I saw a hot network question on SE, about Workplace Ethics - Do I give my password at work to my old boss after quitting?. My initial response (as are the answers in that question) is always NO. The reasons are highlighted there, and I'm sure all of you agree with me.

My question though is about one of the answers, talking about full disk encryption. For items like TrueCrypt, or maybe even BitLocker. They encrypt the disk, and use a passphrase to unlock it. I also know that Dell (and other companies, I'm sure) can have the hard drives encrypted before booting past the BIOS, again with a password.

With these methods, obviously just resetting a password in Active Directory or your Samba server won't give you access to the system. But what methods could an organization use that would allow Full Disk Encryption, but be able to recover or access the data if the employee leaves (i.e. Hit by a bus, fired, quit)? Or are there other considerations?

I should note though, that one of my previous employers used the Dell Hard Disk Encryption passwords, but it was set to our password, and we were free to change it whenever we wanted. An employee passed on, then all current laptops needed their passwords changed to ONE generic password, which I don't believe should be the case. Correct me if I'm wrong, though.


The usual method for recovery is to have a key escrow. Basically, full-disk encryption uses a symmetric key K. From the user's password p is derived another key Kp, which is used to encrypt K: the disk contains both all the data (encrypted with K) and EKp(K). When the user types his password, Kp is rebuilt, and then used to recover K. (This indirection allows for some interesting things, e.g. you can change your password without having to reencrypt the whole disk.)

A full-disk encryption solution will also store EKa(K), where Ka is the encryption key of an administrator or "recovery agent". This time, asymmetric encryption is often used (Ka is public, but the corresponding decryption key is known only to the recovery agent). If the password becomes unavailable (user forgot his password; user was fired; user died; user has been arrested on the Mexican border with 371 lb of Marijuana and won't be available for a few years;...), then the recovery agent can use his private key to recover K and thus unlock the data.

The key K is often called the "master key". The "recovery agent" can be an external device where a copy of K is stored (TrueCrypt calls that a rescue disk). In some systems the asymmetric encryption with Ka is skipped and a copy of the master key K is directly sent to the recovery agent (details vary depending on software solution and configuration options).

In any case, if your full-disk encryption does not offer at least some duly documented recovery options, then just don't use it.

  • Very nice answer! I am glad to know there are recovery methods available – Canadian Luke May 2 '14 at 17:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.