In this lecture I'll show you how to install and use VeraCrypt on Windows which is a free OpenSource
full disk encryption solution.
VeraCrypt is multi-platform software that can be installed on Windows, Mac, Linux and even on FreeBSD.
VeraCrypt is still under active development with the latest encryption standards being supported.
Let’s see what are VeraCrypt main features:
It encrypts an entire partition or storage device such as a USB flash drive or a hard drive.
It creates a virtual encrypted disk within a file and mounts it as a real disk.
This is a file container and it provides plausible deniability in case an adversary
forces you to reveal the password.
It provides hidden volumes which is a type of steganography and hidden operating systems.
Let's get started!
The first step is to download and install VeraCrypt as you would any other Windows application. It's
recommended to check its digital signature before installing.
Take a look at the gpg lecture where I've explained in detail how to verify a digital signature.
And I'm downloading VeraCrypt.
It's done. I'm clicking the EXE file and following the instructions of the wizard; for convenience I'll
use all the default options.
Ok. That's all. VeraCrypt has been successfully installed
Let's start the application! There is a shortcut on the desktop; in this video I'll show you how to
encrypt a USB disk. At this moment I'm inserting a USB disk and I'll click on Create volume.
VC Volume Creation Wizard pops up. VeraCrypt supports two different types of volumes: one is a
virtual volume that looks and behaves like a regular file but VerCrypt can open it and access
the files stored within it.
Imagine an encrypted file that you mount and use like a drive letter in My computer.
The other option encrypts an actual partition or a device.
The process for an encrypted file container is very similar.
I have selected the second option and then I'll click on Next. In the next step
you need to choose whether to create a standard or hidden VeraCrypt volume. A hidden volume is the
option of choice when you are afraid not to be forced to reveal the password.
It implements the plausible deniability
we've talked about in the introduction to full disk encryption. The principle is that a VeraCrypt
hidden volume is created within another VerCrypt volume, in the free space of the volume. Even
when the normal, the outer volume, is mounted it should be impossible to prove whether there is a hidden
volume within it or not.
That's because the free space on any VeraCrypt volume is always filled with random data when the
volume is created and the no part of the hidden volume can be distinguished from the random data.
In this tutorial I'll create a standard VeraCrypt volume which is the default.
The next step is to choose the volume location.
This is in fact the disk or the partition
we are going to encrypt. And I’ll select the removable USB. disk.
This one!
And next; at this point I have to select the volume encryption mode.
The first option will format and encrypt the volume and any data on the device or partition will be
lost.
The second option will try to encrypt the files on the device on the fly and you won't lose the data
that's already on the device.
This takes a longer time.
However if the device is empty you choose the first option.
In the next window you can choose the symmetric algorithm used for encryption and the hash algorithm
required in the process of encrypting the disk; if you want
you can compare the speed of each algorithm; if there is no reason to make a change
leave all options to their default advanced encryption standard. AES and sha512 are extremely secure
algorithms.The volume size, the entire disk and next. In this window
I'll set the volume encryption password.
It's important to choose a strong password which is are in them combination of lower and uppercase letters
digits and spacial characters; use at least 14 or 16 characters for a good password.
Another option is to use a key file which can be any file; but if you want to use a key file instead
of a password
my advice is to allow VeraCrypt to generate a random one, here, in this window, using the key file generator.
In this tutorial I'll use a password
and I'll click on Next.
If you think you'll store files that are larger than 4 gigabytes click this option.
If not, leave it to the default
In this window will choose how to format the drive.
I selected the filesystem as being fat,
fat is good for compatibility,
and I'll select quick format because I don't want to wait too long.
Note that the quick format option comes with a small risk, which is in most cases acceptable.
And I'm clicking on format.
This warning says that the disc will be erased and all data are lost.
So make a backup if you have any valuable data on the disc.
This warning says that
the disk will not be accessed with the same drive leter
from now on. If for example the disc was accessed in My computer using drive letter D it won't be accessed
anymore
using the original drive letter.
okay! That's all! The disc was formatted and encrypted.
Now let's mount and use the disk.
I'll click on select device and then select the disk.
In this case it's D.
I'm selecting the drive and then a new letter for the encrypted volume.
As I said I cannot use the same drive letter.
You can choose anything you want and I'll select a A and mounted and it's prompting for the encryption
password.
After entering the correct password
the encryption disk is available in my computer as drive letter A.
This is the encrypted disk.
Keep in mind that this is transparent encryption which offers data at rest protection; data on disk is
protected through encryption only when the disk is not mounted.
At this moment when the disk is unlocked and mounted there is no protection; also note that when you
insert that disk the Windows operating system will not recognize it and want to formatted. Let's see
what it's all about.
I am dismounting the disk, exit and I'm inserting the USB disk again.
Notice how Windows wants to format the disk.
I'm clicking on cancel, okay and cancel.
I'm opening VeryCrypt,
select the device,
mount and enter the password.
The disk was unlocked and I can use it transparently.
This is the encrypted disk.