PGP Disk - PGP

This is a discussion on PGP Disk - PGP ; We have created three virtual disks with PGP Disk. The contents are mostly spreadsheets with financial data. The PGP documentation is not clear on a few points. This begs the following questions: 1. Do the files in the virtual disk ...

+ Reply to Thread
Results 1 to 2 of 2

Thread: PGP Disk

  1. PGP Disk

    We have created three virtual disks with PGP Disk. The contents are
    mostly spreadsheets with financial data. The PGP documentation is not
    clear on a few points. This begs the following questions:

    1. Do the files in the virtual disk appear anywhere on the hard drive
    other than in the page file when we are working with the files?

    2. When the virtual drive is closed are there traces anywhere on the
    system, again other than perhaps the page file?

    3. When we want to clear out old files we have used a secure erase
    program to wipe them from within the virtual drive. This can take
    some time as the files can be very large, in excess of 70 megs. Using
    a 35 pas swipe takes too long. Would we be just as secure if we just
    deleted the files and then did a secure wipe of the empty space and
    slack in the drive?

    We know that the virtual drive is supposed to be a secure vault.
    However, the value of the date is too high to not cover as many bases
    as we can. I think our main concern is what may be in hidden places
    after we have done our work and closed to drives. I have found a few
    items in the registry that seen to be related.

    Any help or opinion are welcome.

    --
    Gypsy Bill & Jo Ann Full timing RV'ers
    reply to: az9b13d4j located at earthlink dot net

  2. Re: PGP Disk

    In article ,
    wrote:

    > We have created three virtual disks with PGP Disk. The contents are
    > mostly spreadsheets with financial data. The PGP documentation is not
    > clear on a few points. This begs the following questions:
    >
    > 1. Do the files in the virtual disk appear anywhere on the hard drive
    > other than in the page file when we are working with the files?

    That depends on the application with which you access the spreadsheet,
    what you do with the files, the way you have set up the spreadsheet
    program and the operating system on your machine.

    In other words, you need to know what work files the application
    creates and where. Many OS's have utilities for inspecting that while
    an applicatioin is in operation. You have no guarantee that you can
    catch every transient file event in every operating system though.
    >
    > 2. When the virtual drive is closed are there traces anywhere on the
    > system, again other than perhaps the page file?


    Same answer I guess.
    >
    > 3. When we want to clear out old files we have used a secure erase
    > program to wipe them from within the virtual drive. This can take
    > some time as the files can be very large, in excess of 70 megs. Using
    > a 35 pas swipe takes too long. Would we be just as secure if we just
    > deleted the files and then did a secure wipe of the empty space and
    > slack in the drive?

    Both of those seem to be unecessary. If the attacker can get into your
    encrypted disk, he might as well take the files themselves. The deleted
    space on the PGP disk is just as well protected as the spreadsheets
    are.
    If you think your passphrase will stay secure, there is no point in
    securely wiping the entire PGP disk when the time comes to delete it.

    >
    > We know that the virtual drive is supposed to be a secure vault.
    > However, the value of the date is too high to not cover as many bases
    > as we can. I think our main concern is what may be in hidden places
    > after we have done our work and closed to drives. I have found a few
    > items in the registry that seen to be related.

    registry? oh Windows... In that case, you need to concern yourself with
    spyware and keyloggers. Don't ever connect the machine to the net or to
    another one without taking precautions. The NSA has published some
    worthwhile stuff for securing your machine in the face of mildly
    determined attackers who can gain physical access to it.
    After you finish work, you may wish to boot your machine from a CD and
    use the wipe free space facility of PGP or the OS.
    In fact, you might as well not bother with PGP disk. Just lock the
    machine in a safe and operate it in a Faraday cage.
    >
    > Any help or opinion are welcome.


    Another way of looking at the problem is to analyse the overall
    weaknesses in your security. Look at where your attackers are coming
    from. There is no point in fitting massive locks to a door in a wooden
    frame.

    --
    I thought I would be the last on earth to mung my e-mail address.
    fsnospam$elliott$$

+ Reply to Thread