Breaching Disk Encryption

April 7, 2008 in Encryption, Forensics with 1 Comment

Many of the latest operating systems including Windows Vista, Mac OS 10, and Linux now offer disk encryption to protect data against laptops and devices that are stolen or ‘prying’ eyes. There is an excellent open source disk encryption tool I have used for years called Truecrypt which is cross compatible for Linux and Windows. Disk encryption often presents a problem for law enforcement during an investigation. With the proliferation of build in disk encryption this problem is exasperated.

Some really cool research done by Princeton University on defeating these forms of disk encryption was published. The paper gets quite technical into key reconstruction and other related math, but the blog entry has a video that shows a recovery procedure, including the use of off the shelf products to sufficiently cool memory to permit data extraction.

I am going to have to try this out on my laptop.

  • Shawn McEwen

    We are noticing a great deal of pain from traditional I.T organizations that need to deal with enforcing security policies, over-the-air encryption at it impacts compliance without bandwidth limitations. This becomes an even bigger headache with multiple device types like palm, blackberry and smartphones come into play. The following whitepaper offers additional insight into both full disk encryption and file encryption technologies.

    http://www.sybase.com/detail?id=1054752