possible to encrypt "C:\Users\user1\AppData" with truecrypt?

Question

I am looking for a way to encrypt some of the profile folders with truecrypt. Encrypting the system drive is not an option.

How can I encrypt C:\Users\user1\AppData with truecrypt?

Answer 1

It is possible, I'm doing it myself. It's kind of a hack, but it works surprisingly good. This method is based on the fact that Windows allows redirection of the AppData folder.

Short version of my answer:

1. Logon as another user
2. Move the content of the first user's AppData folder to the TrueCrypt volume
3. Delete the AppData folder and replace it with a NTFS junction (folder redirect) that points to the TrueCrypt volume

Details:

First, logon as another user with admin privileges, as we cannot copy AppData from a user who's still logged on. Create a file-based TrueCrypt container and mount it. Open the profile path of the user in Windows explorer and confirm the request to gain access rights, this is important for the next step. Copy the AppData folder to the TrueCrypt container. For proper copying of all system files and security settings, do not use Windows explorer, use a tool like robocopy from within an elevated command prompt:

robocopy C:\Users\user\AppData x: /E /COPYALL /XJ /W:0 /R:0

Where x: is your mounted TrueCrypt volume. This will ensure that all NTFS metadata is copied as well. Do not omit the /XJ switch or you'll be stuck in an infinite loop.

Now you'll have two options to actually change the path to AppData that is used by Windows. The first method is to delete the old AppData folder entirely and replace it with a NTFS junction. This is basically a replacement shortcut that allows to transparently redirect one folder path to another location. To delete the old AppData folder and create a junction, open a command prompt (still with the second user) and type:

rmdir /s c:\users\user1\AppData    
mklink /j c:\users\user1\AppData x:\AppData

Where x: is your mounted TrueCrypt container. If you have trouble deleting the AppData folder because you're getting a message that it's not empty, try this: How to delete a file in Windows with a too long filename? (the first answer)

The second option is a soft redirect by changing the path to AppData that is stored in the registry. Note that this will not delete the old AppData folder, and older or poorly made software could still try to write to the old location because it might use a hardcoded path and not properly read the path from the registry. I found that this is very rare, though, and this approach works almost as well. Here's how to do it:

Logon again with the first user account, open regedit and navigate to:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Then change the values "AppData" and "Local AppData" to point to your TrueCrypt volume, e.g. X:\AppData\Roaming and X:\AppData\Local. You can also change all the other shell folder paths in this registry key, like the Desktop and Downloads folder, if you want to encrypt them as well. Then log off and log on again, and you're done.

After making sure everything works properly, you can again logon as a second user and delete the contents of the old AppData folder (not the folder itself, this will cause problems).

With either of the two methods used, from now on, you'll obviously have to mount the TrueCrypt container right after each logon, or programs will not work properly if they cannot find the AppData folder. You'll also have to restart explorer.exe after mounting the container, because Windows cannot properly load the task bar and start menu without prior access to the AppData folder. Here's how I automated this process with a batch file that is automatically executed at logon:

taskkill /f /im explorer.exe
"C:\Program Files\TrueCrypt\TrueCrypt.exe" /v "c:\users\user\AppData.tc" /ld /q
start "" explorer

Apart from the quirky logon process, everything works as it should.

For compatibility with older programs, you'll also have to modify the legacy special folder redirects in your user folder root. Open a command prompt, navigate to your user root folder and type

dir /a

Look for the JUNCTION entries. The most important are "Application Data" and "Local Settings". They still point to your old AppData folder. Delete them (del command) and create them again (mklink /j command) to link them to the correct paths.