Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I can't seem to find a way to encrypt my entire system partition or the entire drive and be able to skip the pre-boot authenticaion.

I need to be able to boot the machine into the normal encrypted system partition without a pre-boot authentication, so my sister can use the computer using her windows login. But I need the encryption if she ever tries to put the HDD on another computer as a removable drive...

I COULD use file containers, but we also want to encrypt files like "hosts" in the windows/system32/drivers/etc folder.

Does anyone know how to do this?

Thanks

PS: I use both Linux and Windows, so whichever answer there is, I can try.

Edit: I was thinking of saving a hash of my password for TrueCrypt boot loader to use, somewhere. I know it would be possible to find this hash and even reverse this hash given time, but I just need something to make it a little bit harder than just plugging my HDD on another computer and browse through my files...

Sorry, left a piece of important information out. My sister wants to see and use the programs I do so she can learn more about computer stuff. I think that's a good thing, so I wanna help her like that. Btw, I RARELY see her, because we study at different times, so always typing the password whenever she wants is not a really viable option.

share|improve this question
    
"I need to be able to boot the machine into the normal encrypted system partition without a pre-boot authentication" Once your system is encrypted, the only way to boot up is to authenticate the computer... How else could it decrypt your hard drive to load Windows? –  Breakthrough Mar 8 '12 at 18:48
    
Like I said in my edit, I was thinking if the TrueCrypt boot loader could save the hash or even the password itself somewhere to use at boot. I know it compromises security a lot, but it's just a simple way to make things harder for people to simply browse our files. –  SleepyMan Mar 8 '12 at 19:26
2  
It doesn't compromise security "a lot," it compromises security completely. That's the problem. This type of authentication would make the encryption meaningless. –  EKW Mar 8 '12 at 19:30
    
But for this case, I don't need the security like that. I just want to make it a little harder to be able to browse through my files and still be able to let my sister use the computer without her knowing the pre-boot authentication. If you know any other software like that, please point me to it. Thanks. –  SleepyMan Mar 8 '12 at 19:42
    
@SleepyMan this is why you use normal TrueCrypt containers in daily operation - you keep only the files you want encrypted. There's no point in the performance hit of encrypting your whole drive for those few files you actually need to be hidden. –  Breakthrough Mar 8 '12 at 20:09
show 8 more comments

5 Answers

up vote 2 down vote accepted

If you use Windows' Encrypted File System you can Encrypt your sensitive document folders, however BE SURE TO BACKUP THE DECRYPTION CERTIFICATE and store it on something outside of the computer (a USB key or other computer). There is a very good reason it is called the Delayed Recycling Bin, if you do not backup the certificate and your password is not changed using the normal change password methods (type in the old one, type in the new one twice) you will never be able to get to the files.

If you re-install windows (even if you use the same username and password) you will need the backup of the cert to get your files back, if you did not backup the cert before doing the re-install THERE WILL BE NO WAY FOR YOU TO GET YOUR FILES BACK).

I use the all caps-bold because I know you will think "I am careful, I will never need it" DO IT ANYWAY!!!


Fix for Hosts File Issue:
You can fix the Hosts file issue by using windows Automatic Proxy settings. Create a .pac file, encrypt it using EFS, then tell your web browser to use the auto-config settings from the file.

Here is a example of what to put in the file

function FindProxyForURL(url, host)
{
    if (0
    || dnsDomainIs(host, ".cn")
    || dnsDomainIs(host, ".doubleclick.com")
    || dnsDomainIs(host, ".doubleclick.net")
    || shExpMatch(host, "205.180.85.*")
    || shExpMatch(host, "66.40.16.*")
    || (dnsDomainIs(host, ".overstock.com") && shExpMatch(url, "*/linkshare/*"))
    || (dnsDomainIs(host, ".amazonaws.com") && shExpMatch(url, "*/udm_img/mid*"))
    || dnsDomainIs(host, ".gator.com")
    ) {
        return "PROXY 127.0.0.1:80";
    }
    else
    {
    return "DIRECT";
    }
}

The example is fairly self explanatory. it will redirect all of those listed items to localhost port 80.


Original Answer, talking about TrueCrypt and TPM. No longer my recommended solution

What you want is possible through a TPM, but TrueCrypt does not support a TPM. If the hash was not stored in hardware tied to a computer how would the drive know that it was in a different computer and happily auto-decrypt the data?

Also you need to ask your self, what are you protecting your self against. Pre-boot encryption only protects you from some very specific things:

  • someone waling up to your computer and start using it from a powered down state
  • taking the drive out of the computer and using it on another computer, or copying the drive then replacing your drive back.
  • A OS running on a non encrypted portion seeing the shutdown OS in the encrypted portion.

What it does not do is protect you from someone using seeing/copying your files if the OS is already running (think virus/sister snooping around).

Remember:Once you are inside the encrypted envelope everything looks like normal unencrypted data to the OS and anyone using the OS. Explain what you are trying to protect, and who you are trying to protect it from and we may be able to give you a better solution.


EDIT: when you say I just want to make it a little harder to be able to browse through my files who are you trying to make it harder for and in what way are they going to be performing the browsing?

share|improve this answer
    
Exactly, I don't plan on protecting while the system is running. ONLY when someone tries to simple plug it on another computer as a removable drive. That's it... Nothing more... I still want my sister to be able to use the computer as if it was NOT encrypted while it is using my encrypted system. Though I don't care if they plug it in another computer and boot my encrypted system, because then they would need my password to access my Document's folder. –  SleepyMan Mar 8 '12 at 19:50
    
If you don't care if they plug it in another computer and boot my encrypted system why are you encrypting it in the first place? If you want to do a setup like you want you will need to dual boot, one encrypted one not. There is no point in having a auto-decrpting system, it would just add IO overhead and no protection. –  Scott Chamberlain Mar 8 '12 at 19:52
    
The "protection" from booting my encrypted system would come from the OS login system... if the person doesn't have a login, he wouldn't be able to use the computer NOR see any files within it. But if a person DOES have a valid login, let that person use the computer, but the other's Document's folders will be outside their scope. That's what I want. Edit: Encryption would just stop those who plug it in another computer as a Removable Drive (they do not have the knowledge to extract a key from the drive, just assume that please) –  SleepyMan Mar 8 '12 at 19:56
    
What you want in Windows Encrypted File System, it does exactly what you describe and it protects it from being put in another computer too as the still need your windows password to get to the file. BE SURE TO BACKUP THE CERTIFICATE OR YOU WILL LOOSE YOUR DATA!!!! –  Scott Chamberlain Mar 8 '12 at 20:01
    
Answering your edit question: I want to protect from my friends who likes to gossip a lot... stupid stuff but kind of important for my social life. The EFS seems to encrypt files and what not, but what about password resetting? I know I can reset user passwords for Windows XP and Windows 7 and gain total access if the entire partition is not encrypted. Does EFS protect system files against those attacks? Because something like Hiren's Boot CD and Trinity Rescue Kit are among the small tools that my friends use. –  SleepyMan Mar 8 '12 at 20:05
show 5 more comments

An encrypted filesystem without pre-boot authentication is just a slow unencrypted disk. The authentication is how the system knows what the encryption key is.

share|improve this answer
    
I know that's how it would work for a security expert. But my case is just to make it a little harder for people to browse through my HDD. I just don't want people to be able to just plug the HDD in another computer and browse my files. This level of "security" would scare off at least 99% of the people around me, and that's more than enough for me. –  SleepyMan Mar 8 '12 at 19:46
    
@SleepyMan anyone who knows enough to know to remove a drive and use it in another computer would have no trouble getting around your "Security". –  Scott Chamberlain Mar 8 '12 at 19:50
    
Like I said, I know the people around me, they know almost nothing about these things... They are people who just "fix" computers by formatting and trying to salvage files plugging it in another computer... That's it... So for this case, just assume that this "security" is enough. Thanks. –  SleepyMan Mar 8 '12 at 19:52
    
This wouldn't make it harder for someone to browse through your HDD. When I want to look at the files on some USB stick I don't fire up my favourite hex-dumper and say "oh - that's an inode that points there, and that's a directory listing, and ... oh there's a textfile!". I plug it in and double click the textfile. By having encryption but no authentication, then sure, the bytes will look random on disk, but you've no protection from someone just plugging it in and taking a look around - which let's face it, is what someone would do if they wanted to see the files on your HDD. –  SecurityMatt Mar 8 '12 at 21:32
    
Uh... sorry I think you are missing the point... If encryption is enabled on the entire disk, then if you plug it in another computer you will NOT be able to just double click the textfile because the filesystem would be recognized as RAW and NOT as the actual filesystem (like FAT32, EXT3 or NTFS)... So by using encryption, I would at least stop those who cannot find the key (even though it would be in the disk itself). If I'm wrong, and you CAN just plug it in my HDD in another computer and double click my textfile and read it like normal even when it is encrypted, please tell me so. Thanks.. –  SleepyMan Mar 9 '12 at 15:29
show 8 more comments

Truecrypt doesn't provide this capability, for the reasons stated above.

Please note that full disk encryption only protects your data from hard drive theft if the key, or access to the key protected by the passphrase, is stored outside of that system.

Any encryption where the key is on the same system as the data it is encrypting can (and usually will) be compromised. Xbox, Wii, PS3, Xbox 360 have all tried this with their firmware and software keys and eventually failed to some degree. It just buys them time.

It sounds like you want to allow your sister to use the system normally, but keep your use of the system private. I would use Truecrypt to create an encrypted file container, and then use VMWare player to create a virtual hard drive within that file container and install/run your own "self-contained" and fully-encrypted operating system from that. There will be a loss in performance but a gain in privacy; you have to decide what is more important.

Alternatively you could run Truecrypt full-disc encryption inside a VM.

share|improve this answer
    
Well the fully-encrypted OS in VM is not a bad idea if it wouldn't ask for a pre-boot authentication as well. Performance is not a problem for an i7 Extreme Edition with SSD, etc. Thanks. –  SleepyMan Mar 8 '12 at 19:55
    
It's not possible to eliminate the pre-boot auth. However, your sister can use the actual machine and you can use the virtual machine. –  ultrasawblade Mar 8 '12 at 19:57
    
Sorry, left a piece of important information out. My sister wants to see and use the programs I do so she can learn more about computer stuff. I think that's a good thing, so I wanna help her like that. Btw, I RARELY see her, because we study at different times, so always typing the password whenever she wants is not a really viable option. –  SleepyMan Mar 8 '12 at 20:01
add comment

If you only want decryption to happen on one specific machine the encryption has to be done by hardware on THAT machine, which does not exist on another machine. They then need to take more than just a hard drive to access the data. truecrypt is software based so a no go.

For the boot loader, The question is how will it know that it's in this machine not another one. The hard drive is the only permanent memory and if you put the password there you they will take with the hard drive and have it work automatically just like on your machine defeating the purpose. Hashed or not.

if you are thinking of setting the boot loader to read something specific from your machine and use it as a password. serialnumber, motherboard model no, mac address or a password stored on another hard drive etc. I wouldn't recomend it here is why.

first, given what you'r saying they will crack this easily. and it's not even worth the effort. also this doesn't solve the sister problem. she can figure it out pretty easily. and I don't know how to set the truecrypt loader to read the password from hardware specs which need to be unique to this machine like a serial number.

you can be creative with this but it will NOT be worth it.

share|improve this answer
add comment

A bit late to answer but here's my two cents :)

Maybe sleep mode would give you what you need, when your pc wakes up from sleep mode you do not have to give the pre-boot password. If the PC powers down or the drive is connected to another machine the password would need to be given again.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.