Request for Question Clarification by
bookface-ga
on
15 Dec 2003 10:29 PST
What malachite suggests is, in essence, possible, even though you use
Windows 2000 and NTFS. There is a tool called NTFSDOS which allows
NTFS filesystems to be accessed from DOS [I don't remember if it
allows writing, though, and I suspect it does not], and Linux's latest
version can also read NTFS filesystems, and write to them provided the
data is going into a file of constant size, i.e. it can write any
200kb of data to a 200 kb file already existing on the system, which
could be perfect for your needs.
Let me detail the procedure.
A bootable floppy disk or CD could, when booted from, access the hard
drive and perform an encryption routine [optionally using a
user-inputted password] on the data in the registry file, storing it
in encrypted form into a second file that under normal use of the
computer would be filled with either garbage or blanks. (Both files
would be of the same size; the encrypted version's filesize could
easily be adjusted at shutdown to accomodate for any changes in the
registry.) When the encryption operation is sucessfully performed, the
data in the real registry file would then be blanked out.
Upon a second boot with the same disk [and password if one was given]
the file would then be decrypted from the second file back into the
registry contents and the second file would filled with blanks again.
If this would be an acceptable solution to you, I can work out the
details and do the coding for you, though I'd want a little more than
$2 for my troubles.
Another, slightly safer method might a program or script that would
export the registry to a file, encrypt it with a password [or better
yet store it on a secure USB key], and if successful delete all
non-vital keys from the registry [i.e. everything not required for
booting]. Upon rebooting, one could then have a program or script do
the same in reverse, inserting values into the registry/importing from
the saved file. I am fairly sure this is quite doable and I consider
it safer because writing to NTFS or the registry comes with no
gaurantee outside of Windows, and I could work on this solution for
you as well if desired.
Things to note:
Passwords are *normally* stored encrypted into the registry (though
note that is at the descretion of the programmer.) For all major
commercial software, you should be fine, though I make no guarantees
of course. For instance, until AIM version 4.2 or so, passwords were
only lightly encrypted and multiple programs existed to extract and
decrypt passwords from the registry; until 2.15 BulletProof FTP Server
stored its passwords in cleartext by default (although not in the
registry, which should be another concern of yours as not everything
is stored in that central repository); and so forth. However, as both
users and programmers become more aware of and attuned to security
issues, these holes are becoming less and less common.
It is possible that by scanning your registry someone might find an
email address of yours, but it seems much more likely they could find
this information through the internet or other easier and more legal
means.
As currently described, the latter of those two methods makes no
attempt to overwrite any data and the former makes only one. In the
latter case, with a simple hex editor and a boot disk one might
recover sensitive information; in the former, one could still take the
drive to for instance, a forensics expert and be able to recover the
data. If I recall correctly, the data would need to be overwritten 7
times with garbage data for security. Again, this could be done if
desired, though it will probably be harder in the latter case.
Please let me know your thoughts.
- Bookface
