Howto Encrypt your Harddrive in Microsoft Windows
Some versions of Windows 7 include Bitlocker, a utility which allows you to encrypt the system drive. This, however, is of little use to those not running the 'Ultimate' version of Windows 7. There is, however, a free alternative – TrueCrypt. TrueCrypt supports Windows 2000/XP/Vista and 7.
This walkthrough will show you how to encrypt your entire harddrive so that should your laptop be lost, an attacker will be unable to access your sensitive information (unless, of course, you left the laptop powered on!)
-
Visit http://www.TrueCrypt.org and download the latest version
-
Run the installer
-
When asked, it's strongly recommended that you create a System Restore Point.
-
Once installation has completed, run TrueCrypt
-
Press the “Create Volume” button
-
Select “Encrypt System Drive”
-
Choose “Normal”
-
Choose “Encrypt the Whole Drive”
-
Don't Encrypt the Host Protected Area
-
Set Encryption Algorithm to AES
-
Leave Hash Algorithm at the default (RIPEMD-160)
-
Set and confirm a password (See Bootnote 1)
-
Move mouse to help randomise the cryptographic pool (the more random your movements, the better)
-
Set the Rescue CD to save to the Desktop (or somewhere you can easily find it)
-
Burn the Image to CD (see here if you don't have burning software)- Bootnote 2
-
Choose a Wipe mode (A higher number of passes is more secure, but takes longer. Do Not select 'No Wipe' unless you have had no sensitive files on the system yet)
-
TrueCrypt will restart your computer
-
Enter the password you set in step 12 (the system may take a couple of seconds to begin booting)
-
TrueCrypt will load once the system is booted - Press Encrypt
-
Leave the system to it (May take a few hours - Bootnote 3).
When Things Go Wrong: The TrueCrypt Rescue CD
The law of averages guarantees that at some point, something will go wrong for someone, somewhere. This is why it's so important to store the rescue CD somewhere safe.
To use the CD;
- Place it in the CD Drive
- Check your BIOS settings allow booting from CD
- Restart the PC
- Enter your TrueCrypt Password
- System Boots.
Alternatively, you can utilise the other options offered by the rescue disk, including;
- Decrypt the volume
- Restore the TrueCrypt Bootloader
- Restore the Original Bootloader
- Restore Volume Header
All of the above are only possible if you know the TrueCrypt password we set in Step 12. Unfortunately, if you don't have the password you've no realistic option but to wipe the drive, re-install and start again.
Bootnotes
The standard rules on password strength apply - no dictionary words, mix of lowercase and uppercase. Keep in mind that this password is intended to deny access to everything that you've stored on the harddrive. If you've stored passwords to various services in your web-browser, this password could be the only thing preventing the attacker from gaining unfettered access to your accounts.
Keep the Rescue CD somewhere very safe. You'll need it if and when things go wrong. When deciding where to store it, keep in mind that an attacker could potentially use it to bypass TrueCrypt, so putting it in your laptop bag is not recommended!
If, for some reason, you're unable to leave your computer running for that long, you can click the 'Defer' button to interrupt the process. You can then shutdown/restart your PC as necessary and resume the process when it is more convenient. To do this, load True Crypt, select the volume in the top of the window and choose Volume --> Resume Interrupted Process
