Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I store client files in my office computers and the staff need to have access to these files. The client files have to be kept completely confidential due to personal data.

So far, I have used Windows EFS and have converted all my files to PDF using "Adobe PDF encryption" with certificate encryption.

I thought EFS will protect if the drive is stolen and encrypted PDF files would protect if an employee copies the files and take them home.

Can I use TrueCrypt for whole disk encryption, with no pre-boot auth? So staff could restart the computer without sharing the TrueCrypt password with them?

share|improve this question

With TrueCrypt, there's no way to get rid of the pre-boot authentication process - it has to have a strong password or passphrase or it provides absolutely no protection at all.

Simply put, if the staff can boot into Windows without interacting with TrueCrypt, then so can someone who steals the computer, and that person can also decrypt the drive at their leisure.

If it's an issue of convenience rather than trust, you might consider having a YubiKey programmed with all or part of the TrueCrypt passphrase - these can be quickly inserted into the computer to complete a reboot, then locked up in a desk drawer or safe until the next time they are needed.

Otherwise, if you want the system to boot directly into Windows while still using full disk encryption, you'll need another solution. BitLocker+TPM+Secure Boot comes to mind in a Windows environment as an obvious option, but be aware that you may have to make some configuration changes to have a reasonable level of security - at the very least restrict access to the BIOS, block booting from removable drives, and insure that all Windows recovery options are configured to require an administrator's password. The obvious downside to this is that it requires hardware support within the motherboard itself.

If the issue is trust, or a policy requirement to not have shared passwords, there are various commercial encryption products out there that have different options for the pre-boot process. Some of these can authenticate with a server on the office network, so that the computers boot freely when used within the office, some of these offer robust user management, so that everyone has their own credentials to boot the system, and some of them offer support for hardware tokens - smartcards and USB dongles. These are enterprise-oriented features, so the products that implement them generally don't come cheap, but they are out there.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .