Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am getting a new laptop soon which comes stock with 2x128GB Raid0 for the primary partition with Windows 8 Pro installed on it. It also has a 1TB hard drive for storage stuff. My question is that I will at times be using the laptop for some personal stuff. In the event that I were to be fired (or something unexpectedly terminated), I would gracefully return the laptop. The company is due back their property, both physical and digital. However, the personal stuff (pictures of my daughter, some Word Documents, etc.) I would not want them to have access to. Since I would be giving the laptop back in a moments notice, I would want to ensure that my data (which would reside on the 1TB drive) would be encrypted so that the Network Admins or anyone wouldn't be able to access the data.

Potential Solution:

I'm thinking about just relying on TrueCrypt which has served its purposes in the past very well. With modern CPUs supporting AES, it is very minimal performance impacting. I could just rely on the TrueCrypt and encrypt the whole 1TB hard drive. Assuming that I'm using a complicated passphrase, would you imaging that my personal data (as far as the IT staff were concerned is gone or pointless to try to recover)?

Another Solution:

Based on the answer of the first potential solution being that it would take too much effort to hack a encrypted drive, what about another potential solution; BitLocker? My fear about BitLocker was that since the computer would be part of the Domain Controller (unsure what version of Windows Server), would the System Administrators be able to disable/decrypt the Bitlocker without having known the passphrase? Since they would have full access to the primary OS and this laptop would be joined to their domain, would they have "override" capabilities to send a decrypt command that would grant access to the personal data on the 1TB drive?

share|improve this question
2  
There is another solution use a personal flash drive for your personal documents –  Ramhound Sep 22 '13 at 4:02
    
When you are using the computer the volume is decrypted, and if you are connected to the corporate network or a corporate installed program can access that data. If you are that concerned about your private data, it shouldnt be on the corporate computer or network. –  Keltari Sep 22 '13 at 5:16
add comment

1 Answer

up vote 2 down vote accepted

You have few potential solutions here.

  1. Whole disk encryption: Here you must use BitLocker because TrueCrypt cannot encrypt system partition in Windows 8. It might be capable in future but it isn't yet.

  2. Encrypting single partition: Both BitLocker and TrueCrypt are fine here. Assuming that you use just a pass-phrase to encrypt data, your system administrators will not be able to decrypt this. Personally it all depends which one you like, but I don't see any issue in going with Bitlocker here. I just find it a bit more comfortable to work with.

  3. Encrypted file container: This is TrueCrypt only. You can make a whole encrypted disk. While encryption is not running, it is just a single file that can be easily backed up. Once decrypted it becomes just another drive.

  4. Encrypted virtual disk file: Since Windows 7 you can have whole disk emulated inside of single virtual disk file (VHD). Just go to Disk Management, Action, Create VHD and you will have disk in a file. Then you can encrypt this disk with either TrueCrypt or BitLocker (I again prefer BitLocker for its convenience). If you need to return laptop, just copy that one file and you have everything with you. It is a bit annoying to attach it every time, but not more than in scenario 3 with TrueCrypt. And you can always attach it automatically.

I personally would go with solution number 4 (BitLocker encrypted virtual disk file) just because I find it fits my workflow a bit better (VHDs can be used in virtualization software). Close second would be 3 (TrueCrypt's encryped volume).

share|improve this answer
    
I would add that if encryption is enabled on the partition, Windows File Encryption can be applied at the folder all the way down the the file level. As long as the OP doesn't disclose his/her account password when returning the laptop, the encrypted data would be inaccessible. This solution doesn't require any additional software and doesn't require the all-or-nothing solution presented by BitLocker. –  BillP3rd Sep 22 '13 at 4:52
    
@BillP3rd - Windows passwords can be relatively easily hacked –  Keltari Sep 22 '13 at 4:55
    
@Keltari - If you mean resetting the Administrator (or other user's password) using a LiveCD, that's true enough. Cracking (recovering) an existing user's password is also possible, and depending on complexity (or lack thereof), not difficult. However, not even Ophcrack can crack a password longer than 14 characters. –  BillP3rd Sep 22 '13 at 5:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.