1

I've been trying to find an answer concerning whole-disc encryption and keep coming up short. Assuming PGP-disc, TruCrypt and so on work the same way, what happens when accessing data on an encrypted partition. And is there a difference on how this works if the "C" vs the "D" drive is/are encrypted.

For example, lets say I'm working on a Word Document. I'm trying to keep this data from prying eyes.

1) If my main HDD is encrypted, then Word, the OS and the word document are working in an encrypted 'container'. Does this protect someone from viewing the contents of the work... can someone with a virus or maybe OS cache or memory still have the file in unencrypted view? 2) If the data - not the app or OS - are in an unencrypted container is this different from above? 3) Would this only work if I use some sort of encrypted memory system (I think this is built-in to OS X and some Linux (w/ SE Linux or such) and maybe OpenBSD). How about Windows?
4) Or, is the only purpose of the encryption to prevent someone from walking away with the media holding the data from being able to read it without the passwords?

I'm not working on super secret information. It would just be nice to keep some electronic copies of important documents without some basic fear a trojan or someone stealing some data physically will work.

Sorry for length. I hope this helps others probably sharing the same question.

2 Answers 2

2

Whole disk encryption is to protect the data from someone who wouldn't have access to the system running. For example if you have an encrypted laptop at work, at the end of the day you decide to shutdown (power off the laptop). The data is safe. However, if you decide to leave the laptop booted so the LAN guys can push updates, then the encryption wouldn't help much if the cleaning person was a hacker because then only the operating system defenses would have to be defeated.

The same if you decide to store you files in an encrypted container. If you leave it unattended and unlocked or open, then there isn't any real security. If you close the encrypted file, and don't shutdown. Then the data will be safe, assuming any scratch file created were also in the encrypted container. Where you may get stuck is with the swap file, so if security is needed and memory isn't, you can turn that off.

As far as encrypted RAM and the non-Windows OS, I can't speak to that, but any malware that successfully penetrates your system will probably gain access to the data because you are using the system as well. All it would need to do is wait for you to decrypt the files and not get detected.

2
  • 1
    Encryption doesn't help if the cleaning person is a hacker, especially if the computer is turned off. Oct 3, 2010 at 23:13
  • Good point about there are attacks on full disk encryption. I agree it is key is retaining control of the system. If you lose control of the computer all bets are off. Also, I've heard of countries having cameras in the motel rooms usually over desks so they could see the keystrokes you type. So they don't even have to do anything hackery, just old school shoulder surfing. Oct 4, 2010 at 2:33
1

1) If my main HDD is encrypted, then Word, the OS and the word document are working in an encrypted 'container'. Does this protect someone from viewing the contents of the work... can someone with a virus or maybe OS cache or memory still have the file in unencrypted view?

Yes, any software (including a virus) running on the computer will have access to the files (as they are decrypted when the computer is running). It's not necessary to read the data from OS cache or memory, it can just be read from disk, as the OS will decrypt everything on the fly.

2) If the data - not the app or OS - are in an unencrypted container is this different from above?

Well, if the data is not encrypted then it's not safe anyway, so the question seems pointless.

3) Would this only work if I use some sort of encrypted memory system (I think this is built-in to OS X and some Linux (w/ SE Linux or such) and maybe OpenBSD). How about Windows?

I have never heard of "encrypted memory system". What is that supposed to be? There's no need to encrypt memory (i.e. RAM) - it will be gone once you turn off the computer. (Granted, there are so-called "cold boot attacks", but they are rather tricky to pull off).

4) Or, is the only purpose of the encryption to prevent someone from walking away with the media holding the data from being able to read it without the passwords?

Yes, exactly :-).

I'm not working on super secret information. It would just be nice to keep some electronic copies of important documents without some basic fear a trojan or someone stealing some data physically will work.

Full-disk encryption will not protect you from Trojans. While the OS is running, the encrypted container is "unlocked" (the encryption key, which you entered on booting, is available in memory), and any program can read the encrypted data (even steal the key).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .