Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [disk-encryption]

Disk encryption is a special case of data at rest protection when the storage media is a sector-addressable device (e.g., a hard disk).

5
votes
2answers
729 views

How does full disk encryption cater for overprovisoned disk space in flash devices and can this result in data leakage?

My understanding is that flash based devices such as SSDs are over-provisioned and do not advertise the additional blocks of storage available to the operating system. The over-provisioned blocks of ...
1
vote
1answer
38 views

When is Veracrypt an acceptable solution?

To manage security risks effectively, a non-profit organization has the following high level requirements; Limit access to authorized staff. Sensitive data is only accessible to authorized staff. ...
1
vote
1answer
84 views

Should hard drives be encrypted prior to an operating system installation?

When employing full disk encryption, should hard drives be encrypted prior or post the installation of an operating system? If the former, is this supported by operating systems such as Microsoft ...
1
vote
1answer
78 views

Does an unencrypted disk pose a risk to other encrypted disk's data?

I have three disks, only two are encrypted: A: OS, encrypted B: Main storage HDD, encrypted C: Gaming only SSD, not encrypted. Should I be worried that C: could cache/store sensitive data from A/B ...
0
votes
1answer
58 views

Backing up an encypted drive on an encrypted drive

I have searched, and have been unable to find an adequate answer to my question. My apologies as I'm sure this is a relatively elementary question for the users here. I have encrypted my Windows 10 ...
0
votes
1answer
82 views

Where is Bitlocker encryption key stored in USB? [closed]

I have a USB that contains the Bitlocker key. When I open USB I dont see any files inside. How can I move the Bitlocker key to another USB?
6
votes
2answers
133 views

How to prevent Windows Update from suspending BitLocker encrytion?

I was quite shocked today to see that a Windows 10 Pro machine that I recently set up with BitLocker (startup PIN + TPM with full disk encryption) suddenly didn't have BitLocker enabled anymore: And ...
0
votes
1answer
32 views

Security/Privacy OS With Boot On Thumbdrive

I am looking for a security-centered Linux OS that allows you to take the /boot partition on a thumb-drive to alleviate concerns of an Evil Maid Attacks! What OS is it easy to remove the /boot ...
4
votes
1answer
106 views

Is forensics possible with FDEs like LUKS or Veracrypt?

Is forensics possible with full disk encrypted drives? I know that because we don't zero-fill our drives when we delete a file or the file system leaves a trace of a file usually forensics like ...
2
votes
1answer
291 views

SSD encryption vulnerability & TPM

I've recently read several articles about this paper: Self-encrypting deception: weaknesses in the encryption of solid state drives (SSDs) by Carlo Meijer and Bernard van Gastel. The thing I haven't ...
1
vote
2answers
198 views

Full disk encryption vs targetted partition encryption for security experts?

There are "Average Joes" answers here for "Full disk encryption vs home folder encryption". I have three use cases in the frame of professional activities with customers wanting their data secured: ...
1
vote
0answers
31 views

Automatic fetch Luks keyfile over ssh and decrypt partition [closed]

I run a small computer with an encrypted data partition. So that I have as little effort as possible to decrypt the hard disk after a reboot (no extra ssh login, password input etc.), I thought about ...
1
vote
0answers
60 views

Two factor authentication and plausible deniability for disk encryption

Can you prove, for the most common disk encryption programs like Veracrypt or LUKS/dmcrypt, that a second factor like a yubikey or a keyfile on a USB disk is required? If this is not the case is there ...
2
votes
0answers
18 views

How does the Shadow MBR improve security for Opal v2 SEDs?

Opal v2 and above drives are required to support multiple locking ranges, so it's possible to block access entirely to the majority of the drive and only have the bootloader w/ PBA support section ...
1
vote
1answer
135 views

System Encryption With Veracrypt/Truecrypt- What is the difference between Wipe Mode “None” and 3 pass, 1 pass etc?

First I wanted to make sure we're talking about using a Non-SSD Hard drive. I know SSD drives work differently. Here would be a good reference/guide on system encryption: https://www.howtogeek.com/...
2
votes
1answer
65 views

Secure erase partition only on SSD, not the whole thing

I have a 512 SSD which is partitioned into essentially two 256 areas. One for Windows, the other for Linux (Ubuntu). Neither is encrypted. I want to clean my system up, but am only concerned about the ...
1
vote
1answer
117 views

Lost password for encrypted external HD

Have an old filevault encrypted external hard drive. Would like to access but have forgotten the password. However I do remember the style of password (XKCD four word style) and remember two of the ...
0
votes
1answer
40 views

Startup PIN security considerations for BitLocker

I plan to implement Bitlocker encryption on my devices, but I wonder how to achieve the highest possible security against offline attacks. I understood the following: I can enable TPM based ...
1
vote
1answer
152 views

Secure way to wipe an entire SSD? [duplicate]

I've read some articles and they appear to suggest the idea of using the dd command to wipe an entire SSD before encrypting it. The drive in question is a Samsung 970 EVO PCIe NVMe V-NAND M.2 2280 ...
0
votes
4answers
272 views

Should I change to VeraCrypt on win7 SSD from TrueCrypt 7.1a? [duplicate]

Is still safe for me to use TrueCrypt or should I change to VeraCrypt as the last update boot won`t take long anymore. Any backdoors to decrypt TrueCrypt?
1
vote
1answer
102 views

Are Self-Encrypting Drives (SEDs) used in cloud environments?

I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS? And if so, what additional protection do they offer beside from physical theft of the ...
-2
votes
1answer
85 views

Will files added to an encrypted drive be encrypted as well? [closed]

If we do disk encryption on a drive and add some files later on, will they be encrypted or not?
2
votes
0answers
63 views

macOS Data Protection without FileVault

I'm running macOS 10.14, and have encountered a problem which prevents me from enabling FileVault. As best as I can determine, there are no free and convenient alternatives for full disk encryption, ...
1
vote
1answer
157 views

How to protect data in case of an unauthorized physical access to a server

I have some VMs on a hypervisor. They run linux with full disk encryption. In case of an unauthorized physical access to a running server, I know that the attacker can extract passcode out of RAM via ...
1
vote
0answers
90 views

Can BitLocker simply be bypassed by just “waiting long enough” till it auto suspends due an update?

When you get an automatic feature or even only cumulative Windows 10 update with an activated BitLocker (password protected) system partition BitLocker will prompt you afterwards from the system tray ...
1
vote
1answer
90 views

Necessary to wipe Encrypted LVM LUKS

Is it necessary to wipe (using shred or similar) the drive or partition again even though it was already encrypted? Threat model for securing the drive is for potentially physically losing the drive ...
0
votes
2answers
91 views

Encrypting my hard drive using bitlocker

I would like to encrypt my C drive using bitLocker which is the only partition on my windows 10 computer. Is it better to separate the disk into partitions, for example: a partition for the OS and ...
0
votes
1answer
64 views

What are `dd` input blocks? [closed]

I'm looking for a semi-technical explanation of "input blocks". When creating encrypted containers we use dd with "count=n", but I'm not sure of the difference between "count=0" and "count=1". The dd ...
0
votes
0answers
57 views

Full-disk encryption solution for Samsung SSD 850 Pro [duplicate]

All, I've just joined this community and I'm writing here in order to have some clarification about the possibilities to perform a full disk encryption over a desktop machine with Windows 7 ...
2
votes
1answer
816 views

What is the relationship between Windows BitLocker and Hasleo BitLocker Anywhere?

Whilst researching alternatives to BitLocker which work on Windows 10 Home, I came across a product called "BitLocker Anywhere" from Hasleo. Since they use such similar names I was trying to figure ...
2
votes
1answer
121 views

Is a TPM which boots a full-disk-encrypted computer to login secure?

Currently the laptops in use are encrypted using Pre-Boot-Authentication, so the entire disk is encrypted. A user has to enter a password before booting the operating system. A new concept suggests ...
2
votes
1answer
353 views

What is the safest way to use Bitlocker with TPM?

I started using bitlocker yesterday and I have a TPM2.0 in my laptop. I enabled the option to enter a pin when starting and I enabled the option to use AES256 before encrypting. I don't really ...
1
vote
1answer
581 views

How does SSD with SED encrypt and decrypt data?

When you enter data and you want to save a file, the SED encrypts the data but where does the encryption process occur to be exact? Does SED encrypt data in memory before it gets to the disk? Or do ...
3
votes
7answers
2k views

Should I encrypt my entire hard drive, or only a partition?

I have an HP Pavilion notebook which has a 1TB hard drive. I run Windows 10 on it. If instead of fully encrypting the hard drive or encrypting the partition on which Windows is installed, I just ...
0
votes
0answers
163 views

Encryption on an LXC container?

I have the following scenario. I'm hosting some services on a VPS. Each service is running inside an LXC container. Some services like email contain information that I would like to be stored ...
3
votes
3answers
159 views

Using a windows partition as a decoy

I'm interested in setting up a laptop that dual boots Windows 7 and openSUSE. The plan is to encrypt the openSUSE partition and require a USB thumb drive with the encryption key for it to boot. Where ...
7
votes
1answer
352 views

Brute forcing encryption password (self destruct after 4 attempts)

My colleague at work lost the password to his external hard drive (HDD not SSD), a WD Elements. He remembers that his password was simple and 8 characters maximum. The problem is the encryption ...
5
votes
1answer
866 views

Plausible deniability with VeraCrypt standard volumes: what information do they give away?

I know VeraCrypt hidden volumes can be used for plausible deniability, but what about standard volumes? Indeed, properly encrypted data should be indistinguishable from random data. This way, if a ...
2
votes
2answers
58 views

Is corrupting the ciphertext corruption a good erasure?

Normally when you wipe a drive there are still ghost remains of the data even after overwriting the disk multiple times. So I was wondering if you could encrypt the drive and then overwrite the ...
4
votes
1answer
312 views

Bruteforce FileVault Encryption?

I've been getting into forensics and penetration testing lately and hoping someone can explain what the below data is and how it might be used to perform a bruteforce (hashcat) attacks against ...
-1
votes
3answers
125 views

Is it possible to reset the password of an encrypted disk?

I have encrypted my linux partitions. I would know if there's practically a method for overwrite the de-encryption password requested at boot, mounting the hard disk on another pc. EDIT I'm asking ...
43
votes
3answers
13k views

How can Android encryption be so fast?

Android uses full-disk encryption to encrypt files and decrypt them at startup. What I don't understand is that decrypting multiple gigabytes of files must take a lot of time, if nothing else then ...
2
votes
1answer
76 views

recommendation to change encrypted-drive passphrases

There are numerous recommendations for how frequently to change users' passphrases, and I think the most recent NIST recommendation is "no minimum time to change passwords" (I might be mis-quoting). ...
5
votes
3answers
2k views

Full disk encryption vs home folder encryption - why should the former be chosen over the latter

Niebezpiecznik.pl, a popular and acclaimed infosec blog in my country, recommends full disk encryption (emphasis original) to all people (ie. "Average Joes"). They warn that in the opposite scenario ...
7
votes
1answer
152 views

Automatically Open LUKS Container on System Boot in a safe manner

I have a linux system running at a cloud provider where I created an encrypted container using LUKS to store personal data. The encrypted container is manually mounted at /srv; the rest of the ...
0
votes
2answers
177 views

encryption - how to secure files - decrypting exposes them on ssd

Let's say I have an encrypted file. Now I decrypt it but since my computer only has ssd, i decrypt it on the ssd drive. Say, I make changes or I finish using the decrypted file so I encrypt it again. ...
0
votes
1answer
244 views

Does WD My Passport WDBYFT0040BBK-WESN have encryption vulnerability?

Recently I came across this whitepaper: https://eprint.iacr.org/2015/1002.pdf It states vulnerabilities in Western Digital hard drives but doesn't include exact model numbers. I have WD My Passport ...
2
votes
2answers
833 views

Security and Veracrypt [closed]

I have a few questions about Security and Veracrypt and hope you can clarify it for me. I don't want the VeraCrypt hidden volume I created to be damaged. If I mount the hidden volume and transfer ...
0
votes
1answer
309 views

best way to encrypt code and data on IOT device?

I have R scripts which are running on a Raspberry Pi device. I want to encrypt the code and data on the device so that if anyone unmounts the disk and try to read the content via other devices they ...
3
votes
2answers
347 views

What are BitLocker requirements against computer theft?

I'm using Windows 10 Pro edition and took the following actions: I've set up Bitlocker on both disks using the TPM (2.0) to boot the computer. I've also set a Windows password and I have no guest ...