While browsing PasteBin today, I noticed a new Paste that outlined approaches to compromising TrueCrypt protected data, as well as full Keys, Encryption Schemes, Plain-text Files, and Volume Names (and metadata). It was terribly un-nerving.

Appears this Pastebin was copied from this blog post, "TrueCrypt Master Key Extraction And Volume Identification."

My question is, what are the options to mitigate these attack vectors, barring Live-Boot/Read-Only OS's. Or are there any methods?

The Vectors outlined fall into two major categories:

  • Keys in Memory - Or keys left in swap-files.
  • Cached Data on Disk - Including data in swap-files, file history (some OS's cache files in plain-text), and TrueCrypt metadata (that can identify encryption schemes, volume use history, and identify the volume it's self [a USB drive with certain characteristics, or a specific file]).

Due to OS caching, my initial expectation is that there is no way to mitigate these attack vectors without a Read-Only OS, but I thought this was a good place to double-check.


1 Answer 1


Keys in Memory

Unfortunately, the OS needs to store the key somewhere in order to encrypt/decrypt data as requested. There are "workarounds" such as TRESOR which stores the key in CPU registers instead of main memory. This comes with some advantages but the underlying attack vector cannot be closed.

Cached Data on Disk

One solution to this is encrypt the whole disk with full disk encryption (FDE).

A more elegant solution is to use a live system which runs entirely in RAM so that such data leaks are unrecoverable after a system shutdown.

  • I was afraid of that, however, keeping track of and managing a live-boot CD is something I wished to avoid. Would a live-boot USB with write protection and a memory based temporary file-system be a viable solution? Or is it possible to reliably write-protect or emulate Live-CD behavior using a USB drive?
    – Mike
    May 15, 2014 at 15:34
  • Yes you can. The ISO images intended to be burned to CDs/DVDs can also be installed on USB flash drives. Many people like to take advantage of being able to write to flash drives and add "persistence" to their live systems which defeats the point from an anti forensics point of view so watch out for guides that offer persistence as a bonus. May 15, 2014 at 15:57
  • So it is possible to make a USB drive that is NON-persistent? Would it be conceivably possible to make a boot-able USB drive that is both fully encrypted and NON-persistent?
    – Mike
    May 15, 2014 at 16:05
  • 1
    This is a popular tool for installing OS ISOs on flash drives. unetbootin.sourceforge.net (Note that persistence is an optional extra which can be specified during the installation). Encrypting it as well is not something many people want. You will probably have to set that up manually. May 15, 2014 at 16:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .