Link to home
Create AccountLog in
Windows Server 2008

Windows Server 2008

--

Questions

--

Followers

Top Experts

Avatar of Optima Systems
Optima Systems๐Ÿ‡ฌ๐Ÿ‡ง

Encryption on Servers and RAID 5
Hi
I have a Server running MS 2008 R2 which has 3 SAS hard disks configured for RAID 5 on a Perc Controller.

These are obviously showing as 1 virtual disk split into a C: and D: drive. I am thinking of encrypting the data on the D: drive using Bitlocker. Will this work across a RAID array and is there a downside?

Also as a general question if all the disks were stolen from the Server (ie removed from the bays) what data would a person be able to see if they plugged each disk into a server as an external device and would a specialist recovery company be able to access the files?

Thanks

Zero AI Policy

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.


ASKER CERTIFIED SOLUTION
Avatar of DavidDavid๐Ÿ‡บ๐Ÿ‡ธ

Link to home
membership
Log in or create a free account to see answer.
Signing up is free and takes 30 seconds. No credit card required.
Create Account

Avatar of Optima SystemsOptima Systems๐Ÿ‡ฌ๐Ÿ‡ง

ASKER

Thanks for the answer.

ย Just to clarify then, there is no reason not to use Bitlocker and as it sees the virtual drive there will be no issues and if I leave the data un-encrypted a recovery person could access the data on any single drive?

Avatar of McKnifeMcKnife๐Ÿ‡ฉ๐Ÿ‡ช

And who would enter the key? Or would you use a TPM?

SOLUTION
Avatar of Rich RumbleRich Rumble๐Ÿ‡บ๐Ÿ‡ธ

Link to home
membership
Log in or create a free account to see answer.
Signing up is free and takes 30 seconds. No credit card required.

Avatar of DavidDavid๐Ÿ‡บ๐Ÿ‡ธ

I have no idea on the key, I would check the docmentation. ย Bitlocker certainly works on LSI RAID and partitions, but there are rules and procedures that vary slightly on each flavor of windows. ย  ย But do remember the PERC 5 is LSI card but not LSI firmware.

It is LSI card with Dell firmware. ย 99% the same, but not 100%. ย  This is a question best asked to the dell support community.

Reward 1Reward 2Reward 3Reward 4Reward 5Reward 6

EARN REWARDS FOR ASKING, ANSWERING, AND MORE.

Earn free swag for participating on the platform.


Avatar of Natty GregNatty Greg๐Ÿ‡จ๐Ÿ‡ฆ

With all that is said above, no encryption on server necessary, have server physically secured. Or you can pay to host your server in the cloud where you and everyone else ย do not know where the physical server is

Avatar of McKnifeMcKnife๐Ÿ‡ฉ๐Ÿ‡ช

"Bitlocker is a poor choice, as McKnife points out" - I did not do anything like this. BL is no poor choice for sure.
Let me add that there are ways to secure a server even when it's not physically secured AND also have the key entered automatically. We could for example use a scheduled task that points to an unlocking batch file on some other server (secured elsewhere). When that encrypted server gets stolen and the thief boots it, the batch will not be accessible and d: would stay locked.

Avatar of Optima SystemsOptima Systems๐Ÿ‡ฌ๐Ÿ‡ง

ASKER

Thanks to everyone for the replies. I think that probably encrypting the data on the server is unnecessary but we have been asked to look into it.

The thing I am still a little unsure of, as I didnt completely understand the very first reply, is that if by any chance someone gained access to the server and removed the individual disks from the server how much data would they see? Obviously the RAID has been broken so it would be what is visible on the actual disk.
Thanks for any clarification.

Free T-shirt

Get a FREE t-shirt when you ask your first question.

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.


Avatar of McKnifeMcKnife๐Ÿ‡ฉ๐Ÿ‡ช

Removing the disks will not break the RAID. The raid will exist as long as it is handled with care and attached to the same controller model or model successor and then, whole d: would be accessible.

Avatar of Optima SystemsOptima Systems๐Ÿ‡ฌ๐Ÿ‡ง

ASKER

but if the server was left in the server room and the disks were removed and taken away (ie stolen) what data would be visible on the drives if someone looked at the disks?

Avatar of Rich RumbleRich Rumble๐Ÿ‡บ๐Ÿ‡ธ

Raid is not that tough to reconstruct on another machine, but the order of the discs is important. Let's assume they have done so, which is the path of most resistance btw, they would take the entire enclosure and save some headache there in real life...Either way, the raided drives are readable, but beyond the NTFS headers, if the entire volume was encrypted, they'd have to supply the decryption key to gain access. It's no different than a LT drive or a secondary drive, reconstructing the raid is a pain, but do-able, other than that all the same rules apply. Raid is below the encryption, and as stated above, neither know about the other, the encryption see's a volume and encrypts it. The Raid see's drives and creates a volume, that is all.
The best way to read encrypted drives is to not turn them off. If I were to steal a server, and I found that it was encrypted, I'd stop right there unless there was some extreme, very extreme financial gains to be had.
Encrypting server HDD's does not make you compliant with any US or European law or statute I am aware of. There are ones for Mobile, but not server. Encrypting data on servers should be done at file and database levels rather than the OS or Drive level. Again read my article to see what that is.
-rich

Reward 1Reward 2Reward 3Reward 4Reward 5Reward 6

EARN REWARDS FOR ASKING, ANSWERING, AND MORE.

Earn free swag for participating on the platform.


Avatar of McKnifeMcKnife๐Ÿ‡ฉ๐Ÿ‡ช

Again: the raid does not matter here. If the unencrypted drives are stolen, all data might be accessed unless the thieves have no idea what they hold.
Windows Server 2008

Windows Server 2008

--

Questions

--

Followers

Top Experts

Windows Server 2008 and Windows Server 2008 R2, based on the Microsoft Vista codebase, is the last 32-bit server operating system released by Microsoft. It has a number of versions, including including Foundation, Standard, Enterprise, Datacenter, Web, HPC Server, Itanium and Storage; new features included server core installation and Hyper-V.