Questions tagged [disk-encryption]

Disk encryption is a special case of data at rest protection when the storage media is a sector-addressable device (e.g., a hard disk).

3
votes
1answer
102 views

How protected are files within a running encrypted VM on a possibly non secure hypervisor / host?

I've got a set of source code files (compiled C#) that I want to prevent direct read access to. The program will be running on the VM. I was thinking of storing these in an encrypted hard disk VM, the ...
3
votes
1answer
338 views

Enabling SED for SSD and data remanence

I have an SSD that can do self-encryption, but the encryption was not activated. The SSD has data on it, and now I want to enable the self-encryption functionality, preferably doing it in-place. I ...
3
votes
1answer
2k views

Is using trim on a ssd with LVM LUKS safe?

I know that it can allow an attacker to know the filesystem and file size, but can it allow an attacker to decrypt any files?
3
votes
4answers
641 views

What options exist for authenticated full-disk encryption?

Title says it all really. I'm toying with the idea of storing some disk images in "the cloud", but am concerned about the possibility of an attacker manipulating cipertext to do evil things once it's ...
3
votes
2answers
8k views

Encrypting tails USB boot disk (preeboot password on live)

To use tails, I have always used a DVD, because of the fact I know it will not be tampered with, at least within reason. However there are endless reasons why a USB boot option would be faster, and in ...
3
votes
1answer
276 views

Security implications when setting the discard option in /etc/crypttab

Setting the discard option in /etc/crypttab has security implications. From the man page: Allow discard requests to be passed through the encrypted block device. This improves performance on SSD ...
3
votes
1answer
4k views

Full disk encryption on dual boot system (Truecrypt/Veracrypt)

I am looking to run my laptop system with a dual boot configuration (Fedora + Windows) with full disk encryption. I have a laptop that I will be bringing with me while traveling, both domestically ...
3
votes
2answers
384 views

Choose a good password for full disk encryption [duplicate]

I have recently decided to encrypt my Gentoo Linux installation. I am going to use cryptsetup with LVM. LVM filesystem will be placed inside encrypted dm-crypt partition. I have problem with ...
3
votes
1answer
189 views

Is disk wiping required for full disk encryption if that disk was encrypted before?

It is generally recommended to safely erase the content of a disk before encrypting it, to avoid some forensic attacks. But is it necessary when that disk was encrypted before ? Wouldn't the data ...
3
votes
1answer
1k views

Is it possible to extract secrets from a TPM without knowing the PIN?

I understand the general operation of a TPM, and in particular the interest of using a pre-boot PIN: if someone gets access to the machine (turned off), turning on the computer will not be enough to ...
3
votes
2answers
375 views

Is using a weak password for the non-hidden volume acceptable?

Considering that I can only safely choose the filesystem for the hidden partition of a VeraCrypt container, and that I would like to use a particular filesystem, is it acceptable to use a weak ...
3
votes
3answers
343 views

Is VeraCrypt encryption of VHDX correct?

I have created a dynamically expanding vhdx of 500GB to store my backups to - I have decided not to create a 500GB container due to time it would take to create one. I have encrypted the drive ...
3
votes
1answer
909 views

Securely read encryption key from NVRAM of TPM 1.2

I have configured a disk encryption in linux using LUKS with TPM with secure boot. The encryption key is loaded from TPM from NV memory using command TPM_NV_ReadValueAuth. The problem is that it is ...
3
votes
1answer
374 views

Windows Phone 8.1 Forensic Artifacts

I cannot find any potential tool or technique to do windows phone 8.1 forensics after lot of searching. I tried to make the image (.dd) of windows phone 8.1 with Linux commands but it fails, ...
3
votes
2answers
187 views

Can full disk encryption make malware recovery more difficult?

Let us say that we have a computer with a fully encrypted disk. If it gets infected with malware, does this make it more difficult to use a LiveCD or other rescue option to clean it or restore it? It ...
3
votes
1answer
238 views

Remote System Administration of an Encryption-Switch-Encrypted Infrastructure

I can't seem to find a decent explanation anywhere of the practicalities of remote system administration (e.g. SSH) of an encryption-switch-encrypted SAN-stored infrastructure. The environment will ...
3
votes
1answer
1k views

HDD password cracking [closed]

I recently changed the decryption key to my WD My Passport HDD two days ago. Before I left for the weekend, I tested to make sure that the key would work. However, the password that I set, which got ...
3
votes
2answers
579 views

Is a password or passphrase needed with a keyfile backup to decrypt

In my search for an encrypted NAS i have come across a few products that talk about backing up the encryption key and storing it in a safe location. My question is if this backed up keyfile is enough ...
3
votes
1answer
228 views

How well does FDE protect against disk firmware malware? [duplicate]

In early 2015 news broke that the NSA was installing firmware backdoors in many hard drives. I was wondering, if there was a BIOS and Hard Drive backdoor how well would full disk encryption protect ...
3
votes
2answers
547 views

Most secure way to deliver web app for offline access [closed]

Having built a web app based on a PHP stack which is deployed on a server, I would like to have a way to provide access to it offline. There's a database of patients and appointments that needs to be ...
3
votes
0answers
97 views

Securely encrypt drive, able to be decrypted independently of the OS [closed]

I need a software to encrypt drives like USB pens, disc drives, ... to securely store the data. But most of the software I've found to encrypt and decrypt drives is OS dependent. For example Windows ...
3
votes
0answers
179 views

Finding Audit Reports and Results for Whole Disk Encryption Solutions

Due to TrueCrypt being pulled from the web even though it's been audited, I was asked to compare the audit of TrueCrypt against audits and information available for other products that do whole disk ...
3
votes
0answers
3k views

What is a self-contained cross-platform encryption for USB drive? [closed]

I'm trying to find self-contained encryption solution for USB drives while at the same time being platform independent. For example, Windows' BitLocker only works on Windows and not on OS X or Linux. ...
2
votes
3answers
1k views

File encryption on a solid state drive

It seems a lot of computers are switching to solid state drives, and one of the downsides of this is that it seems to make encryption of individual files basically useless, because when you encrypt a ...
2
votes
3answers
619 views

Isn't file encryption good enough?

As the title asks, and in conjunction, I'm wondering why full-disk encryption is "better" to some folk. This is not taking into consideration of theft, but rather, something or someone infecting my ...
2
votes
3answers
997 views

Data encryption risk with bad sectors?

A few decades ago, I've known hard disks and floppy disks which developed bad sectors or crashed. So now when I want to use an external hard disk for backups for a startup company, the first thing ...
2
votes
2answers
429 views

What's a secure way to prompt for a password and erase the cached password afterwards in Linux?

So I have multiple hard drives encrypted with the same password and instead of having to enter it multiple times I'd like to have it set up so that after booting I automatically get a password-box ...
2
votes
1answer
158 views

Are “roll your own” crypto implementations really a concern for offline storage?

This is a fictional situation and I don't intend to use a custom crypto implementation in anything serious. I understand why badly written crypto code can be vulnerable to a lot of attacks. So far ...
2
votes
1answer
174 views

How do I make my drive fully protected with bitlocker?

Please note that I am new to BitLocker but I was able to set it up on my C drive. After doing this, I breifly searched on the web for ways around BitLocker and came up with two articles, Passware Hard ...
2
votes
3answers
163 views

Could an Encrypted VG/Image compromised?

I mean if I encrypt my ""full system"" so that everything (besides the /boot) is in an encrypted VolumeGroup (Linux). So I store my /boot on a flash drive, thats always next to me. Q: can the ...
2
votes
3answers
235 views

Should it remain as a general advice to encrypt the whole HDD?

AFAIK, the general advice is to encrypt the whole HDD or at least the whole /home partition (and its Windows equivalent), because nowadays computers tend to store lots of personal, sensitive ...
2
votes
5answers
458 views

Unattended Disk Encryption

I have been asked to implement disk encryption on a machine that needs to be able to run unattended. The machine has two disks. The first disk has a boot partition and an OS partition, while the ...
2
votes
2answers
601 views

Disk encryption with OTP to protect source code

We have to ship a hard- and software prototype to a customer for a first field test. The software is just not ready (protected - too much Python code) for distribution without the possibility, that ...
2
votes
1answer
158 views

Can I use more than one encryption program to encrypt my computer files or will it cause conflicts?

I encrypted my Ubuntu Linux Operating System in the installation process using the default encryption in Ubuntu if my computer is encrypted with one program can it be encryption with another at the ...
2
votes
2answers
362 views

Server full disk encryption protection from malware

A group of LINUX servers is using dm-crypt to encrypt data. The servers do not store data long-term but are only temporary stopping points for data before it is sent to other systems. The time the ...
2
votes
3answers
132 views

Encryption while logged in

If I'm using full disk encryption on my home computer, and it's online, are the hard drive contents encrypted when I'm logged in and using the machine (from the perspective of an online attacker - no ...
2
votes
1answer
187 views

Is it possible to LUKS require both password and key file?

My goal is to be able easily destroy medium with key file in emergency situation and make system unbootable, even is potential advisor knows right password for the system. I'd store this key file in ...
2
votes
1answer
387 views

Does a bitlocker pin become part of the key?

I recently added a pin to my bitlocker encryption and this seemed to be pretty much instant. In what way is this pin an actual part of the key that is needed to decrypt the hard drive? Or is it used ...
2
votes
1answer
722 views

TrueCrypt FDE Password Recovery

I have a computer with a TrueCrypt full disk encryption and I can't remember the password. I have a pretty good idea of what the password is, meaning I know the words and numbers and symbols used in ...
2
votes
1answer
735 views

Laptops SSD: Hardware Encryption plus DM-Crypt/Luks - Security and Performance

I just bought a new Thinkpad t450s, and put a Samsung 850 pro in it. My Cpu supports AES-NI and the SSD supports hard-ware based encryption. My question is, is there any reason to do Both Hardware-...
2
votes
2answers
2k views

Initialization of a LUKS encrypted partition with cipher or /dev/urandom

I've created a few encrypted devices with LUKS and cryptsetup on Linux and am pretty comfortable with disk encryption in this regard. I've seen it mentioned in many different places that when setting ...
2
votes
1answer
5k views

Another method to erase hard drives securely? [duplicate]

Possible Duplicate: Use truecrypt to make data unrecoverable The other day I was thinking, and I looked up this question because I was pretty sure a question similar to this had been asked. (I ...
2
votes
2answers
885 views

What does “if the Crypto Officer performs this operation” mean in this BitLocker security policy?

In the document Windows Server 2008 R2 BitLocker™ Drive Encryption Security Policy For FIPS 140-2 Validation, in the section 6.1.2 FIPS 140-2 Security Rules bullet point 2 it says: BitLocker™ will ...
2
votes
1answer
181 views

Is there any downside to having a VeraCrypt file container that is almost as big as the drive it's on?

I am setting up an external hard drive to backup several computers to, and I want to keep its contents private by using VeraCrypt. I don't want to encrypt the entire drive because then when it's ...
2
votes
1answer
2k views

What is the relationship between Windows BitLocker and Hasleo BitLocker Anywhere?

Whilst researching alternatives to BitLocker which work on Windows 10 Home, I came across a product called "BitLocker Anywhere" from Hasleo. Since they use such similar names I was trying to figure ...
2
votes
1answer
188 views

Is a TPM which boots a full-disk-encrypted computer to login secure?

Currently the laptops in use are encrypted using Pre-Boot-Authentication, so the entire disk is encrypted. A user has to enter a password before booting the operating system. A new concept suggests ...
2
votes
1answer
1k views

LUKS2 on-disk format specifications

The LUKS1 format has been available for a long time, and the format specifications are easy to find. Recently, LUKS2 has been released, which features a number of important changes, such as AEAD and ...
2
votes
2answers
770 views

Safety level of encrypting data with BitLocker?

Is it kind of impossible to decrypt data that is encrypted by BitLocker and data will be safe enough if my computer was stolen?
2
votes
4answers
12k views

VeraCrypt - Windows boots Automated Repair on UEFI/GPT

OK. So I used VeraCrypt to encrypt the system partition and now Windows boots its automated repair only. After the repair in what I think is Windows Recovery Environment I can choose to boot off USB ...
2
votes
1answer
7k views

How to crack encrypted disk (crypto-LUKS) in an efficient way?

I had a disk encrypted by crypto-LUKS but forgotten password. I read a question posted here. LUKS HDD Encryption crack But before that I want to know if there's some free software I can use to ...