Drive Encryption Defeated
With the numerous cases of lost and stolen laptops containing sensitive and private information making headlines, governments and businesses have turned to drive encryption as a means of mitigating their data loss risks. Drive encryption differs from file encryption in that the entire volume is encrypted and unintelligible without the requisite keys. Without knowledge of the key at boot-time, the system is unable to decrypt the volume. Once running, the keys are retained in RAM for necessary decryption routines.
Herein lies the weakness. Sponsored by the Department of Homeland Security, Princeton researchers discovered that by deep freezing RAM chips, the data is not lost when the power goes off. Normally, without a refresh charge, the volatile state of RAM is lost. While a deep liquid nitrogen freeze allows the attacker to preserve the RAM contents for long periods of time, the researchers discovered that even bursts of compressed air chilled the chips enough that data was retained for several minutes. The extra time was necessary to preserve the chips such that the decryption keys could be copied and then used normally to access the stolen hard drives.