Security lost when cloning.

[frand...@gmail.com]

When you clone a Windows hard drive, xxclone does not copy the
security. So just connect it to any computer and anyone can read the
data on it without any authentication. What do you do about this?

I wrote to the support address about this and was told "xxclone
doesn't copy security" and I need to "do it manually". So I get the
impression that it's possible to fix, but I don't know how to do that,
and since my license is old, I don't expect another reply soon from
xxclone support. Any ideas?

I'm using XXClone version 0.58.0 on a Windows XP Home ed netbook.

Thanks!

This thread from way back in 2008 seems to be about the same thing.
http://groups.google.com/group/xxclone/browse_thread/thread/4aebbb2511556f2a/d1b04f7712527f19?lnk=gst&q=security#d1b04f7712527f19

[Dan Anderson]

Hi Frandasan,

Could you or someone else clarify what sort of security software would be applicable regarding this issue? 

For example, supposedly one form of security on a computer would be a logon boot password that could be set as part of your bias, or a windows-based logon password that could apply as you try to boot into a partition's operating system.  But neither of those would supposedly apply if someone took your original hard drive and used it as a secondary data-only drive on a different computer, and similarly those two examples of computer security would not apply if someone took an Xxclone-created version of your hard drive and used that as a secondary data-only drive.

There are other forms of data security that would still be effective, such as secure passwords on compressed/zipped sets of data, but that form of security is rather limited and does not provide a blanket form of security for all the data contents of a hard drive or partition.

The first question then would be, setting aside for a moment the issue of using Xxclone, what are examples of blanket security software or security settings that would protect the data on your hard drive (or a specified partition on your hard drive) if someone was to remove your original hard drive from your computer, and then the second question would be why that same sort of protection could not be applied to a copy of that hard drive (or partition) created using Xxclone?

Cheers,
Dan

_________________________________________________


-------- Original Message --------

Subject:	[xxclone] Security lost when cloning.
Date:	Tue, 3 Apr 2012 18:38:09 -0700 (PDT)
From:	frand...@gmail.com <frand...@gmail.com>
Reply-To:	xxc...@googlegroups.com
To:	The Xxclone Forum <xxc...@googlegroups.com>

-- 
You received this message because you are subscribed to the Google Groups "The Xxclone Forum" group.
To post to this group, send email to xxc...@googlegroups.com.
To unsubscribe from this group, send email to xxclone+u...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/xxclone?hl=en.

[Christopher J.]

Dan,

     I got the impression "Frandasan" was talking about the SAM and profile attributes, in Windows, not any type of security software products {e.g., antivirus, antispyware, firewall}.

     Could be, too, I have this wrong.

Kind regards,
Christopher J. Spilker

[Dan]

I don't know what SAM or profile attributes are.  I was just under the impression that ordinarily when you remove a hard drive containing Windows, you are not able to open the files on it by putting it in an enclosure and connecting it to another computer.  And I was under the impression that xxclone creates an identical copy of a hard drive, so it would be likewise safe and unusable without authentication.  But after buying and using xxclone, I learned otherwise.

Short of describing how to correct this security problem, can anyone point me to a comprehensive description of the differences between a hard drive and an xxclone of it?

[Dan Anderson]

Hi Dan (Frandansan),

I think I would disagree with your initial premise that "ordinarily when you remove a hard drive containing Windows, you are not able to open the files on it by putting it in an enclosure and connecting it to another computer".  I am assuming that you mean connecting it as a secondary data drive.  As far as I know, at least in the context of a typical home or small business computer, I think you can access the data (whether it is on your original hard drive or a hard drive containing an Xxclone copy) by accessing it as a secondary data drive attached to a different computer..

I'm also not familiar with Christopher's reference to SAM and profile attributes, but they may refer to more sophisticated and secure (e.g. corporate) computer environments, but from your most recent comments that does not seem to be the context of your question.

I would defer to others regarding technical differences between the original source drive/partition and the Xxclone copy, but I don't think they are specifically relevant to your security question until you determine to what extent your source drive/partition does in fact have security features that the Xxclone copy does not have.

Regards,
Dan A

__________________________________________


-------- Original Message --------

Subject:	Re: [xxclone] re: Security lost when cloning.

Date:	Wed, 4 Apr 2012 10:46:38 -0400
From:	Dan <frand...@gmail.com>
Reply-To:	xxc...@googlegroups.com
To:	xxc...@googlegroups.com

[DES]

Perhaps you're concerned here with the ACl's (Access Control Lists),
not the Security Accounts Manager? Which you can see under a item's
Properties\Security Tab? And this in fact the Window's ACL Editor...
such that it is. There is a comprehensive Open Source ACL Editor,
SetACL, you get at Source Forge, but most will find this intimidating
at very the least, and Dangerous until one is well versed with it.

I don't know what xxclone does. I generally image a disk first, then
maintain it with incremental copies, with a tool that uses the Volume
Shadow Copy Service for Open\System\Locked files. This copying
transfers all the properties. The ACL's of the destination are the
same as the source. In Windows 7, since even the Administrator doesn't
have a lot of necessary Privileges, a Backup Operator mode must be
used which ignores NTFS Permissions for the copy, but transfers the
Permissions.

But anything that can be accessed by whoever on the source can
likewise be access by whoever on the destination. After all the clone
would be useless if otherwise. The clone is simply seen as a data disk
to the running system. A handy data disk containing a copy of
Everything, that will boot as the source if electrically place as the
source.

I think I've lost the security thread, not being sure what the
question actually was? But I do think the Key Word you should explore
is ACL, not SAM?

DES

[Christopher J.]

D

     SAM = Security Accounts Manager. Generally responsible for authentication for profiles {i.e., each login I.D. or "user"} and keeping personally created files private.

     There was some vagueness in your setup for cloning. Did you clone your current hard drive to another in a USB enclosure? And then connect that enclosure to your computer you cloned from?

     If that is the case, you should be able to view your files as, essentially, you are using the same "credentials" to do so.

     If I clone another's hard drive to a USB enclosure and attach that one to my laptop, I can see all the files on it EXCEPT those in the "My Documents" folder and several others {Windows XP}. There are work arounds, however, you have to know them.

     Please comment back if still bewildered or you have more information.

Kind regards,
Christopher J. Spilker

[Dan]

Yes, I cloned the hard drive in my computer to another in a USB enclosure.

Then I installed the clone into my computer because I lost some files from the (active) source one (this is exactly why I wanted xxclone all along).  The replacement was quick and easy and seemingly secure.

Then I put the source harddrive in the enclosure, wiped it and partitioned it with Acronis (can xxclone do this?  why not?), made it a clone of the internal one and periodically connected and updated it with xxclone.  

I am always required to log in to my computer and so I assumed that this drive - that had been created as a clone with xxclone - was secure.

Then I connected the enclosed drive to my Dad's computer, logged in as him and I was able to browse everything including the My Documents folder.

I wrote to xxclone support and this is the response I got...

"Currently, XXCLONE does not transfer the security info.

Therefore, you need to manually set up the security-related

settings by hand after the cloning operation."

So, what does he mean by "manually set up the security-related settings by hand after the cloning operation"?

I find it hard to believe that all it takes to read someone's ntfs files is to remove their hard drive and connect it to your computer with a USB enclosure, especially after I was told by xxclone support that I needed to "manually set up the security-related settings by hand after the cloning operation"

thanks much

[Christopher J.]

Dan,

     Thank you for writing back. I now have a much better understanding of what you have done.

     Unfortunately, I can not comment further on why this happened {unless we have a FAT32 versus NTFS format going on}. I hope others with more insight than I will contribute to your questions.

     As for XXCLONE not being able to simply partition or format a drive, that was not its design intent. It is a partition cloner, not a partition manager.

     Along with yourself, I await some other responses ...

Kind regards,
Christopher J. Spilker

[Dan Anderson]

I don't think cloning is resulting in a loss of security, but I should explain further what I mean by that.

I'd go back to my earlier comment Dan (Frandansan).  I think in the context of your operating environment, exactly the same thing would have happened if you had taken your original source drive (rather than your Xxclone copy) and connected it to your Dad's computer as a secondary data hard drive.  The contents of your source hard drive would have been just as accessible as the Xxclone copy.  [ Maybe someone can correct me on this if there is some other kind of security software that Dan (Frandansan) or others might use, but any o/s-driven software on the source or Xxclone-copy drive would seem irrelevant since the operating system being booted up was on his Dad's computer and not booting up using the original source or Xxclone-copy operating system. ]

The above circumstances are very different from, say, a network situation where you can allow individuals on other computers connected to a network to access partitions on your hard drive, because that network access is subject to specific parameters that you would establish (e.g. in Win7 right click on the drive/partition and select properties/security).  The response you received from Xxclone support staff could have been in reference to these sorts of security parameters because Xxclone is used to copy a specific (operating system) partition rather than to copy a network structure.  The Xxclone copy is not part of the network unless you make it part of the network, and set the relevant security parameters.

If the main issue is to prevent others from accessing the contents of various folders on a hard drive if it is physically removed and connected to another computer, one approach would be to Google-search on "encrypt partition" or "encrypt folder" and maybe "problems or limitations with partition encryption". 

Cheers,
Dan A.

___________________________________________________

For example, supposedly one form of security on a computer would be a logon boot password that could be set as part of your bios, or a windows-based logon password that could apply as you try to boot into a partition's operating system.  But neither of those would supposedly apply if someone took your original hard drive and used it as a secondary data-only drive on a different computer, and similarly those two examples of computer security would not apply if someone took an Xxclone-created version of your hard drive and used that as a secondary data-only drive.

[DES]

Let me get back in here again and perhaps add some more to the
confusion? But reading the continued thread this morning... This
appears to be more an understanding of Privileges\Permissions than a
security problem. Back to the Access Control Lists please; there's
Users, Groups, Inheritance, Ownership, and specific Privileges.
Putting a disk created under one User into another computer operating
under a different User doesn't begin to exclude that user from
accessing whatever is included in say the Administrator's Group, to
which the User, whoever he is, certainly belongs. You need to examine
the ACL's and see the overall Privileges, and as Inherited from whom.
These Privileges can appear to overlap because of where they
originally came from and who is a member of what group.

The standard work around in Linux to grant yourself a certain
Permission is to create a Group with that Permission. A User can do
that where he may not have permission to grant himself said Permission
(pun intended). Then Join that Group. Got it? It can be quite
confusing.

In Windows 7, with User Account Control Enabled, you're logged on as a
User, but still a Member of the Administrator's Group. Here
Administrators still don't have full Privileges. In some cases only
this guy "The Trusted Installer" (never met him) has that, and you
have to go out and Take Ownership of things to then be able to to
grant yourself certain privileges. But I digress.

DES

[Christopher J.]

Dan (Frandansan),

     Were you using a password to log onto your Windows XP Home profile?

     If not, this could be a reason for the ability to view files with cloned hard drive in a USB enclosure on another computer.

     For others who are unfamiliar with Windows "SAM" service, here is a brief, albeit, unofficial overview:

http://en.wikipedia.org/wiki/Security_Accounts_Manager

     It would certainly seem my reference to this was not germane to the topic.

     That being said, the reference to Windows "ACL" {Access Control List} seem "spot on".

Kind regards,
Christopher J. Spilker

[student]

Maybe you should try a different approach like EaseUS Todo Backup Free 3.5 at http://www.todo-backup.com/

 

Friendly

[Dan]

Thanks all for the feedback.  I am certainly getting an education in os security.

I am still startled that all it takes to open someone's files is to remove their hard drive and hook it up to another computer.  Is this true of Linux and Macs too?

To Des's comments, my expectation comes from working with Microsoft Access 97.  I imagined that OS file-level permissions were similar to Access database table-level permissions.  In that case, permissions are assigned to tables for particular users who are defined in a particular system accounts file.  If I were to put my database into another computer and try to open it as an Admin member of that computer's (Microsoft Access) Admins group, it wouldn't work because that computer has a different systems account definition file even though the groups are both called "Admins."  I wouldn't be able to take ownership of anything either to get around it.  That's what I thought would happen with file permissions too.  I hoped that I could hook up the clone to my own computer and have free reign because I am the user who created the files, but as a different user on my computer or as any user on a different computer I would be denied.  No such luck, apparently.

I don't know how to create Windows groups for my XP Home computer.  There seem to be only two choices for a user: Limited or Administrator.

Christopher, yes, I did use a password to log in.

Perhaps someone whose xxclone license has not expired yet could ask support this question and get a speedier reply.

[Dan]

I just took a look at the TrueCrypt encryption system.  It seems to have the security effect I want.  I'm curious of the effect of putting the whole partition into an encrypted file.  I wonder whether it works at a level lower than xxclone so that xxclone can still function and can still do its backups incrementally.  The TrueCrypt suggested backup scheme calls for having multiple operating systems and putting the backup into a non-bootable image in a non-system volume on the other hard drive, and having a rescue disk - all things I was trying to avoid when I bought xxclone.  But if my existing xxclone scheme still works, all's well.

It sounds like I would still be able to browse and open files on an attached clone after authenticating to TrueCrypt which is good.  And you can encrypt an existing unencrypted Windows partition while you're using it.  Good too.  As long as performance isn't affected, the only additional hassle I can see is entering another password every time you boot up.

[Christopher J.]

Dan,

     Thank you for your follow-up. I agree with your expectations {that attaching a hard drive, either the original or a cloned one} to another computer as a second one or via USB, should block access to Documents and Settings\{user name}\My Documents and some other folders.

     That is my experience with Windows XP, especially Professional edition. However, it is not always the case and I am at a loss to explain.

     I am quite familiar with the routine of "Take Ownership" as I do this a fair amount of time in repairing computers {usually when doing a full rebuild of the OS and attempting to copy the My Documents folders}.

     Hopefully a reasonable explanation can be divulged on this list. One thing seems true: the way security works within the Windows XP environment does not seem consistent.

Kind regards,
Christopher J. Spilker

[DES]

After reading your response here... you most probably could create a
folder in Windows that only had Privileges from your Account. It's a
matter of direct assignment versus Inheritance. Sorry, but back to
ACL's again. Windows assigns most of it's folder privileges via
inheritance, and actually has a rather easy going access policy, which
tightened up some in Windows 7. By manually taking Ownership and
assigning Full Access to your User Account, then removing all other
accounts on the folder in question. Then files created in that folder
would only inherit the new privileges structure. These then would have
whatever access granted only to you and should approximate what I
think I understand about your question? Certainly some unforeseen
problems would be encountered, there's a reason why Windows does what
it does. But it's interesting, I've just never thought about it this
way. Generally I'm trying to get more access, not restrict it. I'll
have to play with this sometime and see what results.

DES

[Dan]

Ah!!  That does sound like a likely way to get security but also likely to mess things up.  Now that you mention it, I think I tried doing this once for some reason on my entire My Documents folder and regretted it.  I do wonder though if this is what he was referring to when the support staff wrote to me that xxclone did not copy security in the cloning process.  I might need to CAREFULLY create a permissions assignment script to run after every cloning operation that assigns permissions on every file I want secured.  I imagine that would take a lot of time to run and defeat the purpose of incremental cloning.

DES

[spe...@gmail.com]

On Wednesday, April 4, 2012 3:38:09 AM UTC+2, frand...@gmail.com wrote:

When you clone a Windows hard drive, xxclone does not copy the
security.  

This is actualy a problem for Windows 7. Just downloaded and installed verison 2.05.2 (Free), and cloned my Windows 7 partition.

Then on the cloned system I discoverd I had this problem

 

http://answers.microsoft.com/en-us/windows/forum/windows_7-files/multiple-application-data-files-folders-nested/53c5439d-a33f-44da-a0ca-e94bb3e15c1f

 

(some searching pointed out that this is a problem for other file copying- [as oposed to partition copying-] cloning programs as well).

[Here is my current problem, if someone has an idea - first time i use google groups, not sure how private answers work, in order not to pollute the thread...
My system volume (Windows 7) has bad sectors/blocks therefore I can no longer clone with GParted as until now. Also a Windows "System Image" refuses to be restored to a volume that appears larger in Windows "Properties" display (the pink and blue pie charts) (and there is a good 1.5 GB free on the 40 GB source volume of the "System Image"). "System Image" restore does start on a 60GB drive/volume (bad disk, no 40 GB contiguous span without hardware failure). I do not dare shrink/defrag my system volume given that I regularly see "Bad Block" errors in Event Viewer (disk is slowly failing), and since my last GParted booting clone is one year old. So my only options seems to buy a larger drive. Thanks ! :-)