Mac PGP WDE emergency recovery procedures

Question

This is really more of a serverfault/IT question, but I am not part of the beta.

Equipment / Topology:

1. MacBook Pro (Running OSX) 4GB RAM
   • Used for email, web browsing, basicly everything that isn't Visual Studio or a MS app.
2. VMWare Fusion VMs (mostly XP) for various development needs
   • Main VS2008 Development
   • Custom 3rd party software
   • Installation Testing Environments
   • etc

I have a need for whole disk encryption [WDE] due to the nature of the data I work with. Because I use both the VMs and OSX I can not simply install TrueCrypt WDE inside my VMs as that would leave my OSX data unprotected.

FileVault will not work for several reasons that I will leave you to find if you care that much about it, suffice it to say that it will not work for my purpose.

TrueCrypt's WDE is fantastic and would be my perfered solution if it worked on the EFI intel macs :( PGP has a solution that works on macs.

The problem is simple: What happens in the event I need to access the disk without booting the system?

With TrueCrypt you could mount the drive from BartPE or another windows system with TC installed and copy the data over.

Is there a way to do this with PGP for mac that people are aware of? Have others solved this problem already?

I know that you can decrypt the drive in an emergency but there are time when this is undesirable or unreliable. What I am looking for is the ability to build a boot disk (windows is fine, it doesn't have to be mac) to be able to mount my drive unencrypted.

Answer 1

You can install OS X and PGP WDE on a USB/FireWire drive, if you want. It should be no problem accessing the disk from there.

Answer 2

You have two options for sure: 1. Install WDE on a separate Mac and use target disk mode to mount the original disk remotely. 2. Install WDE on a bootable external drive. Then just boot with that, mount the original disk (entering the passphrase, of course) and access the data.

There are a variety of command line recovery options available. You may want to check out the PGP Knowledge Base and search for article 1018.

(disclaimer: I work for PGP)