3

Let us say that we have a computer with a fully encrypted disk. If it gets infected with malware, does this make it more difficult to use a LiveCD or other rescue option to clean it or restore it? It seems to me that one would have to decrypt the volume before cleaning, which feels like a lot of work.

  • 1
    Note that "malware removal" is a sub-optimal means of dealing with the problem. As painful as it may be, nuking from orbit is your only realistic option. – Jonathan Garber Mar 31 '14 at 12:23
1

Yes, full disk encryption is designed to stop those exact attack tools from operating. And that's a good thing, not a bad thing.

Tools like a RescueCD exist only to clean up the mess after someone incompetent failed to take proper care of their system. In a properly managed system, the admin will have made periodic backups of important files. A crash will be an inconvenience, not a risk.

In the rare case of a disaster that resulted in important data loss, the administrator still has the keys, and can possibly decrypt the data for recovery efforts.

On the other hand, tools like a RescueCD are great tools for an attacker. If the attacker cuts power to the system before the operator can secure all their files, the attacker can simply use these tools to access them. Or if a system has crashed in the middle of a sensitive operation, and the administrator doesn't realize that it's left unsecured data behind on the hard drive, that data can reappear later, such as when the disk is salvaged.

| improve this answer | |
  • So, I guess there's no real easy way to check if you're infected with a rootkit? – f1assistance Mar 31 '14 at 12:58
0

In short, no, these tools will not work in an encrypted environment. They will boot, considering encryption is the only restriction, but, if the problem is malware, then the malicious code itself, along with everything else, is encrypted. This said, there are tools in existence that may alleviate this. Backtrack, for example, has TrueCrypt built into it. In an emergency, one could "open" the drive and do some search and rescue. Backtrack also has antivirus tools, though it would, in many cases, be best to rescue critical files and nuke everything.

If the problem is corruption, however, things begin to be more difficult. I only have experience with TrueCrypt, but if one's key header is corrupted, and one has lost the repair disk, life gets harder, much much harder.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.