Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [disk-encryption]

Disk encryption is a special case of data at rest protection when the storage media is a sector-addressable device (e.g., a hard disk).

6
votes
1answer
474 views

Method for securely removing files from a solid state drive

I've thought of a method for securely erasing single files on a solid state drive. This method will work only if the drive is encrypted, and it will work even if someone cracks the encryption key for ...
6
votes
1answer
1k views

Are encryption keys wiped from RAM before hibernate, or how to do it (Luks and Truecrypt)

Using Linux, I have system and swap/hibernation partitions encrypted with LUKS, and data partitions encrypted with Truecrypt, and I am wondering when I put my laptop to hibernation if the encryption ...
6
votes
1answer
882 views

Hardware-based full disk encryption without pre-boot authentication [closed]

I am looking for a possibility to sanitize large amounts of data on regular hard-drives and SSDs. Instead of overwriting the data several times (on regular hard-drives, which could take days and doesn'...
6
votes
0answers
104 views

Can I use disk encryption and track my device at the same time, in case it's stolen or lost? [duplicate]

I would like to encrypt a single user profile but have been told EFS isn't the solution. I have a laptop that I leave in my bag and use for work and private purposes. I want to secure data in case my ...
5
votes
2answers
812 views

How does full disk encryption cater for overprovisoned disk space in flash devices and can this result in data leakage?

My understanding is that flash based devices such as SSDs are over-provisioned and do not advertise the additional blocks of storage available to the operating system. The over-provisioned blocks of ...
5
votes
2answers
25k views

Is Truecrypt still safe? [duplicate]

I want to fully encrypt a disk on Windows 7, but I don't trust Bitlocker and Truecrypt has announced it is not safe (also many rumours about NSA being able to decrypt it and it's better to avoid it). ...
5
votes
5answers
854 views

Encrypted disk at risk if laptop stolen while turned on but locked

If I have a laptop with full disk encryption it's turned on, the screen is locked and it gets stolen. How would an attacker get my data? It's not encrypted at the moment because it's turned on but the ...
5
votes
2answers
1k views

Is it nescecary to wipe and reset the MBR when laptop changes owners even if full disk encryption is used?

Where I'm currently working we use full disk encryption and after a laptop transfer owners we use a secure erasure program. This is quite time consuming and I'm wondering is it necessary? For the disk ...
5
votes
1answer
336 views

Is there readily available encryption algorithms for current computers, that is safe from quantum computers?

Is there readily available encryption algorithms for current computers, that is safe from quantum computers? I know a bunch of currently popular encryption algorithms that are safe from current ...
5
votes
2answers
2k views

Possible implementations of networked+encrypted filesystem

Is it possible to implement scheme where remote server just share its filesystem (or resizable container file in it) and it's locally encrypted and mounted? And what is best practical method? (On ...
5
votes
1answer
503 views

Bruteforce FileVault Encryption?

I've been getting into forensics and penetration testing lately and hoping someone can explain what the below data is and how it might be used to perform a bruteforce (hashcat) attacks against ...
5
votes
1answer
289 views

Android disk encryption

When is the data on an Android phone encrypted? I am assuming here that the device is configured to have full disk encryption enabled. Is it only encrypted when the device is powered off and ...
5
votes
2answers
13k views

TrueCrypt vs “native” whole-disk encryption on Linux?

When preparing to encrypt an entire partition, is it better to rely on "native" whole-disk encryption (eg following this tutorial), or an external tool like TrueCrypt? The wikipedia article comparing ...
5
votes
1answer
80 views

Is there a file system allowing read-only access enforced by cryptography

Is there a file system standard (like LUKS) that allows anyone who can plug in the hard drive to read files, but requires a passphrase to modify or write? For example, I can do something similar by ...
5
votes
4answers
4k views

Is plausible deniability actually feasible for encrypted volumes/disks?

Based on Is it possible to tell if hard drive is encrypted?, is it actually possible to hide a volume in practice? According to this answer TrueCrypt is the only well-known disk encryption software ...
5
votes
2answers
2k views

What are the pros and cons of using yubikey with ssd hardware encryption?

I'm considering trying out yubikey and I've recently discovered that the (crucial m500) SSD I recently bought supports hardware encryption. I think it should be possible to use a yubikey to provide ...
5
votes
1answer
2k views

Is using decrypt_derived more secure than a keyfile?

Say I have two partitions on a Linux system, a root partition (/) and a /home partition. Both of them are encrypted with LUKS. The /home partition needs only to be decrypted if / is unlocked and ...
5
votes
3answers
215 views

Can my /boot be compromised if I Suspend my notebook?

So if I use e.g.: LUKS, and I always suspend my notebook, then are there any methods to modify the unencrypted /boot? It contains the kernel! Or if someone tries (evil maid) to modify the /boot then ...
5
votes
3answers
612 views

Breaking full-disk encryption on a computer that's rarely used

I'm writing a story where a security expert has been kidnapped and tasked with gaining access to some files on a stolen computer protected by full-disk encryption, and I'd like some ideas for ways he ...
5
votes
2answers
249 views

Where to store passwords of encrypted backup drives

I have all my backup hard drives encrypted with LUKS. Currently, the passphrase is some 25+ random password that I store in my password manager KeePassX. Since I have the backup drives for the case ...
5
votes
2answers
1k views

Is it possible to share BitLocker decryption keys between multiple TPMs?

The TPM specification mentions that some keys are migratable, i.e. transferable to another TPM. Does this mean that it would be possible to share (transfer) a BitLocker decryption key between several ...
5
votes
1answer
2k views

Can a Bitlocker To Go user pin be brute forced?

I have a external hard disk and protected a partition on it with Bitlocker To Go. I printed the recovery code but I lost it. I can't remember the user PIN either. If I could only know the first ...
5
votes
2answers
11k views

What does HP DriveLock do to your password?

While looking at various hard drive encryption methods, I discovered that HP's "DriveLock" is not quite the standard ATA security system. While I did get confirmation from HP that it does indeed use ...
5
votes
2answers
1k views

What cryptographic module does Sql Server 2008 use to run in Fips 140-2 compliant mode by default?

One can configure Sql Server 2008 to run in FIPS 140-2 compliant mode, in the same manner as running Bitlocker in FIPS 140-2 compliant mode. Which is to activate FIPS 140-2 compliant mode in the ...
5
votes
1answer
6k views

Is it possible to auto mount entire truecrypt drive

Truecrypt can easily automount if your drive is not entirely encrypted and your data is a standard file. However I have my entire removable storage encrypted and so to the OS, it is seen as an ...
5
votes
1answer
759 views

Can you extract the encryption key of a computer with full disk encryption via malware?

I recently discovered the subject of cold boot attacks which are able to extract the encryption key of the ram memory after the computer has shut down. and from what I understand is that law ...
5
votes
2answers
757 views

Why does LUKS use CBC?

I read that LUKS uses 256-bit AES with CBC by default. CBC, of course, has the disadvantages that if you change something in the plain text, you have to change everything that comes after it. In the ...
4
votes
3answers
3k views

Securing my USB flash drive with Truecrypt and FreeOTFE

I want to know if I encrypt my flash with Truecrypt "Encrypt a non-system partition/drive" option and then mount it and then make a container with FreeOTFE on the Truecrypt encrypted drive and then ...
4
votes
3answers
1k views

Encrypting an email server's local drives or filesystems

Planning to deploy a remote hosted mailer (Zimbra based) I need to make sure the local data on the machine is encrypted. Currently, the plan is to use the built in LUKS to encrypt /opt/zimbra and ...
4
votes
1answer
939 views

Android FDE - Why is key stored in RAM at all?

As far as I understand, the device's /data partition remains decrypted once an encrypted devices has been unlocked during boot up. Why does Android have to keep encryption keys within RAM if no "live" ...
4
votes
1answer
14k views

Is there any way to crack a Bitlocker drive?

We have disk drive that encrypt with BitLocker. My key is lost, and we haven't any backup of the data. Is there any way to hack or crack and recover our data?
4
votes
2answers
296 views

Securing data on laptop's hdd

I was wondering which is the best way to secure/encrypt data in the hard disk on a laptop that runs Ubuntu Oneiric? Setting LVM encryption? I am mostly concerned about having my laptop lost or what ...
4
votes
4answers
1k views

Are backups of truecrypt volumes with different pass phrases a security risk?

Lets say that I periodically change the pass-phrase on a truecrypt volume. The volume is regularly backed up, so my backup system has many copies of that volume, many of which have a different volume ...
4
votes
1answer
488 views

How to encrypt an entire portable HDD, so that it cannot be read/written without the password for it?

I use a portable USB drive (Seagate FreeAgent Go Flex) to keep all my personal stuff, and though the HDD company does offer a password scheme to control access to it, that would work only on windows, ...
4
votes
4answers
4k views

Samsung SSD 840 Evo Disk-Encryption

My question relates to the hardware encryption of samsungs 840 Evo SSD (maybe also other models): The theory: Samsung specifies that their SSD encrypts each data with AES by default. So if I choose a ...
4
votes
1answer
355 views

Accessing hidden partitons

I have two disks. They're both bootable and run Linux. When I physically mount the disks, I can see scsi devices get added. /dev/sdb and /dev/sdc. However the partitions are not detected. I can't see ...
4
votes
2answers
1k views

Is it safe to suspend my computer if I'm using encrypted hard drive?

I'm using disk encryption to protect my data and sensitive information - but only one partition. I used to suspend my computer instead of shutting it down because of very fast resume and very low ...
4
votes
3answers
2k views

Are there any hardware encryption solutions for my notebook?

I have a HP 6510b notebook. Are there any solutions for hardware encryption? I mean I don't want to use software encryption like LUKS, but I don't want that that if my notebook gets stolen the ...
4
votes
2answers
776 views

How secure are most FDE implementations?

I'm applying disk encryption to my local machine and I'm storing the key on a usb drive. This means I need the usb drive to be able to boot. This got me wondering, I've heard about different osses ...
4
votes
2answers
3k views

Where is the Bitlocker key stored without the Trusted-Platform Module (TPM)?

I've seen many Windows clients with Bitlocker installed without the Trusted-Platform Module (TPM) enabled. This requires manual changes in the Group Policy since by default it's not possible to enable ...
4
votes
2answers
7k views

TrueCrypt VS LUKS Bruteforce Resilience

I have been researching LUKS vs TrueCrypt topics -- my only concern is security, but most of the discussions I see focus around usability / interoperability . I know TrueCrypt has a bunch of nice ...
4
votes
3answers
833 views

Remedy for not having filled the disk with random data?

Filling a large HDD with /dev/urandom prior to encryption can be extremely slow (even with netcat, multiple instances in parallel, etc) and for this reason I'm sure a lot of users skip this advice ...
4
votes
2answers
465 views

Advice on buying an encrypted disk

How do I find an encrypted disk to buy? What factors should I be aware of in selecting one? Is there any proof that buying one likely to draw any attention? How do I know there's not a backdoor?
4
votes
3answers
670 views

External HDD safety without Full disc encryption

I am not very informed when it comes to disk security but interested to learn more ( so please if it seems like i am misunderstanding some concepts point me to the right reading material ) I've got ...
4
votes
1answer
7k views

Can Windows BitLocker encryption be broken by Live Boot?

I have a Windows system and I protected the drive with BitLocker encryption. Can BitLocker encryption be bypassed by live-booting with Linux or any other OS?
4
votes
1answer
491 views

Overwriting disk with random data vs. encrypted zeros

Most disk encryption guides recommend to overwrite the disk with random data before encryption, this is discussed here. However the time this takes with the "standard" source of random data can be ...
4
votes
1answer
2k views

Is Dual Factor possible during boot with whole disk encryption on Mac FileVault 2

Mac FileVault 2 is the default disk encryption for newer Macs that occurs in the EFI pre-boot phase. The challenge here is that most smartcard drivers are loaded after the OS loads. Is anyone aware ...
4
votes
2answers
1k views

Detect changes in /boot when using full disk encryption

When running a fully encrypted linux system using dm-crypt, the /boot partition has to be unencrypted to boot, as far as I know. I've setup a server that can be unlocked remotely by connecting to a ...
4
votes
1answer
5k views

VeraCrypt PIM feature - Is it really necessary?

I am looking to encrypt my OS hard drive, and VeraCrypt caught my eye as a real good option. I tried to encrypt my drive with it, and the resulting encrypted system, takes around a minute to decrypt. ...
4
votes
1answer
868 views

LUKS TPM disk encryption attacks

Is it possible, or are there any known attacks, to get the encryption key for disk encryption tpm-luks? (Linux LUKS using encryption key stored in TPM) I know that there are attacks like cold boot ...