3

I want to create an AES256 encrypted zip of a folder. I am on Mac and I want to create the zip file and store it in an external drive. I want to AES256 encrypt the file in case I lose the external drive, no one can read it.

I am using the command

7za a -tzip '-pPASSWORD' -mem=AES256 personal_data.zip /Users/myuser/personal_data

The directory /Users/myuser/personal_data has subfolders and files inside it.

When I extract, the directory structure is non retained and it extracts all the content, at the root of place where I extract.

I use below command to extract.

7za e personal_data.zip

I have two questions:

  1. How can I maintain the directory structure when it extracts?
  2. Is this the most secure way to store a Zip file with sensitive content on the personal system?

Thank you

3

Well first,
e Extract files from archive (without using directory names)
so you want to use
x eXtract files with full paths
instead to extract.

[I'm assuming the debian & mac versions of 7za are equivalent.]


It's definitely not the most secure method, for one your password could be getting stored in your .history file, or be easily visible from a process listing showing the full command line.

And 7z isn't an encryption / security program. Even if it does use AES256 competently, it might not be picking suitable random numbers, or could be making any number of seemingly tiny mistakes that drastically lower security. Look into using GPG instead (you can pipe into/out of it, as in tar ...|gpg... 7z can pipe in or out too but may have some trouble doing both at the same time).

Or an on-the-fly encryption like LUKS, or eCryptfs, or EncFS (maybe older, maybe unsupported, still appears functional), or even TrueCrypt/VeraCrypt, there's probably some mac-specific software too. Then you don't have to worry about unencrypted files, or their remnants lying around after deletion.

  • Thank you x worked. I am planning to create an encrypted zip file and store it in external hard-drive. Do you still think, 7za way of saving file won't be safe? I get your point of .history. I will read about other options you suggested. Thank you. – user2230605 Jun 17 '18 at 7:03
  • Depends on your threat model. It could be "safe enough", should easily stop nosy friends & family, probably businesses, but gpg has stumped the biggest governments. The biggest threat IMO with storing an archive that has to be extracted to view is managing the unencrypted data, undeleting files from a drive is easy, and flash drives might quietly swap sectors making real overwriting impossible to verify (and overwriting/shreding doesn't always work on a hard drive either) – Xen2050 Jun 17 '18 at 7:11
  • I'd encrypt the entire external drive with LUKS or VeraCrypt (or even a combination for the paranoid, LUKS can be stacked [encrypt a LUKS device with LUKS again] and I think they can stack together too). Then the entire drive (or just a few partitions) is covered in case of loss/theft, and no unencrypted or undelete-able files are lying around either. – Xen2050 Jun 17 '18 at 7:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.