your data. So, backing up your data is crucial - as it would be even if you were not playing with drive passwords.


[1] Generally, bypassing the lockout would require modifying the drive electronics physically, or updating it to a custom firmware version that skips the password check. Not impossible - far from it - but not totally trivial either.

1

Take out the SSD hard drive then go get another SSD hard drive that is the same as that one and put that in the spot where your ''sensitive'' SSD is then let them install the power supply when you get it back swap out the blank SSD that you had with your ''sensitive'' one

This allows them to run all the cables exactly where you need them to run it and the drive is not ever in their possession so if it's that important spend a little extra cash

1
  • That answer has already been given.
    – Chenmunka
    Apr 22 at 17:13
0

If there is one important thing that could be learnt from reading stories written by employees and owners of computer repair shops, it is that such shops cannot and should not be trusted because a fraction of people working in such places are more than happy to eagerly analyze the entire contents of their client's file system, even if such analysis is not in any way required to solve the issue they are being paid to fix. I am not denying the fact that there are a lot of honourable and professional people working in such places who respect computer's owner right to privacy, but we still need to remember that the number of people who could be described as the opposite is greater than zero. Even if such people make as little as 1% of all the employees, it is still a great concern. Such people will feel absolutely no shame whatsoever while rummaging through your private files, for reason no other than that they technically (but not morally) can, and will potentially publicly upload, let's say, your photos to the Web anything that could in their eyes make a "funny" juvenile Internet "meme" of the "super embarrassing private thing found in client's PC!" flavour.

Only sensible solution is, never leave your HDDs/SSDs together with your PC. If your PC has CD/DVD optical drive, set the BIOS to boot from it. Obtain a Live CD, on which a portable version of operating system of your choice is burnt. Before leaving the PC in repair shop, remove all HDDs/SSDs and instead put the said Live CD inside the drive. Live USB stick could be used instead, but it won't have the advantage of being read-only as CD/DVD.

Good thing to do, regardless if you want to do according to my aforementioned advice or not, is to make a subtle and implicit but unambiguous impression that you were a lawyer or otherwise professionally involved with occupations that suggest having a significant legal muscle. Practicing law without the license is illegal, but dressing like a lawyer and using lawyer slang is not, as long as you do not officially and explicitly claim that your are a lawyer while not being a lawyer. Any subtle suggestions of having family or friends employed in state's administrative occupation, like an embassy, would also certainly discourage any bottom-feeding wannabe digital sniffers from messing with you from their fear of being sued. The mentioned impression and suggestions could be both in the form of your clothing and appearance while you are visiting the shop and interacting with employees, and in the form of suggestive files with appropriately intimidating contents, like "nondisclosure_breach_lawsuit_2.docx" innocently and seemingly accidentally left in plain sight on your PC's desktop. In general, figuratively speaking, just make sure to subtly flex your legal muscle in front of the repair shop crew, whether that muscle is real or non-existent, to make a proper impression and indirectly telegraph that messing with your privacy will have consequences.

Good luck!

1
  • One computer repairshop employee found so far, as I guess from this answer's score.
    – user276955
    Apr 23 at 18:03
0

I have complete faith in VeraCrypt. On each of my computers, I have created a VeraCrypt folder and copied the User folders (Docs, Pictures, Videos, etc.) into it. From then on, I only use the User's Music folder (no need for privacy), and always read and write personal files to the VeraCrypt folders (which open as a virtual drive). When I don't need to access these folders, all I have to do is close the virtual drive and exit VeraCrypt. Nobody is aware that VeraCrypt's vault file actually contains my encrypted folders.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.