Encrypt a volume, escrow the key, and prove what encryption does not stop

short · 45 min · Objective 2.1

Task

Encrypt a volume on the guest, confirm where the recovery key actually lives, and then demonstrate the boundary: that a running, signed-in machine gives up its files to anything running as that user. The second half is what stops "it is encrypted" being treated as an answer to every question.

Steps

  1. Encrypt the second volume on the guest and record the method and options in lab/crypto/setup.csv with header item,value covering the tool, the unlock method, whether a security module is in use and whether a startup PIN is set.
  2. Establish where the recovery key is stored and record it in lab/crypto/key.md -- the location, not the key itself. Confirm you could retrieve it from a different machine.
  3. Power the guest off, attach its encrypted volume to another guest, and record what that machine can read in lab/crypto/offline.txt.
  4. Start the guest, sign in, and from an ordinary user process read a file on the encrypted volume. Record the result in lab/crypto/online.txt.
  5. Write lab/crypto/boundary.md listing at least five things full disk encryption does not protect against, each with one sentence on why.

Verify

awk -F, 'NR>1 && NF>=2 {n++} END {print n" setup item(s)"}' lab/crypto/setup.csv
grep -Eic 'account|directory|printed|password manager|escrow' lab/crypto/key.md
grep -Eic 'unreadable|encrypted|prompt|cannot' lab/crypto/offline.txt
grep -Eic 'readable|succeeded|opened' lab/crypto/online.txt
grep -Ec '^[-*0-9]' lab/crypto/boundary.md

A recorded key location that is not the encrypted machine itself, an offline read that failed, an online read that succeeded, and five boundary items. If lab/crypto/key.md names a file on the guest, the recovery key does not exist in any useful sense.

Notes

Never record the recovery key value in any lab file. The location is the artefact; the key belongs in an account, a directory or a password manager.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.