Feature #1770
Feature #2251: panic mode
write random garbage to disk patterned after the key file to obscure the deleted key file
| Status: | New | Start date: | 08/23/2013 | |
|---|---|---|---|---|
| Priority: | Normal | Due date: | ||
| Assignee: | - | % Done: | 0% | |
| Category: | - | |||
| Target version: | 0.2 | |||
| Component: |
Description
When Cacheword deletes its encrypted key file, it should then write random garbage to disk of the same pattern that the encrypted key file has. So basically, it should just generate fake versions of the key file and write and delete them as fast as possible for a settable number of iterations.
If the key file is deleted, then forensic recovery just needs to look for random/encrypted data blocks of the length of the key file. That is not too difficult to do. But if there are many deleted blocks on disk that match that pattern, I don't think it would be possible to tell which one was actually used, and which one is fake.
History
#1 Updated by abeluck about 4 years ago
This is a good idea I think. While the analysts could easily grab all the deleted that look like random data, it would definitely make it take longer for the recovery/brute force process, in some situations at least.
Of course currently CW doesn't do any deleting. I guess it would in some sort of panic mode?
#2 Updated by abeluck about 4 years ago
- Parent task set to #2251
#3 Updated by abeluck about 4 years ago
- Target version set to 0.1
#4 Updated by abeluck almost 4 years ago
- Target version changed from 0.1 to 0.2
pushing this back to the next, because deleting key files isn't even on the radar for this release.