I have a laptop that has Sophos Safeguard full disk encryption on it. I booted the machine into another operating system on a USB stick and attempted to read the disk from the other OS, and I verified that the disk was encrypted and I could not read it. This machine does not have a TPM chip. I do not have to enter a PIN or a passphrase or insert a USB stick when I boot it up - it loads up the operating system seamlessly. Given these facts, where is the encryption key stored and how could it be stored securely?

  • If the software can indeed decrypt the disk without you entering a password or putting in a "dongle", and without network connectivity (as stated in a comment below), it's pretty obvious that the whole system is crap. The software obviously stores the key somewhere on the computer (on disk), presumably in a somewhat obfuscated way -- there is no other way they could decrypt the disk (unless everybody uses the same key...). However, if they can read it, anyone with access to the computer can.
    – Damon
    Commented Dec 10, 2014 at 17:34

1 Answer 1


From what I can find on Sophos website, it looks like the encryption keys and revelant certificates are stored on a mssql database which holds the information.

The SafeGuard Enterprise Database(s) hold all relevant data such as keys/certificates, information about users and computers, events and policy settings. The database(s) need to be accessed by the SafeGuard Enterprise Server and by one security officer only through the SafeGuard Management Center, usually the Master Security Officer. The SafeGuard Enterprise Database(s) can be generated and configured using a wizard or scripts. http://www.sophos.com/en-us/medialibrary/PDFs/documentation/sgn_61_ig_eng_installation.pdf?la=en

enter image description here

  • Thank you for the information. I am sure that the Sophos client does communicate with a policy server over the network from time to time, however, I can still boot up the machine even if it is completely disconnected from the network. Therefore, the key must be stored locally... somewhere. I just don't know where or how. This is why I'm confused.
    – Ryan Ries
    Commented Dec 10, 2014 at 15:12
  • 1
    Why don't you contact Sophos support and ask them ? They are the ones who can help you, really.
    – Stephane
    Commented Dec 10, 2014 at 15:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .