Red Hat / Fedora :: Full Disk Encryption DD - How To Access Data In DD File
Feb 12, 2010
I am investigating full disk encryption and have made a DD copy of the hard drive which has been encrypted, this DD file is stored on my computer for analysis.
First question is - Anyone know how i can access data in this DD file even though its been encrypted?
Second question - Is there a DD command where i can image the systems memory? I ask this because when a system is turned on, to get past the pre-boot authentication stage you need a password. From what i understand, this password will be passed in to ram when power is applied to the system. Making a copy of the memory will also copy the password?
The only reason why I don't use Linux (even though I prefer Linux over Windows, and can do everything faster and more efficiently) is because each time I try to learn about dm-crypt I give up.
Can someone point me in the right direction for full OTFE on Linux (like TrueCrypt)?
I do know about cold boot attacks. But I ran across a couple of posts/websites that had me wonder if it is possible, without the passphrase, to just remove the encryption?
I would like to configure my Debian Jessie system in this way.
Two partitions:
1) /boot on /dev/sda1 2) everything else on /dev/sda2
I want to encrypt the second partition with LUKS. And then install over it a LVM volume. Inside the LVM volume i will create the / (root), /var, /opt and /home virtual partitions. In this way, i'll get asked only once for the password to decrypt all partitions. Because if i don't use LVM, then i'll get asked for the password for each encrypted partition.
I can follow and understand almost everything of this HOW-TO for Archlinux: [URL] ....
Only two passages are unclear to me:
1) Configuring mkinitcpio
I don't understand what i should do here in order to complete this. What should i do in Debian to configure "mkinitcpio"? what is the equivalent thing to do here?
I thought that the kernel would automatically recompile itself with all installed modules on the Debian system, once cryptosetup/LUKS or LVM2 get installed.
2) Configuring the boot loader
I don't understand what should i write in /etc/default/grub. Will GRUB automatically load the LUKS and LVM2 modules? Also, I don't think that i could boot the system in this way:
With all the talk about disk encryption for Apple devices, I wanted to ask about how full disk encryption compares between debian linux and mac OS X. Is the code for debian linux fully available for people to inspect for flaws or backdoors? Apparently although part of the encryption code is available for OS X the full code for Filevault 2 is not public. What are the advantages and disadvantages of each method of encryption for each operating system?
I have a bunch of pictures that I thought I had backed up but as it turns out I didn't, the problem is I formatted the drive they were on.
It is a 1TB hard drive, and it was running Ubuntu 10.10 using full disk encryption from the alternate install CD. After formatting, I installed Ubuntu Server 10.10, also using full disk encryption.
I know the encryption key for both installs (and the keys in fact are the same).
I have turned off the machine, and have stopped writing to the disk. I am hoping because it is a 1TB drive, and I have only written over it with 2GB of data, that there is a chance I can recover the data.
I managed to get a cheap refurbed netbook recently (Samsung N150) and I'm wanting to put Ubuntu on it. As it's also likely to be used when travelling and have things like chat logs, photos, and other such things I'd like to do full disk encryption. Also I've been pointed towards 10.4 as apparently the 10.10 netbook desktop isn't to everyone's taste.
So I tried using unetbootin to make a bootable 10.4.1 i386 Alternate usb stick, which hit the problem of no cd drive. I found an item to add to the boot (cdrom-detect/try-usb=true) which got it a little further, but at a copying stage it threw an error saying it couldn't copy off the disc.
Finally I tried making a unetbootin of the mini iso (does mini even support full disk encryption?) but that seems to hang after selecting a mirror.
EDIT: Well it seems I was just impatient on the mini ISO and after a few minutes it's gone onto time-zone, though of course this could get rather tiresome without a local mirror, especially given this may go through more than one iteration.
Is there a way to install ubuntu 10.04 or 10.10 with full disk encryption? I read how to do it in the 8.0 version, was wondering if it is still possible?
this isn't really a security question, per se, so feel free to move. It is related to full disk LVM encryption though. Full disk didn't work for me with grub2 after running dd to a remote server, so I downgraded to grub1. No biggie. However, I have neither grub or grub2 as selected in Synaptic.Let's say I forget which I have installed. How would I determine what version of grub is installed at the moment. I'm assuming it's somehow installed on in the mbr but not on the OS. I didn't mean to do anything funky. Is that the normal setup? I'm deploying these systems to users and want to be able to troubleshoot issues in the future (hopefully that will not be needed!) grub --version does not work because it is not installed.
I've been wanting to do this for a while and after upgrading some of my pc components I decided I would finally try to dual boot with full disk encryption on both windows 7 and Ubuntu 9.10. I managed to encrypt the windows drive with truecrypt and that worked. I installed Ubuntu 9.10 using the alternate cd and everything but /boot is in an encrypted LVM. Each OS is on a separate SATA drive the windows is on sda1 and ubuntu /boot is sdb1.
To setup the dual boot I started out following the tutorial [url] but its for XP and versions of ubuntu that use grub not grub 2. I ran dd as posted and saved the files it produced from truecrypt. I then ran into some problems with grub reinstallation so I simply reinstalled Ubuntu 9.10 from scratch again. This put grub 2 on the computer. I've managed to get it to add a Windows 7 option.
However, when the option is selected truecrypt comes up and says that the bootloader is corrupted and that I need to use the repair CD I burned before I encrypted the drive. My question is does anyone have any experience dual booting using Truecrypt on Windows 7 and LUKS/dm-crypt on Ubuntu 9.10 with grub 2? And how would I get the boot menu to work? I'd rather not reinstall but if I have to I have images from right before I encrypted so it wouldn't be the end of the world.
To structure the layout of my partitions. I'm installing Windows 7, Backtrack 4 R2 and Ubuntu 10.10 Desktop on my laptop. I've got a 500 GB HDD named sda.
I've already installed Windows 7. It's my opinion that it's easiest to begin with Windows.
The partitions look like this right now:
The Windows installation is unencrypted and I want it to stay that way. It's only there in case my laptop gets stolen, I've installed various nasty things there.
The Backtrack 4 installation will also be given 100 GB space, I want it to be encrypted. The Ubuntu installation should get the rest of all the remaining space and preferably be encrypted but it's not 100% necessary.
How I should partition this? There's a limit on 4 primary partitions? How do I circumvent this? There should be one dedicated GRUB partition which will point to each of the installations own boot loaders?
We purchased a new database system at work last October, ditching the old system because of a lack of support from the vendor. This is a retail Point of Sale and Backoffice database system. I am not sure what system the new one runs on, but the system we replaced was a Firebird data base. The reason I am posting is because we are now in need of the information contained in the old database which was not completely imported into the new system.
Basically the problem is this: The database in on a Windows XP system and I found a copy of SQL Manager Lite 2008 on the system, which after quite a bit of studying, I figured out how to extract the database into a removable file. I have this file (178MB) on a USB stick in a file called Backoffice.fbd.
My studying suggests to me that I can get into this database with MySQL. I have never used this and have no clue how to do this. All I want to be able to do get into the database and create tab deliminated spreadsheet files for each of the database sections (Customers, Repairs, Sales History, stock files, etc.) Is it possible to do this with Ubuntu and MySQL and if so, can expert suggest one or two things to get me started. While a guided tutorial would be nice because I am not an expert, I am willing to learn on my own if someone could point me in the right direction.
1. Fedora 14 has a user friendly disk encryption setup.However, there doesn't seem to be an option to change the encryption parameters during setup. Since I can handle the overhead, I would like to change the encryption algorithm and the key length for the default install.
2. I have created an additional encrypted drive (the entire HD) which claims to have its own encryption functionality (Seagate Constellation 1TB). Does Fedora use the built-in encryption mechanism by default? Is there any way to tell?
3. I can't seem to find any utility to tell me what the actual key size is for different HD's I have encrypted. "cryptsetup --help" seems to print out only the information for the default encrypted O/S which is the default 256 bit.
My problem is whether the -s option work when set to a 2,048 bit key length? Or, does it fall back to a 256 bit key length if it fails to do so? Or, does it automatically use the built-in encryption of the hardware? If the -s option doesn't work with a 2,048 bit key setting, can the kernel be recompiled to do so?
I am trying to access data that is on a Raid 5 array in Ubuntu... There are 4 installed disks (250gig disks) - 3 of which are setup as a Raid 5 array (the 4th is active but unused). These show up as one large drive (498gig). I have had an issue with the drive where it is no longer allowing Windows to boot - I receive a disk read error on boot (so the OS does not load, obviously!) - what happened was basically I unplugged then replugged in one of the disks which affected the array... I physically reconnected everything as it was, I then had to 'reactivate' the disk in the Raid BIOS... at that point the array seemed OK, was the right size, etc (and was listed as "Optimal" in the Raid BIOS) however, the problem with the disk read error persists.
I have started the machine using Ubuntu v9.10 from a CD (non-destructive mode) and it shows a disk of the right size (ie: on the desktop and in Nautilus it says "498gig Filesystem" ). However, in Nautilus, the disk appears empty with no folders or files on it (even with hidden files shown).... If I view 'Information" for the disk it shows 67gig used space and 399gig free space (which is correct). Also, if I view the disk in Gparted, it shows a disk with about 67gig of used space and 399 free space on a 464gig disk (with 8gig unallocated). One more thing.... when I try the command 'sudo dmraid -tay' it says that there is no raid disk (there are in fact, no drives plugged into IDE or SATA slots - all disk are plugged into the RAID controller card). Anyway, at this stage, I just want to copy the data to a single hard disk if possible and move on.
I was trying to install Fedora 9 on my new laptop that came with Win XP. I have selected the option to wipe out all partition and create a default layout with the Encryption option selected. But that installation got stopped on the middle, therefore I have started the installation again. This time it asked for the encryption password as expected but don't know why, its not accepting my password. I am 100% sure that the password is correct but it is not allowing me to enter into the hard disk partition section.
My question is, how do I remove encryption from my hard disk? I don't need to preserve the data, I just need to use my hard disk again. Is there any boot CD that allow us to format encrypted disks without prompting for a password?
I have currently a file server that runs on Fedora 9, and all other PCs (mostly running Windows XP) access the file server via SAMBA. Everything works perfectly! However, lately a home invasion in my neighborhood got me thinking. If they take my file server, my data is not protected. So, I would like to implement the LUKS partition encryption (/home) which sits on a separate disk. However, I don't quite like the decryption process at boot time. In other words, I would like to wake up the file server (WOL) remotely, and when it's done booting, I would like to log-in using the other PCs and enter the passphrase remotely to decrypt /home. Is this possible using LUKS encryption (i.e., cryptsetup)? If not, what would be another alternative to what I am trying to do using a secure encryption (so that the data is safe from thieves)?
This has happened several times now, with 9.10 and 10.04. I back up my photos periodically to external drives, using Nautilus. At the next attempted login Gnome won't start and sometimes gives power manager incorrect installation error.
First time this happened I was stumped and eventually did a clean install. Second time, I found advice elsewhere in this forum to solve this by emptying root trash, which did the trick. This time, however, root trash has nothing in it and 2 users trash were insignificant (I emptied them all anyway with rm -r). Tried looking for enormous directories but couldn't find a smoking gun. I would rather not end up doing another clean install - a painful and extreme solution. I'm continuing to look for solutions to the immediate problem, but my question really is, what causes this and how do I prevent it in the future? I've run Computer Janitor regularly and ran apt-get clean but no help. Should I do all my large scale copying from terminal? I'm not a total noob, but close.
What are the possible problem when Windows access the file from Ubuntu got Read Only even though have a full permission to read, write and execute the file? Ubuntu to Ubuntu accessing the file there is no problem only Windows got a problem.
Is it possible to encrypt the entire drive and not be prompted for the passphrase?
I have a request for a demo of our application and I am looking to create a virtual for VMware's player but need to make sure that the vmdk file cannot be mounted and files pulled from it to protect us from reverse engineering of the application.
here is the problem I am facing. My system [ fedora 11 with all updates installed as of nov 27] suffered a power interuption.[ well that happens I dont have an UPS] here is what happen then
1- when i restarted i get stuck with the "install problem with gnome power manager" that prevent the desktop to launch. I found this to be well documented and I ssh'd [ for some reason cannot get the consol] my system and tried as root to remove gnome-power manager with yum remove power manager ... well the command hang out doing nothing and I have to close the session and reconnect... CTRL C dont even work.
So I had another problem. I started checking my system and when I tried df, I received the shocking following answer
I have a little/big problem. This morning, I dont know why, but suddently my hard disk was full. I thougt that the temporary space grew too mucho and I thought if I restart my machine, everything would be nice but no. Now in the logging screen comes messages that some components cant be load and so I can't go in my Fedora
I tried to access to my partition with Knoppix-livecd and free some space, but it seems that Knoppix can't access to that partition. I have installed fedora 12.
I've been using full disk encryption with luks on two Dell laptops for about 2.5 years. One is 64 bit Fedora (upgraded to 12), another is 32 bit Ubuntu (upgraded to 9.10), both were ext3, until recently.Over time, performance degraded substantially, especially on Fedora, which was put to a heavier use. That laptop has 4 Gb RAM, two 2.5 GHz T9300 CPUs, and 56 Gb of free space.
It was especially unbearable after a reboot. Programs like firefox and thunderbird would take close to a minute to start when ran for the first time after a boot. The login process was painfully slow, and some Gnome applets (e.g. Tomboy notes, keyboard layout switcher) would fail to load on the first login, with an error. I experienced this problem on both laptops with full encryption. I had to log out and relogin to make the applets appear. I tried various boot and mount options and was thinking about switching to ecryptfs (encrypted home).
I also use 3 desktops with no encryption and a netbook with ecryptfs on /home, which all work fine. All are Dell, 2 Ubuntu and 2 Fedora. The Gnome applets problem seems to be due to slowness of the installs with the full disk encryption. The last thing I tried is to migrate ext3 to ext4. I also converted /home, /usr, /opt to extents, following[URL].. That seemed to do the trick. Gnome applets now load fine on both laptops, and startup time is back to tolerable.
Is this a typical experience: ext3 performance degradation with time and a much better performance with full disk encryption once ext3 is migrated to ext4?
I'm trying to install a luks enabled grub for full system encryption. What modules are required by grub to load a normal ubuntu linux system and what is the type to use?
I just installed Fedora64 12 on my laptop. When I tried the Live CD all wen well. Now that I am running the full version I can only access internet pages linked to fedoraproject.org...?? not other pages work like google or yahoo or anything else. This is bizarre. How can I get access to the full internet?
I need to install a lvm2 group with encryption and have the /boot file stored within. Is this possible in Fedora's graphical installer? I know it can be achieved in Arch(I know I'll need grub2, I assume that's coming in Fedora 12) I can always install it separately.
I used to know how to access and rw other linux drives and do the fstab magic. For some reason I've lost my touch. I just want the drive to automount and have full access. I don't need a beginners tutorial on mkdir and fdisk -l. Is there a foolproof way to get my drives to do what I want? I dual boot fedora and ubuntu, but have the same issues on both.
I'm trying to backup my old PC games so that I can finally banish their CDs to the attic once and for all. I've just been using the DD command to grab iso's of my games so far, while keeping their keys in a text file (see the DD command below). However, I just hit my C&C collection and I'm having some problems with some of the newer games like Renegade and Yuri's Revenge. I think they must be copy protected or something. 4 of my last discs have stopped copying at exactly 1.7MB (3 seperate DVD drives, 2 IDE, 1 USB enclosed). Can you guys think of anything else that will cause DD to fail at this location? Any ideas? I'd prefer it to be a command line option, as I'm trying to make things go as quickly as possible. Here's the command I've been using. code...
