Contents
Portable Mode
Note: This section is only relevant to the PC version of FreeOTFE
- the PDA version effectivly operates in "portable mode" regardless.
Portable mode allows you to use FreeOTFE without first installing it on your computers hard drive.
Instructions:
- Copy the "FreeOTFE.exe" executable onto removable media (e.g. USB
memory stick, CDR; although for testing purposes you may wish to simply
create a temporary directory on you HDD)
- Copy the FreeOTFE drivers (".sys" files) you wish to use in
portable mode into the same directory as the "FreeOTFE.exe" you just
copied.
Note: You must have a copy of the main FreeOTFE device driver
("FreeOTFE.sys") in this directory, if you do not already have it
installed on the computer you will be using portable mode on.
- Launch "FreeOTFE.exe" from the same dir
- To start portable mode, check "Tools | Portable mode drivers".
- To stop portable mode, uncheck "Tools | Portable mode drivers".
You can check to see which drivers are operating in portable mode by
selecting "File | Drivers..." - those drivers currently running in
portable mode are shown in italics.
No files are copied to your hard drive when starting/stopping portable mode.
WARNING: Although no files are copied to your computers hard drive,
because part of the manner in which MS Windows manages device
drivers, when portable mode is started, Windows writes certain details
of your portable mode drivers to the registry, specifically the full
path and filename of the drivers used together with other basic
information on the drivers (e.g. if they are started manually or
automatically at system startup).
When portable mode is stopped, most of this information is deleted by Windows automatically. However:
- Because of the way in which the registry stores data, an attacker may
be able to recover that information which was deleted (this is analgous
to deleting a file on your filesystem; although it's directory entry
may have been marked as "deleted", the data may still be recoverable)
- When Windows deletes it's registry entries, it doesn't delete all
of them (e.g. HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_...)
It is not possible to securely delete the relevant registry entries
without "going behind Windows' back" - not exactly recommended when
working with kernel mode device drivers!
For this reason, it is suggested that you either:
- Change the filenames of the FreeOTFE drivers you will be using in
portable mode (e.g. rename "FreeOTFECypherAES.sys" to
"FreeOTFECypherTwofish.sys")
This will cause the data written to the registry to reflect this new
filename, hopefully convincing an attacker that the driver used was a
different one.
- If you only use one cypher and hash driver in portable mode,
store a number of other cypher/hash drivers on your removable media.
Even if an attacker can determine which drivers you were using in
portable mode, that attacker will not be able to determine which of the
portable drivers you were actually using to encrypt/decrypt your data
with.
It should be noted that the points raised here apply equally to other OTFE systems that support any kind of "portable mode".
Note: Administrator rights are required in order to start and stop
portable mode. You can still use FreeOTFE on a computer which you do
not have Administrator rights on, but will need to ask an Administrator
to install it for you first; see the installation section for further details,
IMPORTANT: Stopping portable mode when any mounted volumes are still
using one or more FreeOTFE drivers operating in portable mode can cause
unexpected
results - for this reason it is recommended that you dismount all volumes before stopping portable mode.
For safety reasons, drivers installed in portable mode are installed
such that if you reboot your system without first stopping portable
mode via the FreeOTFE interface, those drivers will not automatically
start up when your computer comes back up. If they were automatically
restarted, and your portable drivers were stored on removable media
which was taken out while rebooting possible problems could occur
during your boot sequence.
Because of this, if you exit FreeOTFE without stopping all portable
mode drivers, and then reboot yor computer, you will find that the next
time you launch FreeOTFE, the "Portable mode drivers" menuitem will
appear checked as FreeOTFE detects your portable mode drivers. If you
select this menuitem, the previous portable mode drivers should be
stopped and uninstalled as per normal; clearing this menuitem, ready
for you to restart portable mode.