Truecrypt doesn't change that if the user has the volume open. When computers still had Firewire if they had a warrant for child porn they would use FW and DMA to pull a complete copy of the memory if it was on and get any encryption keys to the Truecrypt volume. They would actually announce that they were coming in on suspicion of child porn because people had a tendency to boot the computer and open Truecrypt to delete all their files.
I suspect similar techniques are still used today, like we see with this tool. If you can get a dump of the computer active memory you can ultimately get the decryption keys on consumer hardware.
>If you can get a dump of the computer active memory you can ultimately get the decryption keys on consumer hardware
What methods are available to get a memory dump if Firewire is disabled? Feds couldn't break my encryption after ~1.5 years but my devices were all off when they showed up. Ironically the one device they did get into was a cell phone powered on but it had little evidentiary value and in one funny way was partly exculpatory.
USB-C+Thunderbolt or eSATA with a vulnerable controller. I know modern OSes have protection against driveby-DMA, but don't know if they protect against memory dump if the "user" - or attacker who gained access to a logged in system - consents.
All these attacks target decryption keys in memory, so they don't work on devices which are turned off.
I'm assuming the computer is "locked" but online, and no users consent to logging in to run anything. Will any of these methods still work if Firewire drivers are disabled?
In that case USB-C/Thunderbolt won't work, in the default config you need to trust the device and cable before anything too interesting can happen. This can be turned off via bios setting though, so there's room for misconfiguration.
E-SATA or PCIe hotplug might still work. However the former is getting less common, and the latter is uncommon in consumer mainboards.
I suspect similar techniques are still used today, like we see with this tool. If you can get a dump of the computer active memory you can ultimately get the decryption keys on consumer hardware.