So, let's say you have a notebook, and you encrypt the entire hard drive. Whenever you boot it's gonna ask for a password, meaning nobody can access your data without the password. On the other hand, what if your notebook got stolen whilst it was in sleep mode? Is there any protection that the encryption can offer?
Thanks
Once you're booted up the encryption key stays in memory. If they really wanted they could directly attach to the motherboard and extract the encryption key from memory. If you've encrypted your hard drive I would certainly hope you set your laptop up to require a password to log back in. If you have (and it's secure) then they can't run a program to steal the key. At that point they have two options, try to physically force the key out (through the motherboard) or reboot and hope it wasn't encrypted.
If you have hard drive encryption enabled and you DON'T have a password for your account (or it doesn't ask when waking up) or your password is weak and easily guessable, hard drive encryption won't help you much.
Full disk encryption is of no use if the PC is stolen when the key is in memory.
My favourite demonstration video of this is on security tube (a great resource); http://www.securitytube.net/Cold-Boot-Encryption-Attack-video.aspx
Cold boot attack demonstrations and a creative attack involving cooling ram, removing it from the laptop, plugging it in to another laptop, and reading the data on it. Have no illusions about "power off, ram loses data instantly". It's a fallacy; data decays gradually.
Hibernate mode can be made to be very secure, given that your resume device (ie swap device) is encrypted. You will be asked for the pre-boot passphrase after resuming from hibernation. I've tried it, and it works. Not susceptible to cold boot attacks either (well, not after the first minute or so).
Sleep mode is less secure; it does not dump its memory to swap when it goes to sleep. It can be made secure up to a point, in that you can require a password to unlock after resuming. However sleep mode is susceptible to cold boot attacks. Someone with physical access to the machine can find the key and get to your data.
So as a rule of thumb, providing your resume device (usually your swap device) is encrypted and requires a pre-boot passphrase, and that passphrase is secure:
Note that home directory encryption, like that offered by eCryptfs (as used by Ubuntu) does not encrypt your swap device. Not all so-called 'disk encryption' does either.
Note: on Windows the terminology is different. Your resume device is a 'hibernation file' on Windows, and your swap device is a 'page file'. But the above still applies: if these are both encrypted then hibernation should be safe.
Protect you account with a password then you would have to type the password when waking up the laptop from sleep mode. However, that does not protect you against a Cold boot attack.
But It's more important to secure Your network daemons, because exploiting them attacker can gain access easier then with Cold boot attack.
Note that encryption is not always associated with password protection and safe storage. You may have encryption and free access to the content at the same time.
For example I have a Thinkpad, it is well known the (Hitachi Travelstar) drive of such machine encrypt the content and cannot store them unencrypted, even if you have not activated the "HDD password" protection. Each unit has a unique encryption key.
The benefit, even without a password, is that you just change the encryption key and the content is not recoverable anymore, but the disk can be reused or thrown to the bin. It is now empty. It is a mean to format in a split second, without using DoD compliant sector erasure and random rewritings to ensure nothing can be recovered even by smart analysis of the magnetic field on the platters.
Well I would not be surprised that there are backdoors that Hitachi and similar manufacturers keeps secret, but this is out of reach of the regular criminal, you need to belong to the MI5 to use that. And usually you use an DOS application that keeps beeping, where lots of garbage hexa codes appear on a per character basis and on a computer with a lot of abstruse warning lights flashing randomly. You also need to wait several "ACCESS DENIED" before being successful, but fortunately there is no timeout for the next attempt.
