Veracrypt – Interesting Way To Encrypt Drive…. Maybe?

[barcleyb]

So, I performed a Diskpart > Clean All on a drive, the job finished OK, had to turn off PC and go out.

Came back and had forgotten I hadn’t initialised the drive or formatted it etc, Veracrypt allowed me to encrypt the drive (2TB) to its full capacity with an NTFS (assume other types would work to? – exFAT etc) volume, I mount the drive as usual and the system has no complaints, I can copy to, from and delete as any other drive.

If I query the disk in Computer Management > Disk Management, Danger Will Robinson - the first thing it wants to do is initialise the drive (GPT) even though it’s mounted by Veracrypt. If I cancel that then Disk Management just sees the disk as unallocated and un-initialised.

OK, so long as I don’t initialise the disk all is well. But this has got me wondering, is there a downside to encrypting and using a disk in this way – Obviously always remember not to initialise that disk, but that aside what else could go wrong that I’m not thinking of?

I have thought of a possible use, you could encrypt a USB/external drive in this manor and store data on it. If said drive became lost/out of your control and someone non techie was to find it, plug it in and take a look, all they would see is a blank disk that needs formatting – nothing to see here, right? Then hopefully format it, copy to it and overwrite the encrypted data none the wiser for what they’re overwriting, or perhaps toss it assuming its faulty.



Your thoughts please, have I missed something with any of this?
What, if any, are the down sides of using a disk in this way?
Would another OS handle a drive formatted in this way differently and perhaps reveal its secret when plugged in?

 

[Tazz]

Yeah, that's pretty much how it's supposed to work. Your encrypted data is only accessible when it 'goes through' Veracrypt. Similarly, when you encrypt the system drive a Veracrypt driver has to load before booting so that the BIOS/UEFI and then Windows can read the disk. At least that's the way it worked in Truecrypt, I haven't encrypted a system drive with Veracrypt yet.

IIRC, initializing the disk in Windows changes the area of the disk that Veracrypt first checks on to see if it has encrypted the disk.

 

[barcleyb]

So, I guess my “surprise” comes from the fact that I have only ever setup a drive as “normal”, i.e. clean it, initialise it, create partition, format it then encrypt it and had always assumed that that was the way it should be done. Doing it this other way skips having to format the drive first, Veracrypt formats the drive as it encrypts it, a kind of 2 for 1 if you will.



One downside I have found is, windows can’t see the drive to optimise it, presumably the drives own internal hardware would deal with TRIM if the drive were an SSD? Otherwise if it were a HDD I guess there’s no way with in Windows to defrag it and you’d need to use 3rd party software?

Are my assumptions correct?

 

[Tazz]

Hey, I didn't know that was in there.
Apparently in "Settings -> Performance/Driver Configuration" there's an option for enabling/disabling (default is disabled) the TRIM command on Windows for non system encrypted drives.
Also, there's an option in "System -> Settings" for an encrypted system drive.

Cool, I'll have to change that.

 

[barcleyb]

I had no idea that was there

That setting definitely allows Windows (10) to see the other drives, but at a cost!

Any one any idea what data may leak?

Better go RTM……

 

[AlanD]

I had no idea that was there

That setting definitely allows Windows (10) to see the other drives, but at a cost!

View attachment 1578

Any one any idea what data may leak?

Better go RTM……

At a guess, at least the fact that an encrypted partition exists, and it's size and format ( FAT32/NTFS etc).

 

[gvlx]

In a twist related to several SN episodes, the developer had its MS account access revoked, which implies he's no longer able to sign the code to be used in Windows.

https://cybernews.com/security/microsoft-suspends-veracrypt-wireguard-accounts-maintainers/

Developer of VeraCrypt encryption software says Windows users may face boot-up issues after Microsoft locked his account | TechCrunch

The maker of the popular open source file encryption software VeraCrypt said Microsoft locked his online account, which may prevent device owners from booting up their computers.

techcrunch.com

This would make for a nice segment in SN.

 

[G The Brit]

So, I guess my “surprise” comes from the fact that I have only ever setup a drive as “normal”, i.e. clean it, initialise it, create partition, format it then encrypt it and had always assumed that that was the way it should be done. Doing it this other way skips having to format the drive first, Veracrypt formats the drive as it encrypts it, a kind of 2 for 1 if you will.



One downside I have found is, windows can’t see the drive to optimise it, presumably the drives own internal hardware would deal with TRIM if the drive were an SSD? Otherwise if it were a HDD I guess there’s no way with in Windows to defrag it and you’d need to use 3rd party software?

Are my assumptions correct?

VeraCrypt/Encryption

The fact that you've encrypted a drive/volume yet anyone else would simply see the storage in RAW format is the purpose. You don't want anybody to know there is valuable/sensitive/encrypted data on it. The downside is that if something were to happen to you, nobody else would know either.

You could put a big sign on the storage device saying 'Encrypted with VeraCrypt. Login, don't FORMAT'. I have 4 internal hard disk drives and a cloud account for backups and 4 external hard disk drives for backups too. The drive with the backup of backups (Uber Backup) isn’t encrypted and I do have instructions on it. I've um and ahed about whether to encrypt it or not. There is nothing on my storage devices that the authorities need to know about, so we are left with theft. It’s my intention to encrypt my devices and/or volumes using Jetico's BestCrypt container and volume encryption programs (as I test them) but at this moment in time nothing is encrypted. That being said, I will be giving my nominated person the instructions to give to my nominated expert if I were to snuff it all of a sudden. It's like backups. It's all well and good doing the best backups but do you have a disaster recovery plan in place that works flawlessly.

One advantage of encryption is that ransomware won't be able to infect your files within an encrypted container/volume. Even though all my internal and external hard disk drives will be encrypted, as I won’t need access to them continuously, they will stay encrypted and so protected from a ransomware attack.

When you do write your instructions, write it as if they are a child. Spell out the ABC's and 123's. Ask someone to be your test subject. You then need a nominated person who would notify your nominated computer expert.

So encryption and failure come with a massive risk of data loss. You should prepare for as many scenarios as possible.

Also, turn off M$ Bitlocker. Enabled it uses 4x the resources as off. Plus, it can cause serious access problems.

So, the question is, do I need it to be like Fort Knox.

I test decryption software from Elcomsoft, which can break any encrypted container or volume or iPhone and Android smartphone. Even if Elcomsoft were to be one or two version behind, it’s just a waiting game for authorities. It’s an arms race and if someone or some authority were to get your encrypted storage device but couldn’t break it today, that’d only have to sit on it for awhile to break it. So encryption has finite security.

Elcomsoft’s forensic software is very expensive. But for authorities they are in a perfect situation as they can wait and wait and wait for Elcomsoft to catch up. It’s a bit like DNA. The ‘monster’ suspect’s DNA may not have been crack when collected but in time, no problemo.


Defragging

There's a lot of software out there – paid/open source/free etc. I have 650GB and 17K pieces of software that I have meticulously collected and which has gone through weeding many times. A new piece of software supersedes the current king of the hill. I’ve been doing this for the past 25 years (minus a 15 year gap). Looking at it as an IT technician/hobbyist and non-gamer, all areas are covered. For example: audio, video, anti-virus, diagnostic (the biggest folder by far which is subdivided into more categories such as HDD+storage utilities, specialist drivers, boot+boot repair+OS utilities, Windows utilities, Windows diagnostic software, Windows programs and update tools, graphics, registry, browsers, maintenance (subdivided in to cleaners, defragmenters, partitioners, debloating software etc.), networking, encryption and security, gaming drivers and software (this covers overclocking targeted at CPU, GPU, HDD-NVMe-SDD/RAM/audio/networking, WINDOWS+OFFICE+LINUX. It’s vast and meticulously subdivided. I also have a main UTILITIES folder of shortcuts that correspond to my software folder as well as a WINDOWS+OFFICE+LINUX shortcuts folder that corresponds to my WINDOWS+OFFICE+LINUX folder. My point is, even when there are 1000s of files stored on it and even though it’s a hard disk drive that can be defragged, I don’t defrag it. Files/folders are constantly being copied/pasted and deleted. Defragging wouldn't help and by not defragging it reduces wear and tear. I do defrag my system volume that’s on a hard disk drive. I wouldn’t defrag my system volume once it’s on a NVMe device. Defragging makes no difference and doing so will cause excesses wear and tear which should be avoided at all costs.

Live by the British special air service (SAS) doctrine—KISS (Keep It Simple And Stupid). Any more complicated and you are asking for trouble.