- Create a new file-based container.
- In the main window, Create volume
- Create an encrypted file container → Standard volume
- Select where you want to store it. (I have an
AppData.tc in my user directory.)
- Accept the default encryption algorithm.
- Select how big do you want the volume to be.
- Enter a password, or pick a key file, or both.
- Format the volume. (I personally choose NTFS as filesystem, for some reliability.)
- Even though file-based, the container still has a standard filesystem.
- The Linux term is "loop mounting".
- Click Exit.
- In the main TrueCrypt window, open the freshly-created volume.
- Use Select File
- Pick an empty drive letter from the big list
- Click Mount
- You can make this step mostly-automatic through Favourites → Add Mounted Volume to Favourites.
- Move your Thunderbird profile.
- Copy the current profile from your AppData folder to the drive you chose in 2.2
- Usually it is in
%APPDATA%\Thunderbird\Profiles and has a name similar to
- After copying, rename to
Thunderbird profile or something, to avoid confusion later.
- Securely wipe the old profile.
- I used to like Eraser, until it received a complete rewrite and became inconvienent to use "but it's .NET now!"
- Now I stick with
- Tell Thunderbird about the new location. It's kept in
%APPDATA%\Thunderbird\Profiles.ini, but there's an easier way to update it:
- Start → Run → enter
- Delete your current profile. Click Don't delete files; you already nuked them in step 3.2.
- Click Create Profile, enter any name (such as
default), and click Choose Folder.
- Pick the location of your encrypted profile from step 3.1.
- Start Thunderbird.
If you decide you do not like TrueCrypt, there is FreeOTFE, which works in mostly the same way.
With Windows' built-in Encrypting File System: Not to be confused with BitLocker.
You mentioned that you do not want to use filesystem-specific features, but they can be useful at times.
- Browse to your Thunderbird settings folder. Usually
- Right-click on
Profiles, choose Properties.
- Advanced → Encrypt contents → OK → OK
- Start Thunderbird.
- Backup the encryption key. You only need to do it once for your Windows account.
- Start → Run →
- Personal → Certificates
- Find the one with "Encrypting File System" in its "Intended Purposes" column.
- Right-click, All tasks → Export
- Click Yes, export the private key
- Enter the encryption password for the exported key, and choose where to put it.
- Oh, one more thing. You have to somehow wipe the old, unencrypted data. I use
cipher /w:C: to wipe all unused space, but even one pass takes a long time...
The downside - EFS is only available in Windows * Professional and up.
From a comment:
The only other way (besides transparent encryption, as above) is to build crypto capabilities into Thunderbird itself. And considering the complexity of the program, it is not a solution.