Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [disk-encryption]

Disk encryption is a special case of data at rest protection when the storage media is a sector-addressable device (e.g., a hard disk).

Filter by
Sorted by
Tagged with
0 votes
1 answer
83 views

How does iOS / Android device encryption work?

As far as I'm aware, a locked iOS is considered very safe. No one, who does not know the PIN cannot unlock the phone. While the PIN seems weak on the first glance (4 digits?) it is actually strong, ...
gaazkam's user avatar
  • 6,027
0 votes
1 answer
81 views

SSH-Agent writing unencrypted keys to swap memory

I have recently set up a computer with full disk encryption, and I decided not to encrypt the swap partition for performance reasons. I have been using ssh-agent on another computer to load my private ...
rcomeau's user avatar
0 votes
0 answers
92 views

How does a pattern or a PIN secure an Android device with encryption?

Modern Android devices have encryption for the storage. It is secured with a key which is derived from the lock screen and a hardware bound key. We know that the rate limiting mechanism prevents brute ...
Michael Tsang's user avatar
0 votes
0 answers
63 views

Protect the content of External Disk/USB Storage

Due to certain circumstances, we are forced to keep some copyrighted data in an external hard disk. due to privacy concerns, we want to allow this data to be accessed only from a trusted/office ...
John's user avatar
  • 1
0 votes
2 answers
115 views

Isolating encrypted and unecnrypted Windows installations and protecting the boot loader

I want to use my PC both for gaming and for stuff like keeping cryptocurrency wallets, online banking, etc. I need to install games as admin but of course I don't want them to be able to access my ...
Vlad's user avatar
  • 101
0 votes
0 answers
93 views

If I hibernate my Linux distro (which has an encrypted partition) and store it in a unencrypted swap partition, can an attacker access all my data?

Is it possible? How? Should I encrypt my swap partition? If I don't encrypt it, basically I make encryption in the main partition useless.
Allexj's user avatar
  • 137
2 votes
2 answers
195 views

Full disk-encryption key vs password

I need to set up full disk encryption on my linux laptop. Questions: Does an encryption key on a USB pendrive protect against rubber-hose cryptanalysis? Is it true that the key on a pendrive is ...
whiteman808's user avatar
1 vote
0 answers
357 views

Do I retain plausible deniability if using "quick format" in veracrypt on new SSD?

I bought a new 2 TB SSD (NVMe). I want to turn it entirely into a veracrypt volume, nearly all of the drive being for a hidden volume. First, I told it to do a "quick format", which was done ...
Make42's user avatar
  • 111
2 votes
2 answers
549 views

LUKS: How many iterations are enough?

The luksFormat command accepts iteration time as a parameter, not iterations. That obviously leads to quite different number of iterations depending on the hardware doing the encryption. However if ...
graywolf's user avatar
  • 425
0 votes
0 answers
119 views

Choosing Encryption Strategies for Secure Long-Term Storage of Sensitive Data

When considering external drives for secure long-term storage of sensitive data, what are the pros and cons of using the same password for encrypting all files versus using random passwords for each ...
S. G.'s user avatar
  • 173
0 votes
0 answers
128 views

PCR to prevent TPM2 key unsealing in case of rogue DMA devices connected?

Security threat: physical theft of a laptop and a server that use TPM2 auto unlock FDE with LUKS. In both cases the TPM checks against some PCRs before unsealing the key. The laptop prompts for a TPM ...
Polizi8's user avatar
  • 163
0 votes
0 answers
82 views

Is specifying resume_offset for hybernation to LUKS-encrypted drive safe?

I need to enable hybernation to the LUKS-encrypted drive. My /boot partition is unencrypted hence it stores all kernel images as well as kernel parameters in unencrypted form. For hybernation to work ...
CurtisB's user avatar
  • 33
1 vote
1 answer
256 views

What are the risks of reusing the same passphrase for FDE, user account, and password manager?

Consider a home user who runs Linux on a laptop with full-disk encryption and uses a cloud-based password manager. Assume the laptop is firewall-protected with no SSH access. It seems reasonable to ...
jth's user avatar
  • 123
0 votes
0 answers
193 views

Advice on encryption setup

I've been trying to get a reliable, and decently secure setup on a device for a little while now, and I feel like I may be overthinking some things but I am unsure. Just to clear things up, this is ...
Kalcifer's user avatar
  • 173
0 votes
1 answer
223 views

Does faulTPM defeat the LUKS-based FDE with a passphrase?

The recent faulTPM paper (https://arxiv.org/pdf/2304.14717v1.pdf) deals mostly with Bitlocker and only mentions LUKS to note the differences. The authors state: With a passphrase, however, the same ...
Leprechaun's user avatar
1 vote
2 answers
473 views

Full disk encryption with LUKS?

I encrypted my Ubuntu Desktop 20.04.3 with LVM/LUKS during the installation process. If I turn off the computer, is the brute force the only attack available for getting the password and accessing the ...
Chris Garcia's user avatar
1 vote
1 answer
254 views

How to protect files in use on a system powered on from physical theft or tampering?

I'm in the process of figuring out an encryption strategy for a personal Linux system. My laptop is almost always on, or in sleep mode, except for longer travels. My main threats are theft of my ...
CryptGuest's user avatar
1 vote
1 answer
131 views

AEAD: Authenticating a digest of my data instead the data itself

Relevant question for Python: Stack Exchange: https://stackoverflow.com/questions/75739308/aead-authentication-with-huge-input-that-doesnt-fit-into-ram Top Answers: https://topanswers.xyz/python?q=...
user2373145's user avatar
1 vote
2 answers
2k views

Full disk encryption: Legacy boot mode (MBR) vs. EFI boot mode

FDE tools like VeraCrypt will encrypt the whole system drive when the machine uses legacy boot mode (MBR). But they will only encrypt the system partition if the machine uses EFI boot mode (the EFI ...
stackprotector's user avatar
1 vote
3 answers
545 views

Understanding FDE: Is the encrypted Linux protected against a compromised boot volume?

I use this initramfs-based FDE on my headless server. My motivation is to secure my system against physical tampering. I am aware that securing an untrusted hardware is not possible. This question is ...
pico_prob's user avatar
  • 113
15 votes
2 answers
8k views

Erased encrypted HDD, then secure erased 10% of it before selling it - is it safe?

I have a 4TB mechanical hard drive that was encrypted before I ever wrote any file on it. I used a 25 character password with symbols. Before I sold it, I unmounted the disk while it was still ...
alexx0186's user avatar
  • 321
1 vote
3 answers
356 views

Are there ways to detect plain dm-crypt encryption and what are the countermeasures against them?

Encryption with plain dm-crypt is often positioned as encryption that cannot be recognized. But is it really so? Are there ways to prove that the data is encrypted with plain dm-crypt? How to bypass ...
gin's user avatar
  • 11
1 vote
1 answer
270 views

How to make a virtual machine forensics-proof - completely or to the maximum possible level?

I want to make a VMWare (VMWare is first preference but any alternative can be used as well) virtual machine completely digital forensics-proof. I am protecting against someone getting physical access ...
Shy's user avatar
  • 121
0 votes
0 answers
193 views

Self-encrypting drive - eDrive vs ATA Security

Let's for a moment forget about the possible drawbacks of SEDs themselves. One of the upsides of SEDs is that the encryption key never leaves the drive but wouldn't using eDrive negate this advantage ...
Brickwall's user avatar
1 vote
1 answer
350 views

Is it sufficient to put /var, /tmp/, and /home on their own encrypted partitions?

I want to encrypt my system, but I don't want the hassle of having to put in two passwords on boot; I just want to put in one password on login that would decrypt the other partitions. I have heard ...
Kalcifer's user avatar
  • 173
0 votes
1 answer
2k views

NAS newbie: how to ensure that network storage is encrypted at rest (and ideally in transit and in use) for Windows, Linux, Mac

I'm looking to buy an ~8TB NAS* for my home office (I guess it's called a "private cloud"). I want to connect to it from Windows, Linux, Mac, Android, and iOS. How can I ensure that the ...
Ryan's user avatar
  • 325
1 vote
0 answers
504 views

Suspicious SSD corruption exactly at LUKS encryption header

I am helping with an interesting data recovery issue. The laptop was running Debian 11 Linux with LUKS full disk encryption on a Samsung 970 Evo Plus 2TB SSD for quite many months. Suddenly the LUKS ...
stackrunner's user avatar
0 votes
0 answers
39 views

Is it possible to hack encrypted external HDD,if you have access to it? [duplicate]

If I lose my external HDD and somebody finds it and tries to hack, will he succeed?Is it possible to get data from encrypted disk by disassembling it and working with platters? HDD is APFS AES 256 ...
alexandergill's user avatar
1 vote
1 answer
892 views

Is it safe to store data on APFS 256 AES encrypted external HDD disk?

I'm using a MacBook and want to store confidential data (financial documents, passwords, private photos, etc.) on an external HDD disk. How safe is setting up APFS AES 256 encryption with disk ...
alexandergill's user avatar
0 votes
1 answer
129 views

Does an SSD store software-encrypted data in unencrypted form somewhere?

I use LUKS encryption on my entire drive. Do SSD drives ship with any storage areas which store unencrypted data, even though the data is saved encrypted on user-available SSD storage? Maybe inside ...
CurtisB's user avatar
  • 33
1 vote
0 answers
221 views

How hard is it to modify UEFI nvram if the device is off and the UEFI is locked?

This assumes that: Machine is powered off No UEFI backdoors No Reflashing the firmware No clearing the NVRAM (The point is to modify/read a small amount of NVRAM, instead of resetting it) Device ...
A-random-nerd's user avatar
0 votes
1 answer
2k views

NVMe Self Encrypting Drive - How to use ATA Security?

I own a Samsung 980 Pro which, according to its own specification, supports Class 0, TCG/Opal 2.0 and IEEE16667. Since it's an NVMe drive, I cannot use hdparm in order to set up class 0 encryption but ...
Brickwall's user avatar
0 votes
0 answers
171 views

SED specification for USB sticks?

As I got from my preliminary research, there is an established standard TCG Opal 2.0 which defines in specification the principles of SED encryption thus enabling the interoperability between vendors. ...
Suncatcher's user avatar
1 vote
0 answers
37 views

Full disk encryption and data recovery capabilities [duplicate]

So I had linux mint with fde, had sensitive files on it, shut down my pc, and reinstalled a new linux mint OS with fde. What are the chances of data recovery from the first OS?
Gateejunle's user avatar
1 vote
1 answer
122 views

Flashdrive data confidentiality when disconnecting flashdrive from machine abruptly

Assuming I boot up a fully encrypted OS from a portable flash drive and do some tasks in this running OS; then abruptly disconnect this flash drive from my computer and a malicious actor gets their ...
saferugdev's user avatar
2 votes
1 answer
492 views

Military-grade encryption on Blu-ray discs?

Another thread addresses the question of what can count as "military-grade encryption." In this case, I see that CyberLink Power2Go software boasts "advanced military-grade 256-bit ...
Ray Woodcock's user avatar
1 vote
2 answers
761 views

How does bitlocker work when unlocking a removable drive on another PC using a password?

Here's the scenario: I have an external harddrive encrypted with bitlocker. I disconnect that drive from the PC that encrypted it, and connect it to a different PC. Surprisingly, when I do this, all ...
Drew's user avatar
  • 135
0 votes
3 answers
1k views

How difficult is it to decrypt a disk encrypted with luksOpen?

I have encrypted a disk on my Ubuntu machine using sudo cryptsetup luksOpen /dev/sdb1 sdb1 I'm wondering how difficult is it to decrypt this disk using bruteforce password guessing? What does the ...
blnks's user avatar
  • 383
0 votes
1 answer
79 views

Saving signed file on an encrypted drive using symmetric encryption

When using asymmetric encryption, signing and encryption are the same, but opposite, operations. Say I have my drive encrypted with asymmetric encryption. If I save a signed file to that drive, using ...
Jonathan's user avatar
0 votes
1 answer
1k views

Using Yubico YubiKey 5 NFC for local data encryption

I'm interested in buying a Yubikey but want to know if you can use a Yubikey to generate a symmetric key for file encryption on selected files on a PC. Or if you need some sort of extension like HMAC-...
romes's user avatar
  • 3
0 votes
1 answer
2k views

Does full disk encryption securely remove data?

I was just catching up on best practices for securely erasing data from a Mac. At one point I remember reading: For SSD drives it is no longer recommended to fully write ones/zeroes/random bits on the ...
Dennis Jaheruddin's user avatar
3 votes
0 answers
3k views

When using VirtualBox, is it better to use the VirtualBox encryption or the OS disk encryption?

VirtualBox has an option to encrypt the drive of a VM. When I installed Debian or Ubuntu, I have the option to say that I want the full disk encrypted. I'm thinking that both do pretty much the same ...
Alexis Wilke's user avatar
  • 1,017
1 vote
4 answers
1k views

Can TPM2 disk encryption protect data after full server theft?

I read about TPM2 with PCR locking full-disk encryption from different sources. For example [1]. What I can't understand is how much does this protect from full server theft. If we assume that TPM2 ...
akostadinov's user avatar
1 vote
0 answers
176 views

Cold boot attack on NAS

I'm familiar with the concept of cold boot attacks on laptop and desktop computers, where the goal is to find hidden encryption keys in the memory. I also think it's done on certain mobile phones. I ...
laddmeister's user avatar
1 vote
1 answer
267 views

How exactly does Windows Bitlocker work?

I wonder how Windows Bitlocker and other similar software works. I know they differ in terms of security level as some software does not fully encrypt locked files, but I'm speaking of unauthorized ...
Someone's user avatar
  • 113
1 vote
1 answer
643 views

What are the pros and cons of encryption software from the hard disk manufacturer?

I usually use Veracrypt (and in the past Truecrypt) to secure my external hard drive. I've always been taught to stick to such open-source software for my disk encryption needs, since it can be ...
ieatpizza's user avatar
  • 203
1 vote
1 answer
236 views

Does Re-Encryption make our data more secure?

We are focusing on mobile phone and hard drive encryptions. This idea can be extended to any data encryption also. iPhone and recent Androids are all encrypted. We know that changing the password will ...
midnite's user avatar
  • 111
12 votes
4 answers
8k views

Is looking for plain text strings on an encrypted disk a good test?

I have a dual boot PC, where the Win10 (uncompressed) partition is encrypted with BitLocker. I was curious about making this test (and also encryption took quite a short time in my opinion), so while ...
golimar's user avatar
  • 239
0 votes
1 answer
155 views

Why would FDE miss slack space, swap files and memory?

I'm reviewing a ISO27001 Gap Analysis workbook and under Control A.11.2.7 someone has left the note: If full disk encryption (FDE) is used on a device is there a policy in place to ensure the ...
L23P's user avatar
  • 103
4 votes
2 answers
976 views

How does Windows password protect my data?

As far as I know, Windows computers are not encrypted by default in case you are not signed into a Microsoft Account. Considering the aforementioned fact I cannot understand the purpose of the login ...
Allan VanDaalen's user avatar

1
2 3 4 5
13