Dangers of Encrypted Flash Drives
April 21, 2010 by admin
For many users of flash media, particularly workers in public service or sector employment encrypted flash drives are becoming increasingly common. Whilst this may well indemnify against the loss of secret or sensitive data should the device itself ever be misplaced or lost the user runs the risk of losing this data forever should the device fail.
Recent scandals, which have included government databases being sent out unencrypted on CD or DVD, have no doubt ensured the rise in popularity of these devices.
Any USB Memory Stick can have their contents encrypted using third party encryption software such as FreeOTFE and TrueCrypt and other such utilities (U3) are available often pre-installed on devices. Some of these programs can be used without an actual installation on the device itself but in the case of a U3 Utility the executable files are stored on the USB drive, together with the encrypted file image.
The encrypted partition can then be accessed on any computer running the correct operating system, although it may require the user to have administrative rights on the host computer to access data. Some vendors have produced USB flash drives which use hardware based encryption as part of the design, thus removing the need for third-party encryption software.
Unfortunately if the device suffers from a controller or PCB component failure the recovery of these devices becomes is very uncertain. Very often if the device requires a NAND Chip read to recover the data whilst the data can be read it its RAW format it can’t be decoded into readable data as the encryption is unbreakable. It is a case of securing to data a step too far!!
Bearing in mind all flash media will fail at some point we would recommend that some form of additional data security is employed to ensure this data isn’t lost should you fall victim to a device failure. The keeping of two devices may well add additional indemnity to the situation but we would also strongly recommend ensuring that a minimum of two copies of critical data, that can and would have a serious impact on your business or employment should they be lost, are maintained.