Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Data on external storage devices are not secure, I understand that. Despite hardware modifications they can still be hacked etc. However files can be hidden (steganography) or encrypted.
I'm wondering if there is any way of hiding a collection of files from an OS so they cannot be deleted (at least from an OS GUI).
Rohos creates an encrypted partition, hiding the files from plain sight (still accessible in memory). How does it fool the OS into not identifing this partition?
I haven't used Rohos before, so I can't say exactly how it works. But I've used TrueCrypt before and it should be capable of this (I would test it, except someone has stolen all my bloody flash drives).
TrueCrypt can create an encrypted partition on a drive (such as a flash drive). This partition should appear as complete gibberish to the OS so it should ignore it. Then you can either keep a small amount of space to hold the TrueCrypt program to decrypt and view the encrypted partition. Or you can just encrypt the entire drive and carry or download TrueCrypt separately.
This will likely only hide it from casual view. Using something like gParted, Windows Disk Management tool and whatever OSX has will likely reveal it. But then they would only be able to format the entire area the contents would still be hidden.
Rohos creates an encrypted partition, hiding the files from plain sight (still accessible in memory). How does it fool the OS into not identifing this partition?
I think clarifying ideas might help clear up your question slightly. The hardware and appropriate drivers present the operating system with a block storage device. You might call this "low level" access - the OS can view and modify each block, sector or other compartment of storage if it so wished.
File systems are abstractions on top of this that use the block level storage and provide structures like files and directories, store meta data such as OS-permissions etc.
As such, any file system abstraction or disk format the OS cannot recognise cannot be read. However, that doesn't prevent it from being "taught how" via an appropriate driver, nor does it prevent block level examination of the device. It's possible to wipe data block by block from a device, for example by formatting it with a new file system.
The OS cannot identify the partition because it doesn't recognise the format. However, its existence is usually trivial to identify since the block count vs the size of the visible partitions give it away. Most people don't partition their USB sticks to only use a third of the size.
I'm not sure exactly what they mean by "file virtualisation" - if they're just providing a cryptographic block layer implementation and allowing access via standard file systems (how most disk encryption works) then they cannot control how other utilities process that data. It sounds, however, like they have some form of utility which accesses the encrypted partition. I'm not sure what added security this provides, to be honest, since if the data is passed to any other program it would be relatively trivial to duplicate every byte sent.
I'm wondering if there is any way of hiding a collection of files from an OS so they cannot be deleted (at least from an OS GUI).
Yes, but it depends on whether you're prepared for the OS to be able to identify those files in the first place. Most operating systems have permissions systems capable of doing this. Another option is to modify the OS such that it refuses such deletes. However, if your objective is to remain hidden whilst refusing to allow the OS to delete your content, that's not possible except with some form of hardware enforcement.
The long and the short of this is that storing sensitive information on portable encrypted USB sticks and then using them on untrusted systems is basically not a good idea. You can't remain secure from a compromised OS. Practice safe data handling processes and don't do this.
Most USB flash drives can be configured so that part or all of the drive can appear as a CD-ROM to the operating system. To do this, you need a utility specific to your flash drive chipset. A good website that has many of these tools, albeit in Russian, is http://FlashBoot.ru. Once you have this tool, create an .iso image file containing your data, then transfer it to a new partition on the USB drive. Now, when you plug in the USB drive, the operating system won't be able to delete those files, unless, of course, somebody re-runs the same utility to destroy that CD-ROM partition.
A good tool I've been using to do this is TrueCrypt. It creates a partition on the flash drive where you can install truecrypt, while the other partition is encrypted and inaccessible. I had some trouble setting it up at first but found an easy guide to follow here: http://www.landofjacks.com/forum/viewtopic.php?f=3&t=13 I'm not sure HOW it does it, but it works well and that is what counts in my book.
USB flash drive with a hardware write-protect switch are available , though you'll have to go to some effort to pick one up.
That page also details some software tricks that I don't recommend but might work for non-sophisticated threats.
