Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [disk-encryption]

Disk encryption is a special case of data at rest protection when the storage media is a sector-addressable device (e.g., a hard disk).

0
votes
0answers
32 views

Disk Encryption VS SQL TDE Encryption

I am trying to understand what would be the benefit of using SQL TDE on top of underlying disk encryption. My understanding is that disk encryption will prevent malicious users pulling out the disk ...
0
votes
0answers
23 views

LUKS partition encryption vs. .vmdk level encryption

Because of data classification that is stored on one of our servers we need to make sure that it is protected while in transit and at rest. While the first can be addressed with proper TLS ...
2
votes
1answer
45 views

Windows BitLocker- Is the drive Password the same as the Key used by AES to encrypt the drive?

I am using BitLocker on my Win10. I encryted my usb drive using my Windows BitLocker with a strong password. I know that Bitlocker uses AES-~256 bit key for encryption. My question what is the key ...
0
votes
0answers
36 views

Protect LUKS encrypted HDD against boot sector key stealing attack

I have HDD with GPT, 1 MiB BIOS boot partition and LUKS encrypted volume group with data. When I boot the computer, GRUB asks for passphrase. However, I want to run some untrusted application which ...
1
vote
2answers
173 views

Is it too late to encrypt my already used USB drive?

I've had my USB for quite a while now. It contains quite a lot of personal information on it. (I know, I'm stupid for not encrypting it before hand). Is it too late to encrypt my drive even if files ...
0
votes
1answer
67 views

On a mobile, does using a password instead of a PIN make encryption stronger?

On a mobile, does using a password instead of a PIN make encryption stronger? What key does the phone use for its encryption? Would it use the PIN itself?
1
vote
1answer
121 views

How is it possible that hardware-encrypted flash devices are safe?

I start with the fact that I understand how flash devices (pendrives) can be encrypted with software, for example Bitlocker. Simply, the encryption key is the password given during encryption and ...
1
vote
1answer
92 views

Is suspend-to-ram really a meaningful risk for Full Disk Encryption?

Ubuntu offers full disk encryption relying on luks. An often recurring area of criticism is the fact that Ubuntu disables hibernation by default while suspend-to-ram stores the private keys in the ram ...
1
vote
1answer
138 views

Data deleted after encryption - recoverable?

My device (Android 8.0) is encrypted with the default encryption (no startup password). As far as I know, when I have data on my phone and factory-reset the phone, the data is unrecoverable, since a ...
28
votes
2answers
5k views

How is it possible for user's password to be changed after storage was encrypted? (on OS X, Android)

There are built-in functionalities to encrypt a storage on OS X (FileVault) and Android. On OS X: to enable encryption current user must have a password protected account. After enabling the ...
5
votes
1answer
78 views

Is there a file system allowing read-only access enforced by cryptography

Is there a file system standard (like LUKS) that allows anyone who can plug in the hard drive to read files, but requires a passphrase to modify or write? For example, I can do something similar by ...
0
votes
1answer
54 views

security of cryptsetup(8) luksRemoveKey, feasibility of extracting MasterSecretKey and using it later

I looked at https://crypto.stackexchange.com/a/24024 and it seems to me cryptsetup(8) luksRemoveKey is weak. The situation: I create new LUKS volume, copy stuff into it. I add a new pass phrase, and ...
1
vote
0answers
68 views

Wiping a smartphone/laptop for travel purposes

What is the best way to prepare your laptop and smartphone for travel? I envision having an encrypted back up stored at home; then factory resetting the smartphones/laptops for travel and installing ...
4
votes
1answer
97 views

I use full-disk encryption. Should I passphrase-encrypt my private key(s) anyway?

Suppose I want to use GnuPG on a GNU/Linux laptop where I've encrypted all filesystems (except /boot) with LUKS/dm-crypt. Backups are encrypted client-side and stored on a physically secure server. ...
0
votes
1answer
52 views

How is the DEK in a SED drive encrypted?

I am using a Samsung Evo 960 NVME SSD. I have encrypted the SSD using its built in hardware encryption features, which follow the tcg opal standard. If I understood correctly, the disk encrypts all ...
0
votes
1answer
72 views

BitLocker To Go password strength

When using BitLocker To Go, given that removable drives are inherently offline and may have to resist such attacks, what are the best practices / recommendations for password strength?
2
votes
1answer
131 views

Is there any downside to having a VeraCrypt file container that is almost as big as the drive it's on?

I am setting up an external hard drive to backup several computers to, and I want to keep its contents private by using VeraCrypt. I don't want to encrypt the entire drive because then when it's ...
1
vote
1answer
125 views

Is it possible to LUKS require both password and key file?

My goal is to be able easily destroy medium with key file in emergency situation and make system unbootable, even is potential advisor knows right password for the system. I'd store this key file in ...
0
votes
3answers
72 views

Can encrypted data be safely dispose off by quick formatting?

I have a Windows laptop machine with a traditional hard disk drive and I used it for a year and then I turn on the full disk encryption (Including system and non system partitions) using veracrypt fde....
0
votes
0answers
37 views

Enclosed FDE, Bridge & chipset FDE. what is the difference to SED

I was reading hardware based encryption, and found out that they are basically of 3 types. 1) SED - Encryption/Decryption done by the drive circuitry. Unlocked via Pre boot authentication. Can use ...
0
votes
0answers
37 views

Protecting/Crypting an external storage

We have an camera with sd card in which it records. AFAIK its software, recording parts etc., cannot be stepped in. We wish a mechanism/methodology that whenever it is plugged into usb socket of a ...
2
votes
1answer
73 views

Decrypting possibly compromised Veracrypt hard drive

I have a Veracrypt encrypted hard drive, a system drive encryption with the operating system. The laptop is possibly compromised, which is why I can't decrypt it directly on the laptop I don't know ...
5
votes
2answers
800 views

How does full disk encryption cater for overprovisoned disk space in flash devices and can this result in data leakage?

My understanding is that flash based devices such as SSDs are over-provisioned and do not advertise the additional blocks of storage available to the operating system. The over-provisioned blocks of ...
1
vote
1answer
116 views

When is Veracrypt an acceptable solution?

To manage security risks effectively, a non-profit organization has the following high level requirements; Limit access to authorized staff. Sensitive data is only accessible to authorized staff. ...
1
vote
1answer
101 views

Should hard drives be encrypted prior to an operating system installation?

When employing full disk encryption, should hard drives be encrypted prior or post the installation of an operating system? If the former, is this supported by operating systems such as Microsoft ...
1
vote
1answer
87 views

Does an unencrypted disk pose a risk to other encrypted disk's data?

I have three disks, only two are encrypted: A: OS, encrypted B: Main storage HDD, encrypted C: Gaming only SSD, not encrypted. Should I be worried that C: could cache/store sensitive data from A/B ...
0
votes
1answer
69 views

Backing up an encypted drive on an encrypted drive

I have searched, and have been unable to find an adequate answer to my question. My apologies as I'm sure this is a relatively elementary question for the users here. I have encrypted my Windows 10 ...
0
votes
1answer
235 views

Where is Bitlocker encryption key stored in USB? [closed]

I have a USB that contains the Bitlocker key. When I open USB I dont see any files inside. How can I move the Bitlocker key to another USB?
6
votes
2answers
639 views

How to prevent Windows Update from suspending BitLocker encrytion?

I was quite shocked today to see that a Windows 10 Pro machine that I recently set up with BitLocker (startup PIN + TPM with full disk encryption) suddenly didn't have BitLocker enabled anymore: And ...
0
votes
1answer
43 views

Security/Privacy OS With Boot On Thumbdrive

I am looking for a security-centered Linux OS that allows you to take the /boot partition on a thumb-drive to alleviate concerns of an Evil Maid Attacks! What OS is it easy to remove the /boot ...
4
votes
1answer
162 views

Is forensics possible with FDEs like LUKS or Veracrypt?

Is forensics possible with full disk encrypted drives? I know that because we don't zero-fill our drives when we delete a file or the file system leaves a trace of a file usually forensics like ...
2
votes
1answer
646 views

SSD encryption vulnerability & TPM

I've recently read several articles about this paper: Self-encrypting deception: weaknesses in the encryption of solid state drives (SSDs) by Carlo Meijer and Bernard van Gastel. The thing I haven't ...
1
vote
2answers
534 views

Full disk encryption vs targetted partition encryption for security experts?

There are "Average Joes" answers here for "Full disk encryption vs home folder encryption". I have three use cases in the frame of professional activities with customers wanting their data secured: ...
1
vote
0answers
122 views

Automatic fetch Luks keyfile over ssh and decrypt partition [closed]

I run a small computer with an encrypted data partition. So that I have as little effort as possible to decrypt the hard disk after a reboot (no extra ssh login, password input etc.), I thought about ...
2
votes
1answer
114 views

Two factor authentication and plausible deniability for disk encryption

Can you prove, for the most common disk encryption programs like Veracrypt or LUKS/dmcrypt, that a second factor like a yubikey or a keyfile on a USB disk is required? If this is not the case is there ...
2
votes
0answers
35 views

How does the Shadow MBR improve security for Opal v2 SEDs?

Opal v2 and above drives are required to support multiple locking ranges, so it's possible to block access entirely to the majority of the drive and only have the bootloader w/ PBA support section ...
1
vote
1answer
216 views

System Encryption With Veracrypt/Truecrypt- What is the difference between Wipe Mode “None” and 3 pass, 1 pass etc?

First I wanted to make sure we're talking about using a Non-SSD Hard drive. I know SSD drives work differently. Here would be a good reference/guide on system encryption: https://www.howtogeek.com/...
2
votes
1answer
72 views

Secure erase partition only on SSD, not the whole thing

I have a 512 SSD which is partitioned into essentially two 256 areas. One for Windows, the other for Linux (Ubuntu). Neither is encrypted. I want to clean my system up, but am only concerned about the ...
1
vote
1answer
119 views

Lost password for encrypted external HD

Have an old filevault encrypted external hard drive. Would like to access but have forgotten the password. However I do remember the style of password (XKCD four word style) and remember two of the ...
0
votes
1answer
54 views

Startup PIN security considerations for BitLocker

I plan to implement Bitlocker encryption on my devices, but I wonder how to achieve the highest possible security against offline attacks. I understood the following: I can enable TPM based ...
1
vote
1answer
195 views

Secure way to wipe an entire SSD? [duplicate]

I've read some articles and they appear to suggest the idea of using the dd command to wipe an entire SSD before encrypting it. The drive in question is a Samsung 970 EVO PCIe NVMe V-NAND M.2 2280 ...
0
votes
4answers
541 views

Should I change to VeraCrypt on win7 SSD from TrueCrypt 7.1a? [duplicate]

Is still safe for me to use TrueCrypt or should I change to VeraCrypt as the last update boot won`t take long anymore. Any backdoors to decrypt TrueCrypt?
1
vote
1answer
123 views

Are Self-Encrypting Drives (SEDs) used in cloud environments?

I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS? And if so, what additional protection do they offer beside from physical theft of the ...
-2
votes
1answer
88 views

Will files added to an encrypted drive be encrypted as well? [closed]

If we do disk encryption on a drive and add some files later on, will they be encrypted or not?
2
votes
0answers
85 views

macOS Data Protection without FileVault

I'm running macOS 10.14, and have encountered a problem which prevents me from enabling FileVault. As best as I can determine, there are no free and convenient alternatives for full disk encryption, ...
1
vote
1answer
172 views

How to protect data in case of an unauthorized physical access to a server

I have some VMs on a hypervisor. They run linux with full disk encryption. In case of an unauthorized physical access to a running server, I know that the attacker can extract passcode out of RAM via ...
1
vote
0answers
242 views

Can BitLocker simply be bypassed by just “waiting long enough” till it auto suspends due an update?

When you get an automatic feature or even only cumulative Windows 10 update with an activated BitLocker (password protected) system partition BitLocker will prompt you afterwards from the system tray ...
1
vote
1answer
173 views

Necessary to wipe Encrypted LVM LUKS

Is it necessary to wipe (using shred or similar) the drive or partition again even though it was already encrypted? Threat model for securing the drive is for potentially physically losing the drive ...
0
votes
2answers
98 views

Encrypting my hard drive using bitlocker

I would like to encrypt my C drive using bitLocker which is the only partition on my windows 10 computer. Is it better to separate the disk into partitions, for example: a partition for the OS and ...
0
votes
1answer
66 views

What are `dd` input blocks? [closed]

I'm looking for a semi-technical explanation of "input blocks". When creating encrypted containers we use dd with "count=n", but I'm not sure of the difference between "count=0" and "count=1". The dd ...