Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [disk-encryption]

Disk encryption is a special case of data at rest protection when the storage media is a sector-addressable device (e.g., a hard disk).

0
votes
0answers
36 views

Ubuntu VM with full disk encryption running off NFS share: implications for data security in transit over network?

I am currently experimenting with running a few VMs, and I'd like to consolidate the VM disk images on a NAS. To be clear, that means there would be a single NAS on the network, as well as several ...
2
votes
1answer
117 views

SSD encryption vulnerability & TPM

I've recently read several articles about this paper: Self-encrypting deception: weaknesses in the encryption of solid state drives (SSDs) by Carlo Meijer and Bernard van Gastel. The thing I haven't ...
1
vote
2answers
143 views

Full disk encryption vs targetted partition encryption for security experts?

There are "Average Joes" answers here for "Full disk encryption vs home folder encryption". I have three use cases in the frame of professional activities with customers wanting their data secured: ...
1
vote
0answers
28 views

Automatic fetch Luks keyfile over ssh and decrypt partition [closed]

I run a small computer with an encrypted data partition. So that I have as little effort as possible to decrypt the hard disk after a reboot (no extra ssh login, password input etc.), I thought about ...
1
vote
0answers
53 views

Two factor authentication and plausible deniability for disk encryption

Can you prove, for the most common disk encryption programs like Veracrypt or LUKS/dmcrypt, that a second factor like a yubikey or a keyfile on a USB disk is required? If this is not the case is there ...
2
votes
0answers
15 views

How does the Shadow MBR improve security for Opal v2 SEDs?

Opal v2 and above drives are required to support multiple locking ranges, so it's possible to block access entirely to the majority of the drive and only have the bootloader w/ PBA support section ...
1
vote
1answer
82 views

System Encryption With Veracrypt/Truecrypt- What is the difference between Wipe Mode “None” and 3 pass, 1 pass etc?

First I wanted to make sure we're talking about using a Non-SSD Hard drive. I know SSD drives work differently. Here would be a good reference/guide on system encryption: https://www.howtogeek.com/...
2
votes
1answer
62 views

Secure erase partition only on SSD, not the whole thing

I have a 512 SSD which is partitioned into essentially two 256 areas. One for Windows, the other for Linux (Ubuntu). Neither is encrypted. I want to clean my system up, but am only concerned about the ...
1
vote
1answer
114 views

Lost password for encrypted external HD

Have an old filevault encrypted external hard drive. Would like to access but have forgotten the password. However I do remember the style of password (XKCD four word style) and remember two of the ...
0
votes
0answers
46 views

Does using a 256 bit BitLocker key give you closer integration with hardware?

Reading TrueCrypt vs BitLocker I found the following line in the answer of user71148: Switch to 256-bit BEFORE encrypting your hard drive. Once you do that, BitLocker is safer for boot partition ...
0
votes
1answer
32 views

Startup PIN security considerations for BitLocker

I plan to implement Bitlocker encryption on my devices, but I wonder how to achieve the highest possible security against offline attacks. I understood the following: I can enable TPM based ...
1
vote
1answer
139 views

Secure way to wipe an entire SSD? [duplicate]

I've read some articles and they appear to suggest the idea of using the dd command to wipe an entire SSD before encrypting it. The drive in question is a Samsung 970 EVO PCIe NVMe V-NAND M.2 2280 ...
0
votes
4answers
131 views

Should I change to VeraCrypt on win7 SSD from TrueCrypt 7.1a? [duplicate]

Is still safe for me to use TrueCrypt or should I change to VeraCrypt as the last update boot won`t take long anymore. Any backdoors to decrypt TrueCrypt?
1
vote
1answer
67 views

Are Self-Encrypting Drives (SEDs) used in cloud environments?

I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS? And if so, what additional protection do they offer beside from physical theft of the ...
-2
votes
1answer
82 views

Will files added to an encrypted drive be encrypted as well? [closed]

If we do disk encryption on a drive and add some files later on, will they be encrypted or not?
2
votes
0answers
52 views

macOS Data Protection without FileVault

I'm running macOS 10.14, and have encountered a problem which prevents me from enabling FileVault. As best as I can determine, there are no free and convenient alternatives for full disk encryption, ...
1
vote
1answer
65 views

How to protect data in case of an unauthorized physical access to a server

I have some VMs on a hypervisor. They run linux with full disk encryption. In case of an unauthorized physical access to a running server, I know that the attacker can extract passcode out of RAM via ...
0
votes
0answers
53 views

Can BitLocker simply be bypassed by just “waiting long enough” till it auto suspends due an update?

When you get an automatic feature or even only cumulative Windows 10 update with an activated BitLocker (password protected) system partition BitLocker will prompt you afterwards from the system tray ...
1
vote
1answer
64 views

Necessary to wipe Encrypted LVM LUKS

Is it necessary to wipe (using shred or similar) the drive or partition again even though it was already encrypted? Threat model for securing the drive is for potentially physically losing the drive ...
0
votes
2answers
86 views

Encrypting my hard drive using bitlocker

I would like to encrypt my C drive using bitLocker which is the only partition on my windows 10 computer. Is it better to separate the disk into partitions, for example: a partition for the OS and ...
0
votes
1answer
60 views

What are `dd` input blocks? [closed]

I'm looking for a semi-technical explanation of "input blocks". When creating encrypted containers we use dd with "count=n", but I'm not sure of the difference between "count=0" and "count=1". The dd ...
0
votes
0answers
53 views

Full-disk encryption solution for Samsung SSD 850 Pro [duplicate]

All, I've just joined this community and I'm writing here in order to have some clarification about the possibilities to perform a full disk encryption over a desktop machine with Windows 7 ...
1
vote
1answer
526 views

What is the relationship between Windows BitLocker and Hasleo BitLocker Anywhere?

Whilst researching alternatives to BitLocker which work on Windows 10 Home, I came across a product called "BitLocker Anywhere" from Hasleo. Since they use such similar names I was trying to figure ...
2
votes
1answer
101 views

Is a TPM which boots a full-disk-encrypted computer to login secure?

Currently the laptops in use are encrypted using Pre-Boot-Authentication, so the entire disk is encrypted. A user has to enter a password before booting the operating system. A new concept suggests ...
2
votes
1answer
224 views

What is the safest way to use Bitlocker with TPM?

I started using bitlocker yesterday and I have a TPM2.0 in my laptop. I enabled the option to enter a pin when starting and I enabled the option to use AES256 before encrypting. I don't really ...
1
vote
1answer
190 views

How does SSD with SED encrypt and decrypt data?

When you enter data and you want to save a file, the SED encrypts the data but where does the encryption process occur to be exact? Does SED encrypt data in memory before it gets to the disk? Or do ...
2
votes
7answers
885 views

Should I encrypt my entire hard drive, or only a partition?

I have an HP Pavilion notebook which has a 1TB hard drive. I run Windows 10 on it. If instead of fully encrypting the hard drive or encrypting the partition on which Windows is installed, I just ...
0
votes
0answers
130 views

Encryption on an LXC container?

I have the following scenario. I'm hosting some services on a VPS. Each service is running inside an LXC container. Some services like email contain information that I would like to be stored ...
3
votes
3answers
153 views

Using a windows partition as a decoy

I'm interested in setting up a laptop that dual boots Windows 7 and openSUSE. The plan is to encrypt the openSUSE partition and require a USB thumb drive with the encryption key for it to boot. Where ...
7
votes
1answer
308 views

Brute forcing encryption password (self destruct after 4 attempts)

My colleague at work lost the password to his external hard drive (HDD not SSD), a WD Elements. He remembers that his password was simple and 8 characters maximum. The problem is the encryption ...
2
votes
1answer
305 views

Plausible deniability with VeraCrypt standard volumes: what information do they give away?

I know VeraCrypt hidden volumes can be used for plausible deniability, but what about standard volumes? Indeed, properly encrypted data should be indistinguishable from random data. This way, if a ...
2
votes
2answers
54 views

Is corrupting the ciphertext corruption a good erasure?

Normally when you wipe a drive there are still ghost remains of the data even after overwriting the disk multiple times. So I was wondering if you could encrypt the drive and then overwrite the ...
4
votes
1answer
250 views

Bruteforce FileVault Encryption?

I've been getting into forensics and penetration testing lately and hoping someone can explain what the below data is and how it might be used to perform a bruteforce (hashcat) attacks against ...
-1
votes
3answers
123 views

Is it possible to reset the password of an encrypted disk?

I have encrypted my linux partitions. I would know if there's practically a method for overwrite the de-encryption password requested at boot, mounting the hard disk on another pc. EDIT I'm asking ...
42
votes
3answers
13k views

How can Android encryption be so fast?

Android uses full-disk encryption to encrypt files and decrypt them at startup. What I don't understand is that decrypting multiple gigabytes of files must take a lot of time, if nothing else then ...
2
votes
1answer
70 views

recommendation to change encrypted-drive passphrases

There are numerous recommendations for how frequently to change users' passphrases, and I think the most recent NIST recommendation is "no minimum time to change passwords" (I might be mis-quoting). ...
4
votes
3answers
1k views

Full disk encryption vs home folder encryption - why should the former be chosen over the latter

Niebezpiecznik.pl, a popular and acclaimed infosec blog in my country, recommends full disk encryption (emphasis original) to all people (ie. "Average Joes"). They warn that in the opposite scenario ...
7
votes
1answer
116 views

Automatically Open LUKS Container on System Boot in a safe manner

I have a linux system running at a cloud provider where I created an encrypted container using LUKS to store personal data. The encrypted container is manually mounted at /srv; the rest of the ...
0
votes
2answers
130 views

encryption - how to secure files - decrypting exposes them on ssd

Let's say I have an encrypted file. Now I decrypt it but since my computer only has ssd, i decrypt it on the ssd drive. Say, I make changes or I finish using the decrypted file so I encrypt it again. ...
0
votes
1answer
167 views

Does WD My Passport WDBYFT0040BBK-WESN have encryption vulnerability?

Recently I came across this whitepaper: https://eprint.iacr.org/2015/1002.pdf It states vulnerabilities in Western Digital hard drives but doesn't include exact model numbers. I have WD My Passport ...
2
votes
2answers
651 views

Security and Veracrypt [closed]

I have a few questions about Security and Veracrypt and hope you can clarify it for me. I don't want the VeraCrypt hidden volume I created to be damaged. If I mount the hidden volume and transfer ...
0
votes
1answer
262 views

best way to encrypt code and data on IOT device?

I have R scripts which are running on a Raspberry Pi device. I want to encrypt the code and data on the device so that if anyone unmounts the disk and try to read the content via other devices they ...
3
votes
2answers
298 views

What are BitLocker requirements against computer theft?

I'm using Windows 10 Pro edition and took the following actions: I've set up Bitlocker on both disks using the TPM (2.0) to boot the computer. I've also set a Windows password and I have no guest ...
1
vote
2answers
97 views

Is it viable to encrypt a 'bitlocked' drive again? [duplicate]

If one had an encrypted drive using Bitlocker, is it worth it to encrypt that drive again using another tool like VeraCrypt? Does this provide an extra layer of protection? Not a duplicate of a ...
0
votes
0answers
101 views

How does Bitlocker encrypt a drive while it is being used?

By this I mean performing file transfers, downloads etc., I haven't read anywhere of this having an effect on how Bitlocker encrypts the drive. Also, how does Bitlocker handle the constant amount of ...
3
votes
1answer
2k views

VeraCrypt PIM feature - Is it really necessary?

I am looking to encrypt my OS hard drive, and VeraCrypt caught my eye as a real good option. I tried to encrypt my drive with it, and the resulting encrypted system, takes around a minute to decrypt. ...
1
vote
0answers
23 views

Can files be retrieved from a VM instance state that was initially encrypted on a disk?

If I were to make a VM disk that was encrypetd, boot it, enter the encrypted passphrase and save the resulting 'image state' (of the running VM). Would this image have the 'encrypted' files easily ...
3
votes
1answer
61 views

How protected are files within a running encrypted VM on a possibly non secure hypervisor / host?

I've got a set of source code files (compiled C#) that I want to prevent direct read access to. The program will be running on the VM. I was thinking of storing these in an encrypted hard disk VM, the ...
2
votes
1answer
350 views

How can a user defeat anti-live forensics software?

Let's say I have a computer with full disk encryption which is logged and running, but I suspect it has anti-forensics software (eg. usbkill), which means that I risk compromising the integrity of the ...
4
votes
1answer
803 views

Android FDE - Why is key stored in RAM at all?

As far as I understand, the device's /data partition remains decrypted once an encrypted devices has been unlocked during boot up. Why does Android have to keep encryption keys within RAM if no "live" ...