6

My situation

I know that bitlocker is meant to encrypt whole drives, but I have an hard drive that is already fully partitioned and containing data.
I'd like to encrypt part of one partition, leaving the rest of the partition accessible.

I would very much like to avoid programs like Norton partition magic (which resize/split partitions), because every time I used them I had problems with the data stored.

Question

Is there any way/builtin alternative/3rd party app that integrates with windows login to encrypt one subset of a partition?

EDIT

I heard horror stories about EFS, which is why I don't want to use it, unless there have been improvements on reliability with windows 8.
Some highlights from that article:

In fact I’ve only used EFS twice in the last ten years on my own computers and on both occasions I’ve lost files and documents. I therefore cannot recommend you ever encrypt your files with this Windows feature.

Unfortunately, because of incompatibilities with some differing versions of EFS files can end up scrambled and unrecoverable.

Improve this question
1
  • 4
    if you are afraid of document loss: "backups" is the right tool mitigate that issue. i have heard horror stories about using a computer as well: "from time to time things went belly up" ...
    – akira
    Nov 3, 2012 at 7:36

7 Answers 7

Reset to default
15
+500

What I would do is use Truecrypt instead.

You can create a container that will look like a regular file to the system and place it on your already-partitioned drive.

enter image description here

The created file can be moved around, etc., just like a regular file:

enter image description here

Then Truecrypt can mount that encrypted file, and it will appear as a new drive in Explorer that you will be able to use; put your stuff to encrypt there.

Not sure about automounting without password, but that sounds like defeating the purposes of encryption anyways; your logon password is easy to crack without full-disk encryption.

However, there is for example this project which lets you automount the volume when a certain USB key is attached.

Also, Truecrypt always allows you to automatically prompt you for the volume password on login by following these steps:

  • Mount the volume (to the drive letter to which you want it to be mounted every time). When you go to Computer, you will see the Truecrypt file showing up as a new volume:

enter image description here

  • Right-click the mounted volume in the drive list in the main TrueCrypt window and select 'Add to Favorites'.
  • The Favorites Organizer window should appear now. In this window, enable the option 'Mount selected volume upon logon' and click OK:

enter image description here

Then, every time you login, this window will appear automatically, letting you quickly type in the password:

enter image description here

(Taken from the Truecrypt FAQ.)

Again, if you can't be bothered to enter the password every time, try this project, which will let you mount it automatically if a certain USB key is attached.

Improve this answer
7
  • Using a short password like "mys3cretp4ssw0rd123" can be cracked withing hours. Using a 1024genreted key stored on a pen drive(that you guard with your life- and a copy stored in the floor boards at your grandmothers in Poland) should be used with twofish-serpent in whirlpool mode. The performance is only reduced slightly but cracking the password can take years or thousands of dollars using amazon.
    – WillyWonka
    Nov 8, 2012 at 10:48
  • 1
    A key is better, but as long as you use a sufficiently long and random password, you should be fine. Truecrypt recommends 20 characters.
    – David
    Nov 9, 2012 at 15:35
  • Yeah. If somebody is determined enough to crack your password, he will probably be determined enough to pull all your files and test them one by one :)
    – houbysoft
    Nov 9, 2012 at 20:08
  • @WillyWonka Since when is 19 characters considered a short password? If it only had 8 characters, then regardless of the mix of mix of character types it'd be quite weak.
    – user3490
    Nov 16, 2012 at 11:41
  • @WillyWonka doesn't truecrypt do key derivation?
    – João Portela
    Sep 11, 2013 at 16:39
5

Bitlocker is (kind of) a nickname for Bitlocker Drive Encryption. It works only on whole partitions.

There is another built in feature called Encrypting File System which you can use. It will encrypt the contents of a file or folder for you. The encryption is locked to your Windows user account and can only be decrypted with your Windows credentials. This feature has been available since XP.

See the following article for more details on how to do it... Windows 8 EFS

Improve this answer
1
  • I'd choose this as an answer, if it wasn't for the various unreliability reports that I've seen about EFS: edited to add an example (of many)
    – Razor
    Nov 2, 2012 at 20:12
4

You could partition your drive! Then BL only one partition!

Improve this answer
1
  • It's already partitioned and I'd rather not partition it further, unless absolutely necessary
    – Razor
    Nov 4, 2012 at 17:20
2

If you only want to encrypt part of a partition I recommend EFS. I don't know what happened to that guy's files (I don't think he does either), but MS is usually good with backwards compatibility and I don't see version changes in EFS breaking his ability to read his own files.

As long as you keep your key safe and secure it's perfectly reliable and does what you're looking for.

Improve this answer
2

Truecrypt is highly rated freeware while there are few mores which you can concern about.

Axcrypt is an open sourece program to encrypt the files.

Features of Axcrypt

Protect any number of files using strong encryption with password.

Right-click integration with Windows Explorer makes AxCrypt the easiest way to encrypt individual files in Windows.

Double-click integration makes it as easy to open, edit and save protected files as it is to work with unprotected files.

Many additional features, but no configuration required. Just install it and use it.

AxCrypt encrypts files that are safely and easily sent to other users via e-mail or any other means. Self-decrypting files are also supported, removing the need to install AxCrypt to decrypt.

AxCrypt is translated into English, Danish, Dutch, French, German, Hungarian, Italian, Norwegian, Russian, Polish, Spanish and Swedish so chances are it speaks your preferred language.

DiskCryptor is also open source software which can encrypt the partition as well.

DiskCryptor - it is a free solution that allows you to encrypt all partitions, including the system. This fact is free, in stark contrast to the fact that most of the software with similar functionality is completely proprietary, making it unacceptable to use for protecting sensitive data.

The ability to create encrypted CD and DVD.
Full support for encryption of external USB-drives.
Automatic mounting of disk partitions and external drives.

FREE CompuSec is specifically designed to protect desktops and notebooks, using pre-boot authentication and full hard disk encryption. Access control requires you to enter your userID and password before the system will boot up. Free CompuSec is free for both personal and business use.

FREE CompuSec includes several other encryption utilities: Voice encryption, encryption of individual files, removable media -- CDs, DVDs, USB thumb drives, and "Container" encryption (similar to TrueCrypt volumes).

The Pre-boot Authentication module is automatically installed on the drive to which the OS boots, but you don't actually have to apply Whole Disk Encryption to any drive if you don't want to.

AEScrypt is a simple program that adds a context menu item in the file system context menu. There is no program window as you have for most programs.

You simply right-click the file you want to encrypt or decrypt in the file listing, select the AES Crypt item, and enter your password in a little dialog box. A new encrypted or decrypted version of the file is created. In the case shown, the file name will be Bootstrap.kdbx.aes.

AEScrypt's user guide makes it more understanble to use.

Improve this answer
0

Generally speaking, tools tend to either encrypt partitions (i.e. continuous section of disk space comprising of multiple files, folders and meta data) or files.

If you want to encrypt a full partition, your two best choices are really BitLocker and TrueCrypt, as have been already mentioned in other questions.

But if what you really want, is just to make, say, all of the files within C:\Users\Me\MyDocuments encrypted to your login - your best bet is NTFS encryption.

In order to use NTFS encryption, right click on any file or folder and view Properties. On the first screen that comes up, press "Advanced" and then check the box saying "Encrypt contents to secure data" and wait for the action to complete.

NTFS encryption works by applying applying AES-128 encryption to the file whilst it lives on the disk, with the key derived from your login credentials. When you double click the file, Windows automatically decrypts the file for your applications, and the data is automatically re-encrypted into the file when the application saves.

When another user (even an Administrator) attempts to open your file, they will be prompted for your username and password. If they are unable to provide those login credentials, they will be unable to reconstruct the AES-128 bit key, and hence they will be unable to view your files. Similarly someone who obtains a forensic image of your drive will be unable to reconstruct the files without having access to your login credentials.

Improve this answer
-1

EFS is not unreliable. The biggest problem with EFS is that people forget that it's there, and then do something like re-install their OS, or take a drive and move it to another computer. Then they want to try and recover their files, but since they didn't bother saving a copy of their keys... no can do (which is a good thing, because if you can't recover your files without a key, nobody else can either).

You can find horror stories about anything on the web. There are tons of them about Windows 8 already. Most people just do not have problems, and when they do... it's usually their own fault.

Still, if you're determined to not use EFS, then there are already a lot of options presented here. Another option is that you can create a Virtual Hard Disk on your hard drive, mount it in Windows and then turn on Bitlocker for the VHD.

http://www.sans.org/windows-security/2009/11/17/bitlocker-attached-vhd-drive

Improve this answer
1
  • 1
    Please add a comment to my post rather than just downvoting it. Thank you.
    – SecurityMatt
    Dec 3, 2012 at 14:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .