2

I am conserned about cold-boot attacks on my full disc encrypted (filevault2) laptop.

Therefore I am wondering if the memory image dump to /var/vm/sleepimage is encrypted before it is saved to disk?

I notice that the suspended drive asks me for my password before unlocking so it appears this is the case, but could anyone confirm this?

4

Everything written to the volume under Filevault 2 is encrypted live and in-stream by the kernel / device drivers.

As long as there isn't a bug where data leaks to outside the core storage wrapper, you don't need to worry about someone analyzing the contents of your RAM by snooping the locked drive.

  • So the only issue I need to worry about is FireWire attack on the computer while turned on then. Thanks for your answer! – Christopher Käck Jun 6 '13 at 15:17
  • Yes - worrying about a lost key that will decrypt the Core Storage volume (or compromised passcode) from the running system (or observation) or a backup location is a much higher risk than unraveling the encrypted bits on Filevault IMO. – bmike Jun 6 '13 at 16:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .