Lab: Encryption software & secure deletion & data recovery
Introduction
The aim of this lab is to introduce encryption software, which can be used to protect the data that is stored locally. We will focus on desktop platforms as it is rather easy to enable ecryption on Android and iOS devices (the instructions should be available in the corresponding lecuture notes). While the lab tasks are designed to be solved on a Windows platform, it is possible to do some of the tasks also using MacOS or Linux distributions.
There are three main tasks in this lab. First, we will see that in some cases it is trivial to recover deleted files even with freely available tools. We will use Recuva to recover files that were deleted by emptying the recycle bin. The aim is to get the experience of using a tool that allows to recover data. Thus, the students who solve the lab tasks at home are allowed to use alternative tools. They can try to recover data from their own computers.
The ease of recovering data gives motivation for both securely erasing data and for encrypting data. Thus, the next task is to use software, which allows to securely erase data. On Windows platform we recommend to use BleachBit for this task.
The final and main task of this lab is to use software, which allows to encrypt the data that is stored on the local machine. We will focus on VeraCrypt, which is a tool that works cross-platform, uses strong cryptography, and has a simple user interface.
Setting up the lab environment
The lab tasks are designed to be solved in a virtual environment where all the tools are already installed. We are using Oracle VirtualBox to run a virtual machine, which contains the required tools. Both Oracle VirtualBox and the corresponding virtual machine are available in the computer classes of the DELTA building.
In case you wish to solve the lab tasks on your own, you can either manually install all of the required tools or download the virtual machine, which we also use in the computer classes. In the latter case, you will also need to install Oracle VirtualBox along with its extension pack. NB! We are not able to provide support for installing software. This has to be done on your own in case you can not attend the lab. When coming across an issue while installing or using Oracle VirtualBox, first try to find an answer with the help of Google. In case that does not help you can post a description of the issue to the Moodle forum. However, in that case it will most likely be easier to install the required software manually, as getting Oracle VirtualBox to run may be tricky in some configurations (we can not provide such support over the internet).
Instructions for configuring Oracle VirtualBox in the computer class
In case you will use the virtual machine at home, you can still follow the instructions but they have to be slightly modified. For example, when using your own computer you will have to select which folder the virtual machine should be unpacked to. The virtual machine file is about 22GB and it will take around the same amount of disk space to unpack the machine. Thus, you will need about 45GB of free disk space to run the virtual machine in your own computer. In case you do not have sufficient disk space, it may be easier to manually install the required software (VeraCrypt is the most important part of this lab).
- Open Oracle VirtualBox from the desktop or start menu.
- Lets configure the folder where the virtual machine will be unpacked. For that, find the file menu from the top left corner of VirtualBox window. Navigate to: File -> Preferences -> General -> Default Machine Folder. Click on the yellow folder icon and find the drive D. Create a folder named infsec_2020 to that drive and open the folder. Next click "Open". You should now have the following view (see image below). After confirming it, click OK.
- Next, lets import the virtual machine. Click on the import button or select from the menu: File -> Import Appliance.
- Click on the yellow icon that is located on the right side of the window.
- Navigate to the folder C:\infsec2020 and select the file infsec-win10-2020_fall.ova. Click Open and Next.
- Click Import and wait until the machine is being imported.
- It will take a few minutes before the virtual machine gets imported. Read the following instructions in the meantime.
- Once the importing finishes, you will see a new entry in the left panel of the VirtualBox window. Click on that entry and press the green Start button.
- The system drive of the virtual machine is encrypted. Thus, it will first ask a password before it even starts to load the operating system. The password will be used to unlock the decryption key, which will be used to decrypt the contents of the virtual hard drive. The password for the virtual machine is given to you in the lab but it is also posted to the Moodle forum. Enter the password and press enter twice (the PIM field is supposed to stay empty).
- It will take some time to check the password. This is done on purpose to make it more difficult to guess the password by brute forcing different combinations.
- After a while Windows will start to load in case you entered the password correctly. There is no password set for the user account and thus you will be automatically logged in. Thus, you should be able to see the desktop on a virtual Windows machine.
- Put the virtual machine window to full screen mode in order to not confuse between the real operating system and the virtual environment. To do that go to View menu and select full screen mode. You can also close the information bars that are displayed on the top of the screen. Now we are ready to start solving the lab tasks.
Data recovery & secure deletion
Before we move to encryption we will see why secure erasure is useful. This is also a motivation for using encryption as the attacker would not be able to access insecurely erased data in case the data is encrypted.
We will try out software Recuva Free and Bleachbit. Recuva allows to restore files while Bleachbit is used for secure deletion.
- Lab exercise 1: Start Recuva Free and understand how it works.
- Use Recuva Free to find deleted files from the partition "Virtual USB". Make sure to check the box named "Deep Scan" as otherwise the files may not be found.
- Where should the recovered files be written?
- Homework task: Right click the recovered picture and select Properties -> Details. Edit the meta-data of the file by writing your full name into the Comments field and your study book number into the Tags field. The solution files are graded automatically, which means that you will have to enter the information to the correct fields. You can find your study book number either from the study information system or from the top right corner of the courses.cs.ut.ee page by clicking on your name -> My data (you have to be logged in). Save the changes to the image and submit the picture as part of your homework solution.''' The solution has to be submitted through the form below. You will have to log in to courses.cs.ut.ee with your university credentials to be able to submit the solution.
In case you can not use the virtual machine it is also possible to try out other file recovery tools on your own. In that case you have to write a brief overview of the user experience of the corresponding tool and take a screenshot of the process of recovering files. As an alternative option, it is also possible to solve this task in the second lab (in case we are allowed to have labs in computer class in the end of October).
- Lab exercise 2: After the homework solution has been submitted securely erase the restored files. In addition, overwrite empty space on the partition "E:Virtual USB".
- Lab exercise 3: Testing recovery with secure erasure. Download some small files (pdf, picture, etc.) and save them on the partition "Virtual USB". Now delete these files by putting them into the recycle bin and emptying the bin. Try to restore the files with "Recuva". Put the data back to "Virtual USB" and now use secure erasure. Now Recuva should not be able to restore the files - test if it is so.
Encryption software
In principle encryption software can be divided in two categories. First, some software is for encrypting individual files and folders in a computer. For example, one can use such software to encrypt only work-related documents. Windows Encrypting File System, VeraCrypt, Boxcryptor and even PGP are examples of software that allow to encrypt individual files or folders.
It is important to understand that all other files are left unencrypted. In addition, the temporary files created when opening an attachment from e-mail or editing an Office document may be placed outside the encrypted folder by the operating system. Also, operating system profile setting as well as web browsing history remain unprotected in this case.
Another approach is to encrypt the whole disk, including the system drive. The system drive is a disk (or its partition) where the operating system files reside and that is used to boot up the system. In Windows, the system drive is the C:\ drive, in macOS and Linux it is where the root file system / is.
When the system drive is encrypted, access to the decryption key is required right after starting the computer, and before the operating system can start loading. Usually the decryption key is unlocked with a password, which is entered by the user. However, it is sometimes also possible to use a physical token to provide the means to access the decryption key in a more secure way.
Most operating systems have system drive encryption software bundled with them. For Windows there is Bitlocker, although is is available only for more feature-full versions of Windows (Enterprise, Ultimate, Server). In macOS there is FileVault 2 and in many Linux distributions LUKS and DM-crypt are most used. VeraCrypt works on all of the three operating systems, although for system drive encryption it is used mostly in Windows.
Windows Encrypting File System
Windows Encrypting File System (EFS) is a feature in the NTFS file system that is used in the Windows operating system. It allows the user to encrypt individual files, folders or even all files in a drive very easily. However, EFS cannot be used to encrypt the system drive. EFS is available since Windows 2000, but it is unsupported in some cheaper versions (e.g. Windows 7 Starter, Home Basic, Home Premium).
Windows EFS generates a separate encryption key for each file. This encryption key is then encrypted with user's password and bundled with the encrypted file. Hence, the file encryption is a s strong as the user's login password. Moreover, since the encryption keys are tightly connected with the user's Windows login account, it is advisable to export the certificate used for EFS and keep it in a safe place. Otherwise the encrypted files become inaccessible if something should happen to the Windows user profile. Recovering encrypted files also requires Windows operating system with EFS support.
While it seems easy to use, we do not recommend to rely on EFS. The design of EFS complicates moving of encrypted data between different computers, storing backups, restoring data. It also does not provide a high security level due to the decryption keys being tied to the Windows user account password, which is usually rather weak. In addition, when encryption individual files, the metadata and temporary files remain unencrypted and can leak information about the contents of the encrypted file.
Staring EFS service:
- Start
services.msc - Find Encrypting File System (EFS) from the list
- Start EFS and make it automatically start on boot
Using EFS:
- Choose a file or folder to encrypt
- Right click on it and choose "Properties" -> "General" -> "Advanced" -> "Encrypt contents to secure data"
- Don't forget to backup the user profile certificate
VeraCrypt
VeraCrypt is a popular open source software for encrypting individual files or whole storage devices (hard disks or USB sticks). It provides on-the-fly encryption so files are transparently encrypted or decrypted while in use. Like all other solutions mentioned here, it uses symmetric encryption to encrypt files.
VeraCrypt's strengths are it's open source code (hence, transparency) and the fact that it is supported on all major operating systems (Windows, macOS, Linux). This allows for easy secure file exchange between different platforms.
1. Installing VeraCrypt (already installed to the virtual machine)
VeraCrypt is available from its webpage at https://www.veracrypt.fr/en/Home.html
Run the downloaded installer and
- Accept the license
- Click "Continue"
- If needed, change the installation location and click "Install"
- Finish installation and run VeraCrypt
2. Encrypted file container
The simplest way to protect a small amount of files is to put them together in a single encrypted file, a container. It is also convenient to backup this container or move it to another computer. By using a strong password the files are kept confidential even when the container should leak - without the right password it looks like random data.
Excercise
Creating a new container:
- Click "Create Volume"
- Choose "Create an encrypted file container"
- Choose "Standard VeraCrypt volume"
- Click "Select File" and save the new container as a file (for example
myfile.hc). Note: .hc is the default VeraCrypt file extension, but you can use any extension, even .pdf or .docx to look less obvious.
Click "Next" - Click "Next"
- Let's make a small container: 10 MB
- Choose a password and memorize it. It should be a strong password, but in the lab you can also use something short and simple for testing. You will be given a warning but it can be ignored.
- Click "Format". Collecting randomness to generate a strong key may take some time.
- You will be offered to create another container. You can choose "Exit" if you don't want to create a second container.
Using a file container:
- Click "Select file" and locate your container (
myfile.hc) - Choose a drive letter, for example
Z: - Click "Mount"
- Insert password. You can first try a wrong password to validate that you will get an error, then use the correct one. Checking the password is deliberately made slow in order to make cracking the password hard.
- Right click on the chosen drive letter and choose "Open" or double-click the chosen drive letter.
- Copy some files to the drive (
Z:\) - Close the drive window
- Click "Dismount" in the VeraCrypt window
- Validate that the copied files are really in the container by following steps 1-5 again. Then don't forget to dismount the drive.
Homework task
Create an encrypted file container with VeraCrypt and submit it as part of the homework. Follow the instructions in the lab session page on how to install and use VeraCrypt. (2p)
- The container itself should be small (500 kB)
- The password must be "security" (written in lowercase)
- Create a text (.txt) file in the container that has your first name as filename, e.g.
Kristjan.txt. The file content is not important. - Make sure that you are able to mount the container with the correct password and then submit the VeraCrypt container as a solution.
3. Encrypting a USB stick / encrypting a partition
One way to securely transport files is to create an encrypted container like described in the previous section and then carry it along on a USB stick. However, VeraCrypt can also encrypt the whole USB drive (i.e., it can encrypt partitions).
USB drives usually have a single partition, but it is possible to add and remove partitions just like on a hard drive. Encrypting a partition commonly requires formatting, so all of the files there must be backed up before starting this process. VeraCrypt also provides the more experimental functionality to encrypt the files in place that are stored on the partition. However, this feature is not guaranteed to not destroy the files.
- Click "Create volume"
- Click "Encrypt non-system partition/drive"
- Click "Standard VeraCrypt volume"
- Choose a partition you want to encrypt by clicking "Select drive" and selecting a partition. If you do this task using the given virtual machine, then choose the "Virtual USB" partition. Files on that partition that you want to keep should be backed up at this point.
- Click "Next" and then again "Next"
- Choose a strong password and/or create a keyfile. The password and keyfile together form the encryption/decryption key. A keyfile should be kept separately from the USB stick and protected against theft. If either of the password or keyfile is lost, the encrypted files cannot be restored.
- Click "Next", choose "Quick format" and click "Next"
- You can now try to make random movements with your cursor to generate entropy for generating the encryption key. Then click "Format" and "Yes".
- Click "Next"
- Using the encrypted partition is similar to using an encrypted file container, but start with selecting "Select device".
Of course, if you want to use this encrypted USB stick in another computer, it must have the VeraCrypt software. For computers where you do not have permission to install new software, there is also a possibility to create a portable VeraCrypt version from Tools -> Traveler Disk Setup... A good idea is to create two partitions on your USB stick: one encrypted and the other unencrypted, holding the portable version of VeraCrypt.
4. Encrypting system drive
As mentioned before, VeraCrypt also allows to encrypt the system drive (or any other drive, actually). This can be done by clicking "Create volume" and then choosing "Encrypt the system partition or entire drive" or Choosing System -> Encrypt System Partition/Drive... from the menu. The rest of the process is similar to creating an encrypted container or USB drive. In the process, VeraCrypt also generates a System Rescue CD where it writes the encryption key encrypted with the chosen password. This CD is needed when the hard drive's boot section gets corrupted for some reason.
Depending on the drive size, encrypting the whole disk may take a lot of time. However, VeraCrypt encrypts the disk on-the-fly and in the background so you can continue to use the computer normally during this time.
Truecrypt and the history of VeraCrypt
VeraCrypt is one of the successors of a very popular open-source disk encryption software Truecrypt. Although a popular software, there were some facts that brought up questions about Truecrypt:
- The authors of Truecrypt are anonymous (at least to the public) and thus it is not known what was their motivation on creating such software.
- It was hard to validate if the distributed binaries were really built from the published source code.
- Truecrypt source code was not audited for a very long time. Hence, there was no guarantee that it didn't contain any back doors. In fall 2013, Matthew Green and Kenneth White started a campaign to audit it's source code. More information on it at http://istruecryptauditedyet.com/.
- In May 2014 the developers of Truecrypt unexpectedly announced that they will discontinue developing the software and advise not to use Truecrypt as it might have security vulnerabilities. It is not known what was the reason for making such a statement. The Truecrypt web page was replaced with a tutorial on migrating to another software. It was decided that the aforementioned security audit would still be finished.
- In April 2015, the security audit was finished and no alarming security issues were identified.
Some people still use(d) the last stable Truecrypt version 7.1a, as this was the audited version. However, since Truecrypt code is not maintained anymore, it is clear that any potential security vulnerabilities will also remain unfixed and some such vulnerabilities have already been found. Thus, it is advisable to use some of its up-to-date copies, e.g. VeraCrypt. VeraCrypt maintains most of the user interface of Truecrypt and can even open old Truecrypt containers. Most importantly, it also receives security patches, if necessary.
Encrypting individual files
VeraCrypt's encrypted file container is a convenient way to securely store or transport files, but it does not suit well with the use case where files need to be synchronized between computers backed up using cloud storage services (Dropbox, Google Drive, Microsoft Onedrive, etc.). The problem here is that VeraCrypts's encrypted file container is actually a single file, so when even one file in the container is changed, the whole container changes and needs to be uploaded to the cloud service again.
This problem can be solved by encrypting each file separately. So when a file is changed, only this single file is uploaded to the cloud service, just as with unencrypted files. Also, the encrypted files are about the same size as the originals. The files are encrypted in the user's computer before uploading them to the cloud service. The same holds for decryption, so the cloud service provider never sees unencrypted version of files.
To start using such encryption software, the user first has to choose a password and a folder where the encrypted versions of files are kept. This should be the folder that is synchronized to the cloud, e.g. some subfolder of Dropbox. Secondly, the user chooses a drive (or folder in case of Linux) where the encrypted files are available in decrypted form. This is the virtual drive where the user can access the files. Unencrypted files are never stored on disk, the encryption and decryption is done on-the-fly. We briefly describe two of such encryption software: Boxcryptor Classic and Cryptomator.
Boxcryptor
Boxcryptor is compatible with all of the cloud storage providers that create a synchronized folder in user's computer (e.g. all of the providers mentioned above) and can be also used without any cloud service just to store encrypted versions of files on the disk. Moreover, Boxcryptor also has mobile client support.
There were two versions of the Boxcryptor software, unfortunately the simpler classic version was discontinued. The new version has secure file sharing capabilities with other Boxcryptor users, but for requires an user account. The paid version of Boxcryptor also encrypts filenames. As creating an account takes time, we won't do this in the lab. Trying out this software is voluntary.
Settings of Boxcryptor Classic. Shown here are the location of the encrypted folder, as well as the drive where the files are accessible.
Cryptomator
https://cryptomator.org/ is a free open source software doing exactly the same - it protects contents of a folder with a password and shows un-encrypted view of those as a separate drive (or directory in case of Linux).
Mounting an encrypted folder 'Documents\top-secret' as drive Z: in Windows.
Encrypted folder and mounted decrypted view side-by-side. Cryptomator also encrypts filenames.
Ending the lab
- After uploading the solutions close the virtual machine. Open the Start menu and select "Power" -> "Shut down".
- Next, remove the previously imported virtual machine from the main VirtualBoxi window. To do that, right click on the name of the virtual machine and select "Remove...".
From the dialog window select "Delete all files".
- Finally, make sure that you log out of the lab computer. We will give minus points to the students who leave the computer class without logging out from their accounts.