3

What is the best way to encrypt multiple separate hard drives?

I have a Windows 7 desktop computer with multiple drives for various media- boot drive, video game HD, media HD, a Raid setup - and I would like to encrypt them all. I don't know what would be the easiest way to go about this.

I have previously used truecrypt to encrypt a drive and I was satisfied with how it functioned, but I now have multiple separate drives and a RAID setup.

The problem with encrypting all the drives separately with veracrypt/truecrypt is I would need to type in the password for each drive after I log in which is fine but maybe someone knows of a simpler way?

  • If you use RAID, don't you have one virtual device that combine your physical devices ? Encryption should be done at this level so you do it only one. – Uriel Aug 30 '15 at 12:41
  • @Uriel in my case i have three individual drives and a separate raid. The reason i don't raid 0 the three drives is that they are all different types of drives (ssd, 2.5" hdd, 3.5" hdd). In my case i would like to keep these drives separate as im not so confident in the life span of some of those drives. As for the raid i understand i can encrypt the entire raid setup. But my question pertains to what is the best way to encrypt individual drives on a desktop. – user26409 Aug 30 '15 at 15:50
  • If you want to keep disks separate at some point, I am not sure you could have a single encrypted filesystem on top of this. You could play with encfs (see EncFSMP on Windows) and use mountpoints to your disks underneath, but that seems more a dirty hack than anything else... – Uriel Sep 1 '15 at 7:38
  • Veracrypt supports automatically opening "favorite containers". This can be a D:\-SystemContainer that's automatically opened when the C:\-Systwmcontainer is opened – BlueWizard Jun 21 '16 at 20:42
1

Windows BitLocker has the ability to auto-unlock data drives if the system drive is also encrypted using BitLocker. Here, "Data Drives" refer to drives that are not the Boot/System Drive. So, these will be your Gaming HD, Media HD, and RAID Setup.

Below is a step-by-step guide on how to set this up if you decide to use BitLocker, with the assumption that you do not have a TPM (Trusted Platform Module). You may need a spare USB Stick, I'm not sure if Windows 7 allows systems without TPM to use BitLocker without a USB Key.

  1. Open Group Policy Editor (WIN+R and enter gpedit.msc).
  2. Navigate to Computer Configuration \ Administrative Templates \ Windows Components \ Bit Locker Drive Encryption \ Operating System Drives and double click Require additional authentication at startup.
  3. Set to Enable and make sure "Allow BitLocker ..." in the options is checked.
  4. Now, open BitLocker Manager (Control Panel\All Control Panel Items\BitLocker Drive Encryption).
  5. Go through the Wizard to configure your Data Drives.
  6. Go through the Wizard for your System Drive (USB Key and/or Password).
  7. Going back to the main BitLocker Manager, you can now set each Data Drive to auto-unlock.

Note that in step 6, if using Windows 10 (and iirc 8.1), you will get the option to either specify a password, or to create a USB Key, or (later) both.
I think on Windows 7, your only option is to create a USB Key.

Note that in step 7, if Windows 7 BitLocker Manager does not provide you the option of auto-unlock, open cmd or powershell as administrator and type in the following command.

manage-bde -autounlock -enable $driveLetter

where $driveLetter is the drive letter of your Data Drive (including the colon, for example D:).

Now, on each boot, you will be required to put in the USB Key or the password. Then, the Data Drives will automatically unlock. If you ever need to access the data of the Data Drives on another computer when your current computer dies, you can use the password you set (or a USB Key, if you configured one) to unlock them. This applies to the System Drive as well, but you must mount your System Drive as a Data Drive on the other system (which also has to be running Windows).

  • I didn't know bitlocker had that capability, thank you. Unfortunately my motherboard doesn't have TPM slot otherwise that would be my preferred method. Wouldn't using a usb drive as a substitute to a TPM chip be vulnerable to something like badUSB? After you mentioned auto mount i also found this for veracrypt veracrypt.codeplex.com/wikipage?title=Favorite%20Volumes so it looks like i have options but the method is what i was looking for thank you! – user26409 Sep 2 '15 at 6:23
  • From what understand about BadUSB, it is an exploit that causes USB devices (be it flash drive, keyboard, mouse, etc.) to behave in a pre-specified manner. One potential attack is for the USB to "become" a keyboard and do stuff to the computer (e.g. start command line as admin (easily done if USB pretends to be keyboard, and the current account is admin already)). So, if you plug in a USB infected with BadUSB, regardless of how you encrypt your stuff, the USB will still be able to do whatever it wants to, such as disable encryption, disable anti-virus, and download malware. – nehcsivart Sep 2 '15 at 18:45
  • Thank you. I tested bitlocker and was surprised. Aes-256 option. Can use TPM module, usb or a password to unlock the drive. Also other drives can be unlocked after you get into the bootdrive automatically. Bitlocker searches your usb drives and if it finds the encryption keys it will automatically unlock the drive. Or if the flash drive is broken one can resort to a password. Alot of option with bitlocker and it was easy which was what i was looking for. Secure? Idk howtogeek.com/199171/… – user26409 Sep 28 '15 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.