|
 Encryption Solutions
|
Please note, that the Knowledge Base isn't translated to english completely at the moment. You will still find some german texts - we are translating permanently the outstanding parts! Thank you for understanding! |
Problem areas of encryption |
| |
|
|
|
Using encryption, you have to consider, that information can be found at other places while processing respektive in its lifecycle. There are copies of the file in temporary folder, in swap-files or paging-files, in the RAM-data on the disk in hibernation mode or the recycle-bin. Additional data can be disclosed with forensic techniques from file slacks.
|
Temporary files |
Commercial software packages create temporary files to store data while a file is open, often to store a copy of the original in the event of unanticipated shutdowns. While these files are extremely useful, the files also pose a security risk if not encrypted when created and filled with sensitive data.
|
Paging files |
Paging files are used extensively in modern operating systems. The purpose of paging files is when memory resources run low, it automatically writes data onto the hard disk into the paging files. As soon as the application is needed again, the operating system copies the data back into memory, and places another applications’ data in storage. The operating system puts everything onto the hard disk, including plain text copies of sensitive data is supposedly secure.
|
Recycle bin |
When a file is deleted, Windows removes it and places it in the recycle bin. Until the recycle bin is emptied, the user can still retrieve the file. However, when the recycle bin is emptied and Windows shows the file no longer exists, the physical data remains on the disk. The deleted information can easily be found and read with inexpensive utility software.
|
Windows Registry |
Microsoft Windows and most application software, store various data in the Windows registry. A web browser might save the domain name of the sites you visited in the Windows registry. But also the unauthorised manipulation leads to a security compromise, the commercial ERD Commander from Winternals, can change the registry and reset the admin password of the targeted computer.
|
Hibernation and sleep mode |
Hibernation or Sleep Mode is often found on laptop computers to conserve battery power when a computer. When a notebook computer goes into hibernation mode, it saves all its RAM memory data to the hard disk. By allowing the PC to re-create the exact state of the computer from before, it entered hibernation mode. Of course, all data in memory at one time, for instance program files and sensitive data is stored on the disk.
|
File Slacks |
Windows file systems arrange data in clusters, which are made up of one or more (up to 64) sectors. A file might only be a few bytes long; nevertheless, it will occupy a whole cluster. The last sector of a file contains random data collected from RAM at the time the file is saved, which can contain passwords, and private keys. The last cluster of a file can contain very sensitive data, including random data from RAM, data from files such as email messages and word processing documents that were previously stored in the remaining sectors left in the cluster. There are forensic tools
, which can recover data by forensic data recovery techniques.
|
Hidden partition |
A hidden partition is a portion of the hard disk an operating system does not recognize or display a file system for. Software applications sometimes use these hidden partitions to save data.
|
|
|
|
|
|
|
|
|
|
|
Legal notice
