Questions tagged [disk-encryption]

Disk encryption is a special case of data at rest protection when the storage media is a sector-addressable device (e.g., a hard disk).

Filter by
Sorted by
Tagged with
4
votes
3answers
753 views

External HDD safety without Full disc encryption

I am not very informed when it comes to disk security but interested to learn more ( so please if it seems like i am misunderstanding some concepts point me to the right reading material ) I've got ...
4
votes
1answer
525 views

Overwriting disk with random data vs. encrypted zeros

Most disk encryption guides recommend to overwrite the disk with random data before encryption, this is discussed here. However the time this takes with the "standard" source of random data can be ...
4
votes
1answer
2k views

Is Dual Factor possible during boot with whole disk encryption on Mac FileVault 2

Mac FileVault 2 is the default disk encryption for newer Macs that occurs in the EFI pre-boot phase. The challenge here is that most smartcard drivers are loaded after the OS loads. Is anyone aware ...
4
votes
2answers
1k views

Detect changes in /boot when using full disk encryption

When running a fully encrypted linux system using dm-crypt, the /boot partition has to be unencrypted to boot, as far as I know. I've setup a server that can be unlocked remotely by connecting to a ...
4
votes
1answer
6k views

VeraCrypt PIM feature - Is it really necessary?

I am looking to encrypt my OS hard drive, and VeraCrypt caught my eye as a real good option. I tried to encrypt my drive with it, and the resulting encrypted system, takes around a minute to decrypt. ...
4
votes
1answer
913 views

LUKS TPM disk encryption attacks

Is it possible, or are there any known attacks, to get the encryption key for disk encryption tpm-luks? (Linux LUKS using encryption key stored in TPM) I know that there are attacks like cold boot ...
4
votes
4answers
4k views

How do I encrypt external drive with Password which is compatible with both Linux and Windows? [closed]

I wanted to encrypt my external drive with password, which is compatible in both Linux and Windows. Truecrypt is an option. But the development of it is stopped few months back. I came across ...
4
votes
4answers
1k views

Same password for full disk encryption, user account, admin account

Consider a computer with only 1 user, but 3 passwords: 1 for Full Disk Encryption (FDE) 1 for a user account without administrative rights, which would be the account the user uses everyday 1 for an ...
4
votes
2answers
2k views

Does a drive need to be wiped before encrypting it to be completely safe?

Perhaps this question has been asked before, but I couldn't find anything specifically. I want to fully encrypt my ultrabook's SSD with VeraCrypt, TrueCrypt, or BitLocker (haven't decided yet) and I ...
4
votes
1answer
2k views

Portability of SED suppporting TCG Opal 2.0

I've ordered a Samsung SSD (850 PRO SATA) that supports TCG Opal 2.0. At first I was planning on setting an HDD password (aka ATA password) via BIOS. But motherboard manufacturers don't seem to ...
4
votes
1answer
6k views

Are default options of cryptsetup/luks secure?

I'm setting up a partition for a linux distribution and I use the command : cryptsetup -y -v luksFormat /dev/sda1. I believe the default options for the current version of cryptsetup are : --hash ...
4
votes
2answers
2k views

Creating a secure offsite backup at a friend's house

A friend has kindly allowed me to store a hard drive at his house to use as an offsite backup. I normally use rsync-backup to make backups of my home directory and have always done this (just being ...
4
votes
1answer
2k views

Is the Windows paging file safe in the encrypted partition?

I came across this setting called ClearPageFileAtShutdown. The setting is described here and says: If you are truly worried about security, boot Windows off a fully-encrypted drive. Then you needn'...
4
votes
1answer
2k views

How safe is the encryption offered by Mac OS X's Finder?

If you plug in a USB drive, open it in Finder and right-click the Finder window, you get the option to encrypt the drive. What methods does Finder use to encrypt the drive and how safe is it actually?...
4
votes
1answer
1k views

What is susceptible to Kon Boot hack tool?

I just learned about Kon Boot (from this YouTube video) and am wondering, how is such a hack tool guarded against? In the video the presenter claimed he had full disk encryption but was still able to ...
4
votes
2answers
4k views

How to handle disk encryption for remote connection?

I have at my workstation, an ubuntu 14.04 installation with full disk encryption. I now have to travel frequently for days and am planning to ssh into this machine from my chromebook to work remotely. ...
4
votes
1answer
120 views

I use full-disk encryption. Should I passphrase-encrypt my private key(s) anyway?

Suppose I want to use GnuPG on a GNU/Linux laptop where I've encrypted all filesystems (except /boot) with LUKS/dm-crypt. Backups are encrypted client-side and stored on a physically secure server. ...
4
votes
1answer
221 views

Is forensics possible with FDEs like LUKS or Veracrypt?

Is forensics possible with full disk encrypted drives? I know that because we don't zero-fill our drives when we delete a file or the file system leaves a trace of a file usually forensics like ...
4
votes
2answers
841 views

Is storing encrypted data in a database futile?

The way I see it: there are two ways to encrypt data for a web app. 1) Store a single encryption key on the server, and use it to encrypt / decrypt data at runtime. The obvious issue here is that if ...
4
votes
4answers
1k views

UEFI and security implications for encryption

After my old PC kicked the bucket I now own my first UEFI board and I am already having trust issues. I utilized Truecrypt's system encryption for years now and really got used to it. My new board has ...
4
votes
1answer
389 views

Self-encrypting drives, certification for tamper-protection?

Consider a drive with Opal 2.0 support that works with Microsoft Bitlocker's "eDrive" feature. In this case, supposedly, the encryption key never leaves the disk (which might increase security, ...
4
votes
1answer
935 views

Does setting a firmware password add security if FileVault 2 is enabled?

On an up-to-date OS X computer with FileVault 2 (whole-disk encryption, minus the recovery partition), is any security gained by setting a firmware password, as well?
4
votes
1answer
479 views

Does ATA security support or allow for 2FA?

I understand TCG OPAL is the spiritual successor of ATA Security for hard drive encryption with SEDs. They claim there is support for biometrics etc, but how is it for the predecessor, ATA Security? ...
4
votes
1answer
364 views

Best current methods for preventing data leakage from SSD

I'm wondering about the current best practices for ensuring data confidentiality on an SSD used as an OS boot drive (under Linux). Important considerations are: Ensures against data leakage in the ...
4
votes
1answer
147 views

What medium for storing full-disk encryption keys is easy-to-use as well as easy-to-destroy?

If I were to frequently work on sensitive data on a LUKS partition and wanted to be able to quickly destroy the keys to it, I figure it would make sense to— encrypt that partition with a key file, ...
4
votes
1answer
191 views

When using FDE, is there any OS/software allowing to get back from hibernation without requiring the disk encryption key?

This question is a spin-off the following one: Are encryption keys wiped from RAM before hibernate, or how to do it (Luks and Truecrypt). In this question, an answer quoted the following message (the ...
4
votes
1answer
1k views

Does any PXE/Full disk encryption password concept like this exist?

This question may just show a distinct misunderstanding of things on my part, and I apologize if it is, but I thought I'd put it out here as I don't know where else to ask. I've been thinking about ...
4
votes
1answer
2k views

Reasonable (BruteForce) Attempts/Second Estimate?

I've read various articles on password strength and passwords vs pass phrases (including the one from XKCD and its thread here), but most of those articles seem to be focused on online passwords, and ...
4
votes
0answers
487 views

Android wear, Tizen Encryption [closed]

Does Android Wear or Tizen for wearables offer hardware encryption? I have the Samsung Galaxy Gear S and I don't see an option, but was curious if it does it without any user intervention. I don't ...
3
votes
2answers
2k views

Truecrypt hidden partition deleted original drive data

Help! I created a hidden partition within a harddrive encrypted using truecrypt, and instead of creating a second partition, it seems to have deleted all of my data instead. what did i do wrong? I ...
3
votes
4answers
613 views

Securing Data at Rest in Android

Here's a situation. I am the author of an app that allows my customers to stream videos on their local android device. I also allow them to download the video and store it locally on their android ...
3
votes
3answers
16k views

Completely encrypting virtual machine (for free) [closed]

I know in VMware workstation there's the option to encrypt a virtual machine. Is there a free way to do this without VMware workstation? I'm aiming for the fullest encryption and encapsulation ...
3
votes
3answers
3k views

LUKS nuke efficiency

I am wondering about LUKS nuke patch efficiency. In fact, I think I don't really understand it. From what I know of LUKS, a passphrase is used to encrypt a random key (the master key), which is used ...
3
votes
2answers
2k views

Is my data secure in locked screen if I use bitlocker

My SSD is currently encrypted by bitlocker right now. So let say if I leave my laptop on locked state (Win+L). Is it possible for someone to get access to my data? Few thing I noted are: If someone ...
3
votes
3answers
2k views

How to encrypt entire HDD without any password prompts?

Before you dismiss this as silly, let me explain :) The only purpose of this encryption is to make the data inaccessible if the drive breaks down and I want to send it off for warranty replacement. ...
3
votes
2answers
2k views

Is automatic login with full disk encryption a risk?

I use full disk encryption on Linux and wonder whether there is any security risk ob having automatic login on the Linux itself. In case somebody breaks the encryption of the drive, they can read all ...
3
votes
1answer
1k views

Recognizing PGP-encrypted disks

I am studying various disk encryption schemes (such as PGP, MS Bit Locker, BestCrypt and TrueCrypt) on my Windows OS. I am interested to know how an encrypted partition/disk/file with a particular ...
3
votes
1answer
399 views

Is this a security risk for us to lost TPM or others to access to reset BIOS ?

In the previous post Physically secure the system case it is recommended to physically protect the system. But in case stolen laptops where intruder have physical access to TPMs. What are the security ...
3
votes
2answers
2k views

Full Disk Encryption and FIPS

I've been tasked to find out what's required to use BitLocker (or any other FDE method/mechanism) in Windows 10 in "FIPS mode". This is outside the realm of my expertise (and I've advised the client ...
3
votes
1answer
2k views

Will new data written to disk while BitLocker is encrypting the disk be encrypted?

When you enable BitLocker, there is a period of time where BitLocker is slowly encrypting the contents of the drive in the background. During this time, is it guaranteed that new data written to the ...
3
votes
1answer
227 views

How can AES-CBC be used for LUKS encryption, when the ciphertext is not static?

In CBC mode of operation, ciphertext from previous block is used as IV in next block. How then can AES-CBC be used for disk encryption (LUKS), when the data on the disk (ie the ciphertext) keeps ...
3
votes
1answer
116 views

Is there a full disk encyption software that shows different content depending on what password has beeen used? [closed]

I'm searching for a 256-bit full disk encryption software that allows me to access different content on the same disk with different passwords. Like: Password A opens partition 1, password B opens ...
3
votes
1answer
841 views

Decrypting FDE in Disaster Recovery

I saw a hot network question on SE, about Workplace Ethics - Do I give my password at work to my old boss after quitting?. My initial response (as are the answers in that question) is always NO. The ...
3
votes
2answers
2k views

How to make a certificate encrypted flash drive?

I was wondering if it possible to encrypt a flash drive (or any other external medium) using certificates instead of a password. The idea is to have a number of encrypted pendrives that can be used on ...
3
votes
2answers
552 views

What are BitLocker requirements against computer theft?

I'm using Windows 10 Pro edition and took the following actions: I've set up Bitlocker on both disks using the TPM (2.0) to boot the computer. I've also set a Windows password and I have no guest ...
3
votes
1answer
419 views

Is SSD encryption useless on data already present?

The reason I ask this question, is that presumably when contents on an SSD are encrypted, the unencrypted data is overwritten with its encrypted version. This study tells us that overwritten data can ...
3
votes
1answer
136 views

Recommended practice for laptop encryption: nested encryption?

Until now I have used a laptop that has a single folder encrypted (using filevault2) containing my passwords and bank stuffs. I am getting a new laptop that encourages full-disk encryption. This ...
3
votes
1answer
99 views

Is there any security issue when removing a LUKS partition without luksClose?

An external hard disk drive is connected to a Debian system via USB. The disk is encrypted using cryptsetup LUKS and is properly opened and mounted using luksOpen. Now, if somebody just unplugs the ...
3
votes
1answer
207 views

What's the point of encrypting /boot or / partition?

I'm not talking about full disk hardware encryption. I'm talking about software encryption. encrypting /home prevents your data after your laptop is stolen. As far as I understand, encrypting / and /...
3
votes
3answers
4k views

How can I extract the encrypted master key from LUKS header?

I know that a LUKS partition has a plain-text header that stores many informations like master key (MK) digest, MK iterations of PBKDF2, information about the 8 key-slots etc. I also know that in the ...