Need to leave computer in repair shop. How can I secure solid state drive contents?

Question

I need to take my desktop into a PC repair shop and leave it for a few days. It would be easy for them to copy the drives without me knowing. I am running Windows 10 with a password but this doesn't actually encrypt the drive. I have multiple SSDs in the PC. I considered just taking the SSDs out but this isn't a good idea because I want them to fix cabling issues (someone told me installing a new power supply is easy but I disagree).

I thought about encrypting sensitive files and encrypting them with Veracrypt but this doesn't seem to be a great idea. I would have to:

        a) find each file;
        b) encrypt it and then decrypt to use;
        c) securely wipe the unencrypted file.

Is there a better option?

Answer 1

Swapping the SSDs for blank (or at least empty of anything-you-care-about) ones would work, though of course then you'd have to swap them back afterward and that has some potential to mess up the cabling (depends on your case). It also requires some SSD(s) you don't care about.

Actually encrypting the drive is a good option. You can use Bitlocker (the Windows built-in disk encryption feature), though depending on your hardware and your Windows edition you might need to upgrade some stuff and/or change some settings to make this work (by default, Bitlocker wants a TPM, and I'm not sure if it's available on Home editions or not). You might be able to use "Device Encryption" even on Windows 10 Home; this is just BitLocker under the covers, but with less user control over its behavior (and in particular, it does require TPM 2.0, which many but not all modern machines have built into their CPUs). Alternatively you can use a third-party encryption utility. Veracrypt (among others) is able to perform full-volume encryption (same as Bitlocker) such that the OS and data are inaccessible without a password or USB key. In either case, the shop would still be able to turn the computer on, though not to get very far; they'd be stopped at or before the Windows login screen. However, all the data (not just specific files) on the disks would be encrypted at rest.

Finally, depending on the shop and the machine in question, you could remove the SSDs while whatever else gets fixed, and then bring them with you and ask the technician to install them while you watch. Installing SSDs takes very little time in most cases, especially for a trained and experienced technician, and can be done without ever letting the SSDs or machine out of your sight. Of course, if the SSDs are SATA and the shop doesn't know you're going to install a bunch of SATA SSDs, they might not run the power and data cables where you'll need them, which might slightly increase the time to install them. Not by much, though. Replacing the PSU on most cases really is quite easy, with cable management being the only tricky part at all and still not that hard (unless your case layout is really inconvenient or the cables are too short, which sometimes happens).

Answer 2

For the most part, you can't. If you want to be able to trust that your computer hasn't been tampered with, it needs to remain in your physical custody. I know someone told you this before and you disagreed with it, but replacing the power supply in a PC case is really no harder than replacing the surge protector strip under your desk; it's just a matter of unplugging and replugging cables (albeit with different plug types on them). As long as you take good notes/pictures of what goes where, you can't really mess it up. If you have concerns about the safety of your data handing the computer over to a shop, I really, cannot recommend strongly enough, figuring out how to do this yourself and avoiding the issue entirely.

If you do really need a shop to work on your computer, like if it's something more difficult you can't do yourself, take the drives out or at least use full disk encryption with the key not stored anywhere on the PC, but derived from a password you have to enter at boot time. I believe this can be done with Bitlocker on stock Windows these days but I'm not a Windows expert by any means so look to other answers for how to do that. Of course this will do nothing to mitigate the possibility of keyloggers or firmware-level malware that might be installed (with or without the shop's knowledge; it's possible their systems are infected by somebody else's malware) while they have your PC.

File-level encryption will help if your only concern is reading/copying certain sensitive data, but it will do nothing to prevent installation of backdoors/spyware that would let someone take your data the next time you use the computer, or (more likely) not-intentionally-malicious but harmful changes to your PC done by an incompetent and/or irresponsible technician during the time they have it.

Answer 3

I work at a computer repair place.

It would really help if you told us what kind of work you're having done on it. You mentioned replacing the power supply; is that all that's being done? Because, yes, replacing a power supply really is super easy. At my shop, if someone buys the power supply from us, we'll install it for free, right in front of the customer. Unless they have something weird going on, it shouldn't take more than 10 minutes (and that includes the time it takes to remove the old PS).

If there's any other work that needs to be done, the answer will really depend on the nature of that work. Removing the drives or encrypting them are the best options in this scenario, but that might not be possible if the tech needs to access the drive as part of the repair (for instance, installing drivers or removing viruses). In that case, you'll need to either back the files up to a flash drive and delete them, or use file-level encryption.

(If you do remove the drives yourself, make absolutely sure that you tell the tech that you did this.)

The answer also depends somewhat on the nature of the data you want to protect:

• Are you worried about them stealing your online banking data? Log out of your online bank(s), clear all browsing data, copy any password documents to a flash drive and delete them from the computer, then (if you want to be really sure) use a program to zero out the free space on the drive. (Note: If you do have passwords saved in a document somewhere, they really should be put in an encrypted password safe app anyway, so this might be a good opportunity to do so.)

• Are you writing a novel/screenplay/video game/D&D campaign that you don't want to leak? All those files should be grouped together, so it should be fairly simple to encrypt them or copy them to a flash drive, then securely erased.

• Do you have confidential customer information from your employer? That might be a little more complicated, but, again, your options are encryption or moving them to a flash drive. (Then again, if you're using your computer for work, you might be able to get your company's IT department to help you instead of taking it to a shop, so you don't have to worry about leaking confidential info in the first place.)

• Is it just your collection of furry midget porn? I wouldn't even worry about that, because, trust me, they've seen worse. (Though it would be polite to warn the tech about stuff like that, lest they unexpectedly get an eyeful of something they really didn't want to see.)

Answer 4

I have multiple SSDs in the PC.

Cool, take a picture and print it.

---

I considered just taking the SSDs out

Yes, do this.

If you're afraid of breaking something then have the technician remove them and give them to you to bring home.

When you go to pick up your computer then just bring your drives and they will re-install them.

---

but this isn't a good idea because I want them to fix cabling issues

If the technician has a picture of where your SSDs are then it's trivial to pre-route the cables to those locations.

---

someone told me installing a new power supply is easy but I disagree

Yes, it really is trivial; for a technician. Your disagreement is unfounded.

---

It really depends on what's being fixed.

If you have a fierce virus or a corrupt Windows 10 installation then you kind of have to trust them to be professional. If you have sensitive stuff and don't want them freely snooping around then back up your stuff, delete it from your drives, and run trim a few times. You're very unlikely to be a worthwhile target for a data recovery procedure.

If you're having a hardware issue and nothing happens when you press the power button then just take out the drives. If the technician gets to a point where they boot into the BIOS then your problem is resolved as far as they're concerned.

If a motherboard replacement is required then you will likely need to re-install Windows from scratch and bring your files over. I would imagine they would coordinate such an endeavor with you.

Answer 5

One approach is to use a bootable USB drive to erase everything on the SSDs and hard drive. Then erase free space on those devices using something like cipher.exe /w for a HDD or an SSD-specific tool that accounts for wear-levelling.

You could maybe install some bootable OS on the HDD for testing.

Then take the computer to the repair shop.

When you get it back, wipe it again and restore Windows and your apps and data from any of your regular backups. (As the first step in this plan, you might want to test a few of your onsite and offsite backups if you haven't done so recently)

Answer 6

You might be able to set an ATA password for the SSD(s). I believe that most desktop UEFI/BIOS firmware implementations do not have an option to do that (laptops generally do), but you might be able to find a tool that can run from a USB boot drive to set that password. The hdparm tool of any Live USB Linux distribution would be able to do that, for example.

Please note that in general this will only password-protect the drive, it will not actually encrypt the data. A really determined attacker (like certain 3-letter agencies) would still be able to bypass the lockout [1], but I would not expect the average computer tech to spend that kind of effort.

The advantage of this option is that you don't need any kind of OS support - the data on the drive is basically unmodified. Once you get your PC back, you remove the password and all is as before.

The obvious disadvantage is that if something goes wrong, you lose your data. So, backing up your data is crucial - as it would be even if you were not playing with drive passwords.

---

[1] Generally, bypassing the lockout would require modifying the drive electronics physically, or updating it to a custom firmware version that skips the password check. Not impossible - far from it - but not totally trivial either.

Answer 7

Take out the SSD hard drive then go get another SSD hard drive that is the same as that one and put that in the spot where your ''sensitive'' SSD is then let them install the power supply when you get it back swap out the blank SSD that you had with your ''sensitive'' one

This allows them to run all the cables exactly where you need them to run it and the drive is not ever in their possession so if it's that important spend a little extra cash

Answer 8

If there is one important thing that could be learnt from reading stories written by employees and owners of computer repair shops, it is that such shops cannot and should not be trusted because a fraction of people working in such places are more than happy to eagerly analyze the entire contents of their client's file system, even if such analysis is not in any way required to solve the issue they are being paid to fix. I am not denying the fact that there are a lot of honourable and professional people working in such places who respect computer's owner right to privacy, but we still need to remember that the number of people who could be described as the opposite is greater than zero. Even if such people make as little as 1% of all the employees, it is still a great concern. Such people will feel absolutely no shame whatsoever while rummaging through your private files, for reason no other than that they technically (but not morally) can, and will potentially publicly upload, let's say, your photos to the Web anything that could in their eyes make a "funny" juvenile Internet "meme" of the "super embarrassing private thing found in client's PC!" flavour.

Only sensible solution is, never leave your HDDs/SSDs together with your PC. If your PC has CD/DVD optical drive, set the BIOS to boot from it. Obtain a Live CD, on which a portable version of operating system of your choice is burnt. Before leaving the PC in repair shop, remove all HDDs/SSDs and instead put the said Live CD inside the drive. Live USB stick could be used instead, but it won't have the advantage of being read-only as CD/DVD.

Good thing to do, regardless if you want to do according to my aforementioned advice or not, is to make a subtle and implicit but unambiguous impression that you were a lawyer or otherwise professionally involved with occupations that suggest having a significant legal muscle. Practicing law without the license is illegal, but dressing like a lawyer and using lawyer slang is not, as long as you do not officially and explicitly claim that your are a lawyer while not being a lawyer. Any subtle suggestions of having family or friends employed in state's administrative occupation, like an embassy, would also certainly discourage any bottom-feeding wannabe digital sniffers from messing with you from their fear of being sued. The mentioned impression and suggestions could be both in the form of your clothing and appearance while you are visiting the shop and interacting with employees, and in the form of suggestive files with appropriately intimidating contents, like "nondisclosure_breach_lawsuit_2.docx" innocently and seemingly accidentally left in plain sight on your PC's desktop. In general, figuratively speaking, just make sure to subtly flex your legal muscle in front of the repair shop crew, whether that muscle is real or non-existent, to make a proper impression and indirectly telegraph that messing with your privacy will have consequences.

Good luck!

Answer 9

I have complete faith in VeraCrypt. On each of my computers, I have created a VeraCrypt folder and copied the User folders (Docs, Pictures, Videos, etc.) into it. From then on, I only use the User's Music folder (no need for privacy), and always read and write personal files to the VeraCrypt folders (which open as a virtual drive). When I don't need to access these folders, all I have to do is close the virtual drive and exit VeraCrypt. Nobody is aware that VeraCrypt's vault file actually contains my encrypted folders.