Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

So, let's say you have a notebook, and you encrypt the entire hard drive. Whenever you boot it's gonna ask for a password, meaning nobody can access your data without the password. On the other hand, what if your notebook got stolen whilst it was in sleep mode? Is there any protection that the encryption can offer?

Thanks

share|improve this question
2  
Subjective, community wiki. –  Xavierjazz Jan 11 '10 at 21:39
4  
If you've encrypted your harddrive and are putting your laptop into sleep without requiring a password on wake, you're wasting your time. It's like buying an expensive alarm system for your house and not arming it - you have to do it right for it to protect you. –  Jared Harley Jan 11 '10 at 21:47
    
@Xavierjazz my "objective" answer is Full Hard Drive Encryption isn't 100% save (but what is?) but it IS useful. –  Maciek Sawicki Jan 11 '10 at 21:58
add comment

5 Answers

up vote 7 down vote accepted

Once you're booted up the encryption key stays in memory. If they really wanted they could directly attach to the motherboard and extract the encryption key from memory. If you've encrypted your hard drive I would certainly hope you set your laptop up to require a password to log back in. If you have (and it's secure) then they can't run a program to steal the key. At that point they have two options, try to physically force the key out (through the motherboard) or reboot and hope it wasn't encrypted.

If you have hard drive encryption enabled and you DON'T have a password for your account (or it doesn't ask when waking up) or your password is weak and easily guessable, hard drive encryption won't help you much.

share|improve this answer
1  
I don't think a logon password means anything really. If the key is in memory on a running machine in the hands of an attacker it can be obtained. –  RJFalconer Jan 11 '10 at 21:34
3  
Yes and no, if the attacker cannot log in to run a program the only option is to physically access the memory. Not having a password (and running as administrator!) leaves you wide open to attacks (both software and hardware based. –  Joshua Jan 11 '10 at 21:36
1  
Many computers can have their memory accessed directly over Firewire nakedsecurity.sophos.com/2012/02/02/filevault-encryption-broken –  Stephen Holiday Jan 23 '13 at 17:55
add comment

Full disk encryption is of no use if the PC is stolen when the key is in memory.

My favourite demonstration video of this is on security tube (a great resource); http://www.securitytube.net/Cold-Boot-Encryption-Attack-video.aspx

Cold boot attack demonstrations and a creative attack involving cooling ram, removing it from the laptop, plugging it in to another laptop, and reading the data on it. Have no illusions about "power off, ram loses data instantly". It's a fallacy; data decays gradually.

share|improve this answer
3  
Ok, but how many laptop thieves can do that? And You can simply protect again that attack (by thieves, not Police) - just use Your laptop with out battery (only on AC power). –  Maciek Sawicki Jan 11 '10 at 21:51
1  
Then the thief takes the laptop, and it powers off. Now he simply has less time to recover the key. The question was "how useful is disk encryption?", with special interest in if the laptop is stolen when in sleep mode. The answer is "No use". –  RJFalconer Jan 11 '10 at 22:17
add comment

Hibernate mode can be made to be very secure, given that your resume device (ie swap device) is encrypted. You will be asked for the pre-boot passphrase after resuming from hibernation. I've tried it, and it works. Not susceptible to cold boot attacks either (well, not after the first minute or so).

Sleep mode is less secure; it does not dump its memory to swap when it goes to sleep. It can be made secure up to a point, in that you can require a password to unlock after resuming. However sleep mode is susceptible to cold boot attacks. Someone with physical access to the machine can find the key and get to your data.

So as a rule of thumb, providing your resume device (usually your swap device) is encrypted and requires a pre-boot passphrase, and that passphrase is secure:

  • Hibernating is quite secure
  • Sleeping (suspend to RAM) is less secure

Note that home directory encryption, like that offered by eCryptfs (as used by Ubuntu) does not encrypt your swap device. Not all so-called 'disk encryption' does either.

Note: on Windows the terminology is different. Your resume device is a 'hibernation file' on Windows, and your swap device is a 'page file'. But the above still applies: if these are both encrypted then hibernation should be safe.

share|improve this answer
add comment

Protect you account with a password then you would have to type the password when waking up the laptop from sleep mode. However, that does not protect you against a Cold boot attack.

But It's more important to secure Your network daemons, because exploiting them attacker can gain access easier then with Cold boot attack.

share|improve this answer
add comment

Note that encryption is not always associated with password protection and safe storage. You may have encryption and free access to the content at the same time.

For example I have a Thinkpad, it is well known the (Hitachi Travelstar) drive of such machine encrypt the content and cannot store them unencrypted, even if you have not activated the "HDD password" protection. Each unit has a unique encryption key.

The benefit, even without a password, is that you just change the encryption key and the content is not recoverable anymore, but the disk can be reused or thrown to the bin. It is now empty. It is a mean to format in a split second, without using DoD compliant sector erasure and random rewritings to ensure nothing can be recovered even by smart analysis of the magnetic field on the platters.

Well I would not be surprised that there are backdoors that Hitachi and similar manufacturers keeps secret, but this is out of reach of the regular criminal, you need to belong to the MI5 to use that. And usually you use an DOS application that keeps beeping, where lots of garbage hexa codes appear on a per character basis and on a computer with a lot of abstruse warning lights flashing randomly. You also need to wait several "ACCESS DENIED" before being successful, but fortunately there is no timeout for the next attempt.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.