Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [disk-encryption]

Disk encryption is a special case of data at rest protection when the storage media is a sector-addressable device (e.g., a hard disk).

4
votes
2answers
266 views

Are there risks associated with a strong password reuse for disk encryption?

I understand the risks of password reuse when we share the password with 3rd parties as perfectly discussed under this question: Is password reuse a problem if the password is very strong? However I ...
4
votes
4answers
4k views

How do I encrypt external drive with Password which is compatible with both Linux and Windows? [closed]

I wanted to encrypt my external drive with password, which is compatible in both Linux and Windows. Truecrypt is an option. But the development of it is stopped few months back. I came across ...
4
votes
4answers
983 views

Same password for full disk encryption, user account, admin account

Consider a computer with only 1 user, but 3 passwords: 1 for Full Disk Encryption (FDE) 1 for a user account without administrative rights, which would be the account the user uses everyday 1 for an ...
4
votes
2answers
2k views

Does a drive need to be wiped before encrypting it to be completely safe?

Perhaps this question has been asked before, but I couldn't find anything specifically. I want to fully encrypt my ultrabook's SSD with VeraCrypt, TrueCrypt, or BitLocker (haven't decided yet) and I ...
4
votes
1answer
2k views

Portability of SED suppporting TCG Opal 2.0

I've ordered a Samsung SSD (850 PRO SATA) that supports TCG Opal 2.0. At first I was planning on setting an HDD password (aka ATA password) via BIOS. But motherboard manufacturers don't seem to ...
4
votes
1answer
5k views

Are default options of cryptsetup/luks secure?

I'm setting up a partition for a linux distribution and I use the command : cryptsetup -y -v luksFormat /dev/sda1. I believe the default options for the current version of cryptsetup are : --hash ...
4
votes
2answers
2k views

Creating a secure offsite backup at a friend's house

A friend has kindly allowed me to store a hard drive at his house to use as an offsite backup. I normally use rsync-backup to make backups of my home directory and have always done this (just being ...
4
votes
1answer
1k views

Is the Windows paging file safe in the encrypted partition?

I came across this setting called ClearPageFileAtShutdown. The setting is described here and says: If you are truly worried about security, boot Windows off a fully-encrypted drive. Then you needn'...
4
votes
3answers
3k views

How can I extract the encrypted master key from LUKS header?

I know that a LUKS partition has a plain-text header that stores many informations like master key (MK) digest, MK iterations of PBKDF2, information about the 8 key-slots etc. I also know that in the ...
4
votes
1answer
2k views

How safe is the encryption offered by Mac OS X's Finder?

If you plug in a USB drive, open it in Finder and right-click the Finder window, you get the option to encrypt the drive. What methods does Finder use to encrypt the drive and how safe is it actually?...
4
votes
1answer
1k views

What is susceptible to Kon Boot hack tool?

I just learned about Kon Boot (from this YouTube video) and am wondering, how is such a hack tool guarded against? In the video the presenter claimed he had full disk encryption but was still able to ...
4
votes
2answers
4k views

How to handle disk encryption for remote connection?

I have at my workstation, an ubuntu 14.04 installation with full disk encryption. I now have to travel frequently for days and am planning to ssh into this machine from my chromebook to work remotely. ...
4
votes
1answer
105 views

I use full-disk encryption. Should I passphrase-encrypt my private key(s) anyway?

Suppose I want to use GnuPG on a GNU/Linux laptop where I've encrypted all filesystems (except /boot) with LUKS/dm-crypt. Backups are encrypted client-side and stored on a physically secure server. ...
4
votes
1answer
177 views

Is forensics possible with FDEs like LUKS or Veracrypt?

Is forensics possible with full disk encrypted drives? I know that because we don't zero-fill our drives when we delete a file or the file system leaves a trace of a file usually forensics like ...
4
votes
2answers
807 views

Is storing encrypted data in a database futile?

The way I see it: there are two ways to encrypt data for a web app. 1) Store a single encryption key on the server, and use it to encrypt / decrypt data at runtime. The obvious issue here is that if ...
4
votes
4answers
1k views

UEFI and security implications for encryption

After my old PC kicked the bucket I now own my first UEFI board and I am already having trust issues. I utilized Truecrypt's system encryption for years now and really got used to it. My new board has ...
4
votes
1answer
386 views

Self-encrypting drives, certification for tamper-protection?

Consider a drive with Opal 2.0 support that works with Microsoft Bitlocker's "eDrive" feature. In this case, supposedly, the encryption key never leaves the disk (which might increase security, ...
4
votes
1answer
933 views

Does setting a firmware password add security if FileVault 2 is enabled?

On an up-to-date OS X computer with FileVault 2 (whole-disk encryption, minus the recovery partition), is any security gained by setting a firmware password, as well?
4
votes
1answer
444 views

Does ATA security support or allow for 2FA?

I understand TCG OPAL is the spiritual successor of ATA Security for hard drive encryption with SEDs. They claim there is support for biometrics etc, but how is it for the predecessor, ATA Security? ...
4
votes
1answer
355 views

Best current methods for preventing data leakage from SSD

I'm wondering about the current best practices for ensuring data confidentiality on an SSD used as an OS boot drive (under Linux). Important considerations are: Ensures against data leakage in the ...
4
votes
1answer
144 views

What medium for storing full-disk encryption keys is easy-to-use as well as easy-to-destroy?

If I were to frequently work on sensitive data on a LUKS partition and wanted to be able to quickly destroy the keys to it, I figure it would make sense to— encrypt that partition with a key file, ...
4
votes
2answers
10k views

How secure is a BIOS/UEFI hard drive password? [duplicate]

I'm buying some new machines and am concerned about security of the data should the machine be physically stolen. It's easy to take out the drive, image it, and read what you want. I could use file ...
4
votes
1answer
185 views

When using FDE, is there any OS/software allowing to get back from hibernation without requiring the disk encryption key?

This question is a spin-off the following one: Are encryption keys wiped from RAM before hibernate, or how to do it (Luks and Truecrypt). In this question, an answer quoted the following message (the ...
4
votes
1answer
1k views

Does any PXE/Full disk encryption password concept like this exist?

This question may just show a distinct misunderstanding of things on my part, and I apologize if it is, but I thought I'd put it out here as I don't know where else to ask. I've been thinking about ...
4
votes
1answer
2k views

Reasonable (BruteForce) Attempts/Second Estimate?

I've read various articles on password strength and passwords vs pass phrases (including the one from XKCD and its thread here), but most of those articles seem to be focused on online passwords, and ...
4
votes
0answers
480 views

Android wear, Tizen Encryption [closed]

Does Android Wear or Tizen for wearables offer hardware encryption? I have the Samsung Galaxy Gear S and I don't see an option, but was curious if it does it without any user intervention. I don't ...
3
votes
2answers
2k views

Truecrypt hidden partition deleted original drive data

Help! I created a hidden partition within a harddrive encrypted using truecrypt, and instead of creating a second partition, it seems to have deleted all of my data instead. what did i do wrong? I ...
3
votes
7answers
7k views

Should I encrypt my entire hard drive, or only a partition?

I have an HP Pavilion notebook which has a 1TB hard drive. I run Windows 10 on it. If instead of fully encrypting the hard drive or encrypting the partition on which Windows is installed, I just ...
3
votes
4answers
600 views

Securing Data at Rest in Android

Here's a situation. I am the author of an app that allows my customers to stream videos on their local android device. I also allow them to download the video and store it locally on their android ...
3
votes
3answers
15k views

Completely encrypting virtual machine (for free) [closed]

I know in VMware workstation there's the option to encrypt a virtual machine. Is there a free way to do this without VMware workstation? I'm aiming for the fullest encryption and encapsulation ...
3
votes
3answers
3k views

LUKS nuke efficiency

I am wondering about LUKS nuke patch efficiency. In fact, I think I don't really understand it. From what I know of LUKS, a passphrase is used to encrypt a random key (the master key), which is used ...
3
votes
2answers
2k views

Is my data secure in locked screen if I use bitlocker

My SSD is currently encrypted by bitlocker right now. So let say if I leave my laptop on locked state (Win+L). Is it possible for someone to get access to my data? Few thing I noted are: If someone ...
3
votes
3answers
2k views

How to encrypt entire HDD without any password prompts?

Before you dismiss this as silly, let me explain :) The only purpose of this encryption is to make the data inaccessible if the drive breaks down and I want to send it off for warranty replacement. ...
3
votes
2answers
1k views

Is automatic login with full disk encryption a risk?

I use full disk encryption on Linux and wonder whether there is any security risk ob having automatic login on the Linux itself. In case somebody breaks the encryption of the drive, they can read all ...
3
votes
1answer
1k views

Recognizing PGP-encrypted disks

I am studying various disk encryption schemes (such as PGP, MS Bit Locker, BestCrypt and TrueCrypt) on my Windows OS. I am interested to know how an encrypted partition/disk/file with a particular ...
3
votes
1answer
397 views

Is this a security risk for us to lost TPM or others to access to reset BIOS ?

In the previous post Physically secure the system case it is recommended to physically protect the system. But in case stolen laptops where intruder have physical access to TPMs. What are the security ...
3
votes
1answer
470 views

How can a user defeat anti-live forensics software?

Let's say I have a computer with full disk encryption which is logged and running, but I suspect it has anti-forensics software (eg. usbkill), which means that I risk compromising the integrity of the ...
3
votes
2answers
2k views

Full Disk Encryption and FIPS

I've been tasked to find out what's required to use BitLocker (or any other FDE method/mechanism) in Windows 10 in "FIPS mode". This is outside the realm of my expertise (and I've advised the client ...
3
votes
1answer
2k views

Will new data written to disk while BitLocker is encrypting the disk be encrypted?

When you enable BitLocker, there is a period of time where BitLocker is slowly encrypting the contents of the drive in the background. During this time, is it guaranteed that new data written to the ...
3
votes
1answer
215 views

How can AES-CBC be used for LUKS encryption, when the ciphertext is not static?

In CBC mode of operation, ciphertext from previous block is used as IV in next block. How then can AES-CBC be used for disk encryption (LUKS), when the data on the disk (ie the ciphertext) keeps ...
3
votes
1answer
116 views

Is there a full disk encyption software that shows different content depending on what password has beeen used? [closed]

I'm searching for a 256-bit full disk encryption software that allows me to access different content on the same disk with different passwords. Like: Password A opens partition 1, password B opens ...
3
votes
1answer
824 views

Decrypting FDE in Disaster Recovery

I saw a hot network question on SE, about Workplace Ethics - Do I give my password at work to my old boss after quitting?. My initial response (as are the answers in that question) is always NO. The ...
3
votes
2answers
2k views

How to make a certificate encrypted flash drive?

I was wondering if it possible to encrypt a flash drive (or any other external medium) using certificates instead of a password. The idea is to have a number of encrypted pendrives that can be used on ...
3
votes
2answers
449 views

What are BitLocker requirements against computer theft?

I'm using Windows 10 Pro edition and took the following actions: I've set up Bitlocker on both disks using the TPM (2.0) to boot the computer. I've also set a Windows password and I have no guest ...
3
votes
1answer
389 views

Is SSD encryption useless on data already present?

The reason I ask this question, is that presumably when contents on an SSD are encrypted, the unencrypted data is overwritten with its encrypted version. This study tells us that overwritten data can ...
3
votes
1answer
124 views

Recommended practice for laptop encryption: nested encryption?

Until now I have used a laptop that has a single folder encrypted (using filevault2) containing my passwords and bank stuffs. I am getting a new laptop that encourages full-disk encryption. This ...
3
votes
1answer
95 views

Is there any security issue when removing a LUKS partition without luksClose?

An external hard disk drive is connected to a Debian system via USB. The disk is encrypted using cryptsetup LUKS and is properly opened and mounted using luksOpen. Now, if somebody just unplugs the ...
3
votes
1answer
187 views

What's the point of encrypting /boot or / partition?

I'm not talking about full disk hardware encryption. I'm talking about software encryption. encrypting /home prevents your data after your laptop is stolen. As far as I understand, encrypting / and /...
3
votes
1answer
616 views

FileVault and Sleeping mode

I have FileVault activated on 10.10. (Mid 2012 MacBook Pro - MPB) I relaized already that there are different sleep modes. autopoweroff and normal Standby. Whenever the MBP goes into Hypernate mode, I ...
3
votes
3answers
190 views

Using a windows partition as a decoy

I'm interested in setting up a laptop that dual boots Windows 7 and openSUSE. The plan is to encrypt the openSUSE partition and require a USB thumb drive with the encryption key for it to boot. Where ...