Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Let me give you some backup story first: A computer technician challenged me to give him my laptop and ask him for any piece of information that I wanted to "hide" in my hard drive. He claimed that he would be able to retrieve anything, no matter what I do to hide it.

Since I do not appreciate absolute statements like: "and there is nothing you can do about it", I started thinking about this in my head. I realized that a very secure Operating System would not cut it, since he does not need to boot from this specific hard drive in order to find things in my hard drive.

The generic question here is:

Is there a way to completely secure all data in a hard disk? (I do not need detailed explanation on how to do it, I just need you to point me to a direction; I can read more about it myself)

Specifically, I suspect that I may need:

  • An Operating System that is very secure and possibly encrypts all the data that it stores (no idea if such thing even exists).

  • If the above does not exist, is there a way to manually encrypt the data in my hard drive and still be able to boot from that hard drive?

In general, I want to make the hard drive as least accessible as possible to anyone that is not me (= knows a specific password/key), so any solutions are welcome.

share|improve this question

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

35  
Encrypt it and require a strong password or an encryption key that you have on a USB stick to decrypt. He just lost the game. You could probably just create a password protected RAR file with a strong password. Sorry to say, but I can smell his naïve adolescent attitude from here. –  Daniel Andersson Apr 26 '12 at 9:42
6  
It's a trick! If he is worth to be called a computer technician, then he probably just wants to prepare some pranks –  bytesum Apr 26 '12 at 10:25
14  
3  
implant it in your body and have it vibrate uncomfortably when it's in use... –  ratchet freak Apr 26 '12 at 18:03
3  
Give him a laptop with a completely randomized hard drive data and challenge him to find the secret message hidden within. If you can derive a message from this stream of bits and some secret key, this is technically encryption (feasible with OTP as well as any stream cipher), and has the advantage of being somewhat subpoena resistant, as you can keep a dummy key which will decrypt to something harmless. –  Thomas Apr 26 '12 at 20:41

14 Answers 14

up vote 63 down vote accepted

It's enough to encrypt most sensitive files. A ZIP file encrypted with AES 256-bit and a good long password is nigh impossible to get into without the password. (Avoid using the legacy ZIP encryption known as PKZIP stream cipher/ZipCrypto - it is known to be weak.)

It's also possible to encrypt a whole partition, hiding everything in it. Truecrypt is kind of the de facto standard program for home (and some business) partition/image encryption. Probably the best thing about Truecrypt compared to tools built-in to the operating system is it's portable: there's a version for Windows, Mac OS X and Linux, which makes up the vast majority of consumer operating systems.

If you want to hide everything, you can encrypt the every partition in your system, including the one you boot from. It is not possible to read data from an encrypted drive without knowing the password/key. Thing is, the Windows operating system doesn't always support booting from an encrypted hard drive.* Truecrypt has what it calls system encryption. They've summarised it pretty well:

System encryption involves pre-boot authentication, which means that anyone who wants to gain access and use the encrypted system, read and write files stored on the system drive, etc., will need to enter the correct password each time before Windows boots (starts). Pre-boot authentication is handled by the TrueCrypt Boot Loader, which resides in the first track of the boot drive and on the TrueCrypt Rescue Disk.

So the Truecrypt boot loader will load before your OS and prompt you for your password. When you enter the correct password, it will load the OS bootloader. The hard drive is encrypted at all times, so even a bootable CD won't be able to read any useful data off it.

It's also not that hard to encrypt/decrypt an existing system:

Note that TrueCrypt can encrypt an existing unencrypted system partition/drive in-place while the operating system is running (while the system is being encrypted, you can use your computer as usual without any restrictions). Likewise, a TrueCrypt-encrypted system partition/drive can be decrypted in-place while the operating system is running. You can interrupt the process of encryption or decryption anytime, leave the partition/drive partially unencrypted, restart or shut down the computer, and then resume the process, which will continue from the point it was stopped.


*Various other operating systems support system drive encryption. For example, Linux kernel 2.6 and newer have dm-crypt, and Mac OS X 10.7 and newer have FileVault 2. Windows has such support with BitLocker, but only in Enterprise/Business/Server editions, and only in Vista and newer. As stated above, Truecrypt is more portable, but often lacks the integration necessary to encrypt system drives, Windows being the exception.

share|improve this answer
4  
True crypt is what I have used and very happy with it –  Rippo Apr 26 '12 at 14:50
4  
One caveat when encrypting an existing unencrypted drive: if it's solid state, it may not be re-writing over the same sectors, because it varies them to extend the disk's life. So data on a solid state drive is really only safe if it was encrypted from the start. –  Nathan Long Apr 26 '12 at 18:40
11  
"Thing is, most operating systems don't natively support booting from an encrypted hard drive." -- that isn't even remotely true. Windows has BitLocker, Mac has FileVault 2. –  josh3736 Apr 26 '12 at 18:53
9  
@Josh: Those are the operating systems with the most users, not most operating systems. –  Ben Voigt Apr 26 '12 at 22:14
4  
@BenVoigt, that's a bit of a ridiculous argument to make. "Sure, the OSes used on 3/4 of desktops natively support FDE, but BeOS doesn't!" –  josh3736 Apr 26 '12 at 22:41

One phrase - Full Disk Encryption, preferably with a a nice, long, non dictionary key. You might also look at systems that do this with an external keyfile. Basically, since the entire system other than the bootloader is encrypted, short of a direct memory access attack - that is to say use a firewire or other device that has DMA to get memory contents and or to use a cold boot attack to get information. Twarting this is simple - just make sure the system is switched off, and battery removed just before you hand over the system. If its just a hard drive, both these attacks are improbable

I'd probably just give truecrypt a shot, use a VERY long, random password (length makes brute forcing harder, and randomness prevents a dictionary attack), and let him go to town with it. Alternately, some versions of windows have bitlocker - which is a strong FDE option built into windows. Likewise there's solutions for linux like luks and dmcrypt.

Or fill a disk with random data... and see how long before he figures it out ;)

share|improve this answer
68  
+1 Or fill a disk with random data. oh yes –  Tog Apr 26 '12 at 10:00
    
+1 Haha that would be awesome –  Paulpro Apr 26 '12 at 15:29
1  
Ah, random data :D Just like that bit in Cryptonomicon (more detailed reference not included cause it'd spoil one of the fun bits..) –  tanantish Apr 26 '12 at 19:31

Don't fall for any tricks like, "give me the password so I can check the results".

A security conference I went to asked for passwords at the beginning. Halfway through and the presenter said the biggest security risk is YOU, as most people had given out their password feeely.

(And yes, just encrypt the relevant data.)

share|improve this answer

You could "hide" the file within an image? This might throw him off - or at least take him a little bit of time to figure out. Possibly.

http://lifehacker.com/282119/hide-files-inside-of-jpeg-images

share|improve this answer
2  
Or even inside program binaries crazyboy.com/hydan –  Dan D. Apr 26 '12 at 10:09
17  
This is otherwise known as steganography. –  hydroparadise Apr 26 '12 at 15:26
4  
Or security through obscurity? –  vsz Apr 27 '12 at 11:35

I agree with the other TrueCrypt answer. However, I have one important point to add - the plausible deniability feature of TrueCrypt. What that means is that TrueCrypt doesn't leave any positively identifiable signatures on the disks/files it encrypts. So, nobody can prove whether a set of bits on disk are random bits or encrypted data. This is so important that it had implications in a recent court case.

share|improve this answer
    
I would be interested to know what court case that was. –  hydroparadise Apr 27 '12 at 17:17
3  
Here's the link ca11.uscourts.gov/opinions/ops/201112268.pdf Gist: TrueCrypt users cannot be compelled to divulge their passwords. 5th amendment applies. –  slowpoison Apr 27 '12 at 17:41

Interesting that the word hide has to be put in quotes by many people, since they seem to know that nothing is actually being hidden in their suggestions. I wonder if that computer technician held his hands in the air and made the hand motions associated with quotation marks when he said "hide" as well.

I doubt it. While encrypting things can prevent access, having an encrypted zip file sitting on your desktop called "Nothing_to_see_here.zip" isn't really hiding anything.

Some laptops come with the ability to password protect the drive, where once it is enabled through the bios you have two options... enter the password or format the drive. Dell is one of those companies that includes this function. Ok. You can ALSO call Dell after you have put in the wrong password 3 times, and you can give them the challenge code presented on your screen and they will give you the response code to bypass the password... but they also charge for that service if your warranty has expired. Again... this is not hiding anything.

There is a world of difference between allowing someone access to a room so they can search for something tucked out of sight (hiding), and just barring them from entering altogether (encryption).

Since I do not appreciate absolute statements like: "and there is nothing you can do about it"

No. You did not like this technician essentially telling you that he knew something you did not, and/or that he was better than you at something. This is why you immediately tried to think of how to better this technician, instead of actually realizing that what he was saying means nothing! It would not have hurt you in the least to have admitted right there and then that maybe he actually could FIND any file you had HIDDEN. Of course, you would have needed to have him define what hiding means in this context... since (again) it seems that "hidden" apparently means different things to different people. Regardless, your issue with his challenge has nothing to do with his boast, and everything to do with your inability to accept the possibility that he might actually be better than you at something. This is why you could not leave the challenge alone. This is why you do not appreciate absolute statements like that. Because the truth is, there are times when things will happen in your life and there WILL BE NOTHING YOU CAN DO ABOUT IT.

You want a way to keep files you access regularly from being found? Keep them off your computer. How about that? Store them on a flash drive. Then, you can keep the files on your person at all times, and no one can access your laptop to get them when you are not near your laptop. Who made the stupid rule that all your files have to stay on your laptop at all times? I'm not talking about this technicians childish boasting and whatever game you have turned this into. Once you encrypt the file, or hide it in an image, or remove it from your computer onto a flash drive, then his game is over. Why? Because you did not get the parameters of this challenge defined... and I can guess what they are.

  • The file has to be somewhere accessible.
  • You need to play the role of the ignorant fool who thinks that just sticking a file in some directory off the beaten path is the extent of being able to be hidden.

Once you step away from either of these, the game is over, and you "did not understand what he meant".

share|improve this answer
4  
But if you lose the flash drive or leave it behind somewhere? Oh dear... By the way, he said hide information, not files.. subtle difference, since encrypted information is essentially hidden. And it's theoretically possible to break any encryption. –  Bob Apr 26 '12 at 12:40
1  
Someone says I can find you anywhere you hide if we play Hide and Seek... and this pisses you off so much that you have to change the game to TAG where they need to touch you in order to win. What if your hard drive crashes... Oh Dear. And encrypted information is locked away, not hidden. If you need a key, it is locked. If he found the encrypted file, does that mean he found the information? Did he ever say he had to be able to VIEW the information, or just FIND it? –  Bon Gart Apr 26 '12 at 12:56
3  
A piece of information != a file. Information would be gained by reading the contents of a file. Having the file but not being able to read it means the information inside is still hidden. –  Yamikuronue Apr 26 '12 at 13:34
    
I get it that you and Bob feel that "information" does not equal "file". Tell me. What exactly did the computer technician in this question think information meant? Did he mean to say "file"? Does he equate the two? You don't need super encryption. You could simply break this "information" down into small chunks, convert it to hex, and create directories in C:\Windows named those hex chunks. If you make them 32 characters long, they will appear to be normal directories. Only you know that if you translate the names back you have your information. –  Bon Gart Apr 26 '12 at 18:15
    
But since the TITLE of the question is "Is there a way to make my hard drive inaccessible to everyone but me?" then for the purpose of this discussion, information DOES EQUAL file. –  Bon Gart Apr 26 '12 at 18:15

Many of the answers posted are good answers.

As an addition, you may want to look at an asynchronous asymmetric encryption tool like GnuPG. It's a bit more complicated than encrypting within a ZIP file because you are dealing with public and private keys. I think I might of heard of some University in Europe cracking this type encryption with very special circumstances. You would still want to put the passwords and keys on a usb drive, or somewhere other than the drive you will be giving the challenger.

Additionally, I once had a professor tell me that if you want something absolutely hidden, re-encrypt the encrypted file with a new set of keys. That way, if the first level encryption is somehow decyphered, the attacker wouldn't know it because everything would still appear encrypted.

Hope this helps.

share|improve this answer
3  
"I once had a professor tell me that if you want something absolutely hidden, re-encrypt the encrypted file with a new set of keys." is wrong for most cryptosystems. Consider ROTn. Encrypting ROTn(ROTm(x))=ROT{m+n}(X). The attacker won't even realize you did ROTn(ROTm(x)) but instead directly try to figure out m+n. There is no added security. –  emory Apr 26 '12 at 15:45
1  
@emory Interesting to note. Guess professors are people too. I think I understand what you are getting at. I'll check into that. –  hydroparadise Apr 26 '12 at 16:13
    
GnuPG is not asynchronous, it's assymetric (in its default mode). It also supports conventional (symmetric, same-key) encryption. –  Michael Kjörling Apr 27 '12 at 7:53
3  
Also, I imagine that the professor was referring to encryption algorithms a little more sophisticated than simple substitution ciphers. If you take a plaintext P, then encrypt it with (say) AES first with key K1 and then encrypt the resulting ciphertext with AES and a different key K2 (C = AES( AES(P,K1), K2 ), K1 ≠ K2) the resulting ciphertext will not have any resemblence to, say, the output of AES(AES(P,K2),K1) (key order reversal). This property does not hold for simple substitution ciphers such as ROTn. –  Michael Kjörling Apr 27 '12 at 7:57
    
@MichaelKjörling Thanks for the correction on asymmetric. I knew it was a-something, and sometimes I struggle my recall. ;) –  hydroparadise Apr 27 '12 at 12:35

Alternate data streams are a funny thing to throw at him.

share|improve this answer

Then take the challenge, someone already told you, create a file, put the file you want to "hide" inside a RAR or 7-Zip file, with full encryption so he can't check which files are inside the compressed file. Use a strong password with numbers, alphabet and symbols. Then erase the original file with some tool like Secure Delete (or a similar tool).

Done, now he can't do almost nothing to do.

share|improve this answer

I use TrueCrypt virtual drives that are secured by both very long passwords, and keyfiles stored on a usb. I also initiate timeouts on open virtual drives when activity is absent for a given time. Been using this type of security for years. I process very large databases with within those virtual drives without any performance issues.

share|improve this answer
    
Are you using a CPU with hardware support for AES, such as intel Sandy Bridge? –  drxzcl Apr 29 '12 at 8:47

Ubuntu provides home drive encryption which is quite secure.. I had to struggle to recover my own data even though I knew my own key.. information about home drive encryption can be found here :

share|improve this answer

Encryption is useless against subpoenas and/or torture. All computer tech has to do is allege perhaps anonymously that the file that Nothing_to_see_here.zip is full of kiddie porn. The FBI will seize it from his shop and demand the password. He will tell them it is your computer.

There will be some legal maneuvering. You will either wind up in jail or remain free. Either way, computer tech has learned something interesting about your secret file.

Alternatively, he could allege some problem with the laptop that needs an $x repair. Your authorization or lack of authorization of the repair will tell him something about the economic value of Nothing_to_see_here.zip to you.

share|improve this answer
2  
Looks like the 5th amendment in the US might protect you from not giving out your password outsidethebeltway.com/… this one specifically mentions TrueCrypt privacycast.com/… –  Matthew Lock Apr 27 '12 at 4:09

If you want the highest level of security, something even governments can't legally force you to address, look at TrueCrypt. With TrueCrypt you can actually turn empty space into a mounted partition. As such, if the system is inspected it should just look like old data headers, something you would see on every hard drive out there that has ever deleted data. Since there is no evidence of data there that's usable, legible, or recoverable, you are not legally obligated to provide access to said data. It also utilizes encrypted passwords of many levels and substantial performance too.

share|improve this answer

in short: No. Everything you can do could be done by someone else too. If there is a lock, there is a key.

share|improve this answer
2  
Here's a case where TrueCrypt was unable to be unlocked en.wikipedia.org/wiki/TrueCrypt#Operation_Satyagraha even with the FBI's involvement –  Matthew Lock Apr 27 '12 at 4:15
    
There's a key, yes, it's theoretically possible to find the key, yes, but is it practically possible to find the key? If its a well hidden/good (password) key, no. With an exceptional key for extremely sensitive data? Say you have a password string 20 characters long, with a character set of every possible character in a standard US keyboard and no dictionary words... that's 3.0x10^39 possible combinations, several orders of magnitude greater than an estimated lifetime of the universe in picoseconds. –  Bob Apr 27 '12 at 13:42

protected by nhinkle Apr 27 '12 at 0:46

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.