Update: TrueCrypt is discontinued, try these free alternatives
https://veracrypt.codeplex.com/releases/
If you are running Linux, full disk encryption of many many types has been around for years. Here are some links to get you started:
https://help.ubuntu.com/community/EncryptedFilesystems
http://archimedesden.wordpress.com/2011/10/21/yet-another-full-disk-encryption-with-ubuntu-11-10/
I like these notes on key storage a lot:
https://wiki.archlinux.org/index.php/System_Encryption_with_LUKS#External_Storage_on_a_USB_Drive
The rest of this post is for the poor people forced to run Windows on machines that might easily be stolen, but still want to use the NTFS disk in Linux. Many thanks to the TrueCrypt folk for thinking of us Linux users and making the Windows software available on a donation basis.
I am running TrueCrypt System Encryption version 7.1 on my NTFS Windows disks, and quite pleased with the performance of it. The steps below show how to mount such a drive in Knoppix 6.7 in the event you need to edit your files in your favorite live Linux distribution.
- The full docs are here:
http://www.truecrypt.org/docs/ - Download the files. 32 or 64 bit / graphic or text depending on your needs:
wget http://www.truecrypt.org/download/truecrypt-7.1-linux-console-x64.tar.gz
wget http://www.truecrypt.org/download/truecrypt-7.1-linux-console-x86.tar.gz
wget http://www.truecrypt.org/download/truecrypt-7.1-linux-x86.tar.gz
wget http://www.truecrypt.org/download/truecrypt-7.1-linux-x64.tar.gz - Extract the file:
tar -xvzf truecrypt-7.1-linux-console-x86.tar.gz - Install:
./truecrypt-7.1-setup-console-x86 - Read the help for your version:
truecrypt -t -h - Mount sda1 on /mnt:
truecrypt -t -k "" --protect-hidden=no -m=system /dev/sda1 /mnt - View / Edit your files as needed.
- Unmount sda1:
truecrypt -t -d /dev/sda1 - Uninstall TrueCrypt:
sudo bash
truecrypt-uninstall.sh
$ truecrypt -h
Usage: truecrypt [--auto-mount <str>] [--backup-headers] [--background-task] [-C] [-c] [--create-keyfile] [--delete-token-keyfiles] [-d] [--display-password] [--encryption <str>] [--explore] [--export-token-keyfile] [--filesystem <str>] [-f] [--fs-options <str>] [--hash <str>] [-h] [--import-token-keyfiles] [-k <str>] [-l] [--list-token-keyfiles] [--load-preferences] [--mount] [-m <str>] [--new-keyfiles <str>] [--new-password <str>] [--non-interactive] [-p <str>] [--protect-hidden <str>] [--protection-keyfiles <str>] [--protection-password <str>] [--random-source <str>] [--restore-headers] [--save-preferences] [--quick] [--size <str>] [--slot <str>] [--test] [-t] [--token-lib <str>] [-v] [--version] [--volume-properties] [--volume-type <str>] [Volume path] [Mount point]
--auto-mount=<str> Auto mount device-hosted/favorite volumes
--backup-headers Backup volume headers
--background-task Start Background Task
-C, --change Change password or keyfiles
-c, --create Create new volume
--create-keyfile Create new keyfile
--delete-token-keyfiles Delete security token keyfiles
-d, --dismount Dismount volume
--display-password Display password while typing
--encryption=<str> Encryption algorithm
--explore Open explorer window for mounted volume
--export-token-keyfile Export keyfile from security token
--filesystem=<str> Filesystem type
-f, --force Force mount/dismount/overwrite
--fs-options=<str> Filesystem mount options
--hash=<str> Hash algorithm
-h, --help Display detailed command line help
--import-token-keyfiles Import keyfiles to security token
-k, --keyfiles=<str> Keyfiles
-l, --list List mounted volumes
--list-token-keyfiles List security token keyfiles
--load-preferences Load user preferences
--mount Mount volume interactively
-m, --mount-options=<str> TrueCrypt volume mount options
--new-keyfiles=<str> New keyfiles
--new-password=<str> New password
--non-interactive Do not interact with user
-p, --password=<str> Password
--protect-hidden=<str> Protect hidden volume
--protection-keyfiles=<str> Keyfiles for protected hidden volume
--protection-password=<str> Password for protected hidden volume
--random-source=<str> Use file as source of random data
--restore-headers Restore volume headers
--save-preferences Save user preferences
--quick Enable quick format
--size=<str> Size in bytes
--slot=<str> Volume slot number
--test Test internal algorithms
-t, --text Use text user interface
--token-lib=<str> Security token library
-v, --verbose Enable verbose output
--version Display version information
--volume-properties Display volume properties
--volume-type=<str> Volume type
Synopsis:
truecrypt [OPTIONS] COMMAND
truecrypt [OPTIONS] VOLUME_PATH [MOUNT_DIRECTORY]
Commands:
--auto-mount=devices|favorites
Auto mount device-hosted or favorite volumes.
--backup-headers[=VOLUME_PATH]
Backup volume headers to a file. All required options are requested from the
user.
-c, --create[=VOLUME_PATH]
Create a new volume. Most options are requested from the user if not specified
on command line. See also options --encryption, -k, --filesystem, --hash, -p,
--random-source, --quick, --size, --volume-type. Note that passing some of the
options may affect security of the volume (see option -p for more information).
Inexperienced users should use the graphical user interface to create a hidden
volume. When using the text user interface, the following procedure must be
followed to create a hidden volume:
1) Create an outer volume with no filesystem.
2) Create a hidden volume within the outer volume.
3) Mount the outer volume using hidden volume protection.
4) Create a filesystem on the virtual device of the outer volume.
5) Mount the new filesystem and fill it with data.
6) Dismount the outer volume.
If at any step the hidden volume protection is triggered, start again from 1).
--create-keyfile[=FILE_PATH]
Create a new keyfile containing pseudo-random data.
-C, --change[=VOLUME_PATH]
Change a password and/or keyfile(s) of a volume. Most options are requested
from the user if not specified on command line. PKCS-5 PRF HMAC hash
algorithm can be changed with option --hash. See also options -k,
--new-keyfiles, --new-password, -p, --random-source.
-d, --dismount[=MOUNTED_VOLUME]
Dismount a mounted volume. If MOUNTED_VOLUME is not specified, all
volumes are dismounted. See below for description of MOUNTED_VOLUME.
--delete-token-keyfiles
Delete keyfiles from security tokens. See also command --list-token-keyfiles.
--export-token-keyfile
Export a keyfile from a security token. See also command --list-token-keyfiles.
--import-token-keyfiles
Import keyfiles to a security token. See also option --token-lib.
-l, --list[=MOUNTED_VOLUME]
Display a list of mounted volumes. If MOUNTED_VOLUME is not specified, all
volumes are listed. By default, the list contains only volume path, virtual
device, and mount point. A more detailed list can be enabled by verbose
output option (-v). See below for description of MOUNTED_VOLUME.
--list-token-keyfiles
Display a list of all available security token keyfiles. See also command
--import-token-keyfiles.
--mount[=VOLUME_PATH]
Mount a volume. Volume path and other options are requested from the user
if not specified on command line.
--restore-headers[=VOLUME_PATH]
Restore volume headers from the embedded or an external backup. All required
options are requested from the user.
--save-preferences
Save user preferences.
--test
Test internal algorithms used in the process of encryption and decryption.
--version
Display program version.
--volume-properties[=MOUNTED_VOLUME]
Display properties of a mounted volume. See below for description of
MOUNTED_VOLUME.
MOUNTED_VOLUME:
Specifies a mounted volume. One of the following forms can be used:
1) Path to the encrypted TrueCrypt volume.
2) Mount directory of the volume's filesystem (if mounted).
3) Slot number of the mounted volume (requires --slot).
Options:
--display-password
Display password characters while typing.
--encryption=ENCRYPTION_ALGORITHM
Use specified encryption algorithm when creating a new volume.
--filesystem=TYPE
Filesystem type to mount. The TYPE argument is passed to mount(8) command
with option -t. Default type is 'auto'. When creating a new volume, this
option specifies the filesystem to be created on the new volume (only 'FAT'
and 'none' TYPE is allowed). Filesystem type 'none' disables mounting or
creating a filesystem.
--force
Force mounting of a volume in use, dismounting of a volume in use, or
overwriting a file. Note that this option has no effect on some platforms.
--fs-options=OPTIONS
Filesystem mount options. The OPTIONS argument is passed to mount(8)
command with option -o when a filesystem on a TrueCrypt volume is mounted.
This option is not available on some platforms.
--hash=HASH
Use specified hash algorithm when creating a new volume or changing password
and/or keyfiles. This option also specifies the mixing PRF of the random
number generator.
-k, --keyfiles=KEYFILE1[,KEYFILE2,KEYFILE3,...]
Use specified keyfiles when mounting a volume or when changing password
and/or keyfiles. When a directory is specified, all files inside it will be
used (non-recursively). Multiple keyfiles must be separated by comma.
Use double comma (,,) to specify a comma contained in keyfile's name.
Keyfile stored on a security token must be specified as
token://slot/SLOT_NUMBER/file/FILENAME. An empty keyfile (-k "") disables
interactive requests for keyfiles. See also options --import-token-keyfiles,
--list-token-keyfiles, --new-keyfiles, --protection-keyfiles.
--load-preferences
Load user preferences.
-m, --mount-options=OPTION1[,OPTION2,OPTION3,...]
Specifies comma-separated mount options for a TrueCrypt volume:
headerbak: Use backup headers when mounting a volume.
nokernelcrypto: Do not use kernel cryptographic services.
readonly|ro: Mount volume as read-only.
system: Mount partition using system encryption.
timestamp|ts: Do not restore host-file modification timestamp when a volume
is dismounted (note that the operating system under certain circumstances
does not alter host-file timestamps, which may be mistakenly interpreted
to mean that this option does not work).
See also option --fs-options.
--new-keyfiles=KEYFILE1[,KEYFILE2,KEYFILE3,...]
Add specified keyfiles to a volume. This option can only be used with command
-C.
--new-password=PASSWORD
Specifies a new password. This option can only be used with command -C.
-p, --password=PASSWORD
Use specified password to mount/open a volume. An empty password can also be
specified (-p ""). Note that passing a password on the command line is
potentially insecure as the password may be visible in the process list
(see ps(1)) and/or stored in a command history file or system logs.
--protect-hidden=yes|no
Write-protect a hidden volume when mounting an outer volume. Before mounting
the outer volume, the user will be prompted for a password to open the hidden
volume. The size and position of the hidden volume is then determined and the
outer volume is mounted with all sectors belonging to the hidden volume
protected against write operations. When a write to the protected area is
prevented, the whole volume is switched to read-only mode. Verbose list
(-v -l) can be used to query the state of the hidden volume protection.
Warning message is displayed when a volume switched to read-only is being
dismounted.
--protection-keyfiles=KEYFILE1[,KEYFILE2,KEYFILE3,...]
Use specified keyfiles to open a hidden volume to be protected. This option
may be used only when mounting an outer volume with hidden volume protected.
See also options -k and --protect-hidden.
--protection-password=PASSWORD
Use specified password to open a hidden volume to be protected. This option
may be used only when mounting an outer volume with hidden volume protected.
See also options -p and --protect-hidden.
--quick
Do not encrypt free space when creating a device-hosted volume. This option
must not be used when creating an outer volume.
--random-source=FILE
Use FILE as a source of random data (e.g., when creating a volume) instead
of requiring the user to type random characters.
--slot=SLOT
Use specified slot number when mounting, dismounting, or listing a volume.
--size=SIZE
Use specified size in bytes when creating a new volume.
-t, --text
Use text user interface. Graphical user interface is used by default if
available. This option must be specified as the first argument.
--token-lib=LIB_PATH
Use specified PKCS #11 security token library.
--volume-type=TYPE
Use specified volume type when creating a new volume. TYPE can be 'normal'
or 'hidden'. See option -c for more information on creating hidden volumes.
-v, --verbose
Enable verbose output.
IMPORTANT:
If you want to use TrueCrypt, you must follow the security requirements and
security precautions listed in chapter 'Security Requirements and Precautions'
in the TrueCrypt documentation (file 'TrueCrypt User Guide.pdf').
Examples:
Create a new volume:
truecrypt -t -c
Mount a volume:
truecrypt volume.tc /media/truecrypt1
Mount a volume as read-only, using keyfiles:
truecrypt -m ro -k keyfile1,keyfile2 volume.tc
Mount a volume without mounting its filesystem:
truecrypt --filesystem=none volume.tc
Mount a volume prompting only for its password:
truecrypt -t -k "" --protect-hidden=no volume.tc /media/truecrypt1
Dismount a volume:
truecrypt -d volume.tc
Dismount all mounted volumes:
truecrypt -d
Below are notes from installing TrueCrypt System Encryption on Windows:
TIP: If you want to avoid burning the TrueCrypt Rescue Disk.iso file to CD you can just copy it to some other secure computer and then loop mount the iso in Windows using SlySoft Virtual CloneDrive 5450 to skip the verify process. DO NOT DO THIS UNLESS YOU ARE SURE YOU CAN LATER BURN THE DISK YOU NEED IN AN EMERGENCY!
This is the info that TrueCrypt tells you to print at various stages of the install:
IMPORTANT NOTES -- PLEASE READ OR PRINT (click 'Print'):
Note that none of your files will be encrypted before you successfully restart your computer and start Windows. Thus, if anything fails, your data will NOT be lost. However, if something does go wrong, you might encounter difficulties in starting Windows. Therefore, please read (and, if possible, print) the following guidelines on what to do if Windows cannot start after you restart the computer.
What to Do If Windows Cannot Start
------------------------------------------------
Note: These instructions are valid only if you have not started encrypting.
- If Windows does not start after you enter the correct password (or if you repeatedly enter the correct password but TrueCrypt says that the password is incorrect), do not panic. Restart (power off and on) the computer, and in the TrueCrypt Boot Loader screen, press the Esc key on your keyboard (and if you have multiple systems, choose which to start). Then Windows should start (provided that it is not encrypted) and TrueCrypt will automatically ask whether you want to uninstall the pre-boot authentication component. Note that the previous steps do NOT work if the system partition/drive is encrypted (nobody can start Windows or access encrypted data on the drive without the correct password even if he or she follows the previous steps).
- If the previous steps do not help or if the TrueCrypt Boot Loader screen does not appear (before Windows starts), insert the TrueCrypt Rescue Disk into your CD/DVD drive and restart your computer. If the TrueCrypt Rescue Disk screen does not appear (or if you do not see the 'Repair Options' item in the 'Keyboard Controls' section of the TrueCrypt Rescue Disk screen), it is possible that your BIOS is configured to attempt to boot from hard drives before CD/DVD drives. If that is the case, restart your computer, press F2 or Delete (as soon as you see a BIOS start-up screen), and wait until a BIOS configuration screen appears. If no BIOS configuration screen appears, restart (reset) the computer again and start pressing F2 or Delete repeatedly as soon as you restart (reset) the computer. When a BIOS configuration screen appears, configure your BIOS to boot from the CD/DVD drive first (for information on how to do so, please refer to the documentation for your BIOS/motherboard or contact your computer vendor's technical support team for assistance). Then restart your computer. The TrueCrypt Rescue Disk screen should appear now. In the TrueCrypt Rescue Disk screen, select 'Repair Options' by pressing F8 on your keyboard. From the 'Repair Options' menu, select 'Restore original system loader'. Then remove the Rescue Disk from your CD/DVD drive and restart your computer. Windows should start normally (provided that it is not encrypted).
Note that the previous steps do NOT work if the system partition/drive is encrypted (nobody can start Windows or access encrypted data on the drive without the correct password even if he or she follows the previous steps).
Note that even if you lose your TrueCrypt Rescue Disk and an attacker finds it, he or she will NOT be able to decrypt the system partition or drive without the correct password.
IF POSSIBLE, PLEASE PRINT THIS TEXT (click 'Print' below).
How and When to Use TrueCrypt Rescue Disk (After Encrypting)
-----------------------------------------------------------------------------------
I. How to Boot TrueCrypt Rescue Disk
To boot a TrueCrypt Rescue Disk, insert it into your CD/DVD drive and restart your computer. If the TrueCrypt Rescue Disk screen does not appear (or if you do not see the 'Repair Options' item in the 'Keyboard Controls' section of the screen), it is possible that your BIOS is configured to attempt to boot from hard drives before CD/DVD drives. If that is the case, restart your computer, press F2 or Delete (as soon as you see a BIOS start-up screen), and wait until a BIOS configuration screen appears. If no BIOS configuration screen appears, restart (reset) the computer again and start pressing F2 or Delete repeatedly as soon as you restart (reset) the computer. When a BIOS configuration screen appears, configure your BIOS to boot from the CD/DVD drive first (for information on how to do so, please refer to the documentation for your BIOS/motherboard or contact your computer vendor's technical support team for assistance). Then restart your computer. The TrueCrypt Rescue Disk screen should appear now. Note: In the TrueCrypt Rescue Disk screen, you can select 'Repair Options' by pressing F8 on your keyboard.
II. When and How to Use TrueCrypt Rescue Disk (After Encrypting)
1) If the TrueCrypt Boot Loader screen does not appear after you start your computer (or if Windows does not boot), the TrueCrypt Boot Loader may be damaged. The TrueCrypt Rescue Disk allows you to restore it and thus to regain access to your encrypted system and data (however, note that you will still have to enter the correct password then). In the Rescue Disk screen, select 'Repair Options' > 'Restore TrueCrypt Boot Loader'. Then press 'Y' to confirm the action, remove the Rescue Disk from your CD/DVD drive and restart your computer.
2) If you repeatedly enter the correct password but TrueCrypt says that the password is incorrect, the master key or other critical data may be damaged. The TrueCrypt Rescue Disk allows you to restore them and thus to regain access to your encrypted system and data (however, note that you will still have to enter the correct password then). In the Rescue Disk screen, select 'Repair Options' > 'Restore key data'. Then enter your password, press 'Y' to confirm the action, remove the Rescue Disk from your CD/DVD drive, and restart your computer.
3) If the TrueCrypt Boot Loader is damaged, you can avoid running it by booting directly from the TrueCrypt Rescue Disk. Insert your Rescue Disk into your CD/DVD drive and then enter your password in the Rescue Disk screen.
4) If Windows is damaged and cannot start, the TrueCrypt Rescue Disk allows you to permanently decrypt the partition/drive before Windows starts. In the Rescue Disk screen, select 'Repair Options' > 'Permanently decrypt system partition/drive'. Enter the correct password and wait until decryption is complete. Then you can e.g. boot your MS Windows setup CD/DVD to repair your Windows installation.
Note: Alternatively, if Windows is damaged (cannot start) and you need to repair it (or access files on it), you can avoid decrypting the system partition/drive by following these steps: If you have multiple operating systems installed on your computer, boot the one that does not require pre-boot authentication. If you do not have multiple operating systems installed on your computer, you can boot a WinPE or BartPE CD/DVD or you can connect your system drive as a secondary or external drive to another computer and then boot the operating system installed on the computer. After you boot a system, run TrueCrypt, click 'Select Device', select the affected system partition, click 'OK', select 'System' > 'Mount Without Pre-Boot Authentication', enter your pre-boot authentication password and click 'OK'. The partition will be mounted as a regular TrueCrypt volume (data will be on-the-fly decrypted/encrypted in RAM on access, as usual).
Note that even if you lose your TrueCrypt Rescue Disk and an attacker finds it, he or she will NOT be able to decrypt the system partition or drive without the correct password.
No comments:
Post a Comment