Community Newsletter: Q&A forum: Encrypting and password protecting files and folders on my PC

Mudiaga, I have to commend you for what you are trying to do. So may people have sensitive data on their computers, often open to the internet or others with access to the computer, with little or no protection.

There are several programs available, but the ones I have used are TrueCrypt, Kruptos 2, and AxCrypt. They are all free - TrueCrypt is even open-source. You didn't say what OS you have, but XP and Vista also have their own encryption capabilities built in.

I would not suggest using the Windows encryption. It has some flaws and several limitations. The encryption is based on your user profile's name and password. You must export your certificates and private keys in the event that your user profile becomes inaccessible for some reason (ex. corrupted, infected). Without those, you won't be able to decrypt the files. Since the encrypted files are only accessible by your user profile, you can't share them with others in an encrypted form. Also, if you are logged in, your encrypted files are accessible, so don't walk away from your PC without logging out or otherwise preventing access.

Enough of what I don't like. Of the three programs I mentioned, Kruptos 2 and AxCrypt both encrypt on a file by file basis. They both use 128-bit encryption keys. When installed, they are integrated with Explorer's right click menu, so you don't have to start another program. AxCrypt has the ability to decrypt and encrypt on the fly, so if you try to open a file that is encrypted, you will be prompted for the password. With the proper password, the file will open in it's associated program. When you close the file, it will automatically be re-encrypted, so you don't have to remember to take the extra step of re-encryption. Both programs also have good file destruction features; when a file is encrypted, the original file is destroyed, keeping anyone from resurrecting it from the hard drive.

TrueCrypt is much more powerful, but works differently than Kruptos or AxCrypt. TrueCrypt uses 256-bit encryption keys, and gives you the choice of three different encryption methods (or even two or all three at the same time) - take a look at TrueCrypt's web site for lots of good information on the methods. The difference with TrueCrypt is that you need to create a container that is encrypted. The container can be a drive (don't ever encrypt your Windows drive!), partition on a drive, or a file with any name you want to give it. When you mount this container using TrueCrypt, you assign it to an open drive letter. Once mounted, it acts just like a drive - you can move files to and from it, open files on it, etc. This is beneficial if you need to frequently access your encrypted files; you will only need to supply the password once to mount the container, and then you can work with all the files until you dismount the container. You need to remember to dismount the container if you leave your computer, since it is fully accessible when mounted. The difference between TrueCrypt and Windows' encryption is that the Windows encrypted files are always accessible when you are logged in, while TrueCrypt containers don't need to be mounted unless you need them.

Whenever you encrypt a file, you run the risk that if any part of the file is corrupted - just one bit - the file won't be decryptable and yo won't be able to use any recovery software to try to even recover part of the file. It will be gone. Did I hear someone say back up and back up often??? TrueCrypt is very vulnerable this way, because the container can be a single file. Recognizing this, TrueCrypt allows you to export the header information (a 1k file) so in the event the header of the file is corrupted, you can import the header and recover the entire container (or at least the uncorrupted portions of it).

No matter what method you choose, be sure to use a very secure password - long, letters, numbers, special characters, and not common words or names.

Before making a decision, take a look at the manufacturer's web sites - they each have pretty good descriptions of what their programs can (and can't) do. TrueCrypt's is by far the best for info, both for general encryption and the program itself. But no matter what, do something to protect your data!

I have used all of these programs, and am currently using a TrueCrypt container to hold all of my sensitive information. I back it up every night, so have never had any lost data even through a failed hard drive.

You didnt mention your operating system, but if you are using Windows XP (Professional and Media Center editions) or Windows Vista (Business or Ultimate), the first option is EFS (Encrypting File System). It is a security feature built-into the OS, enabling you to encrypt files such that only you can access the files by logging into your account. The benefits are that there is no third-party software to purchase/install, no additional passwords to remember, and no need to launch a program just to access or encrypt a particular file. Just right-click the file(s) or folder(s) in question, select Properties, click the Advanced button, and check the box labeled Encrypt contents to secure data. The initial application of encryption can take some time, but if you encrypt the entire folder any file saved or copied to there from then on will automatically be encrypted on the fly with little to no reduction in performance.

However, EFS is far from perfect. If you are logged into your account, no additional protection is available. (If someone takes over your computer while youre logged in they have full access, just as you did. Secondly, if Windows becomes corrupt you may lose access to your files, since the encryption is directly tied into the OS. Finally, tools to circumvent EFS are widely available for $100-$200, so anyone could crack your files open if they were willing to pay the price.

The second option is Bitlocker, a new feature of Windows Vista Ultimate edition. Its much more secure for even Windows cannot boot without the correct passcode, protecting not just your personal files but your OS as well. So far there are no commercial workarounds available and everything is done in the background, making it an ideal solution for those who worry about stolen laptops. Like EFS, though, its tied into the OS so if it becomes corrupt your files may be lost, and if someone takes control while youre logged in theres no stopping the unauthorized user. Plus, unlike EFS, theres no simple recovery option should you forget your passcode or have the OS go south.

The last option is third-party encryption software; TrueCrypt is one of the most well-respected freeware options while Cryptainer is my personal favorite. They both enable you to drag-and-drop your files into an encrypted folder, which can even be hidden from view of all other users, a feature EFS and Bitlocker lack. Theyre also completely independent of the OS, so you can copy the encrypted folder and take it with you, accessing it on any computer while keeping the contents safe. To top it off, no one can access your files even while youre logged into Windows unless they also have the passcode for the encrypted container. Considering youre not limited by your OS (Windows 95 or better will do, and TrueCrypt runs on Linux) or transportation choices (works on flash drives, CDs/DVDs, etc.), its a worthy trade-off for the lack of automatic, on-the-fly encryption.

And on a final note, be sure to keep your security software up-to-date. No matter how many layers of encryption and password protection you employ it could all be for nothing if spyware is installed on your computer, designed to log your keystrokes (including passcodes) and/or take pictures of your activities. PCTools' Spyware Doctor, Webroot's SpySweeper, and AVG's Antispyware are the top-ranked options to protect yourself against such, but there are many other options available.

Hope this helps,
John

I had not heard about that legislation, so if you have any article names or links I'd love to read about it. (Plenty of talk and proposals, but nothing definitive.) It doesn't seem feasible, though, given the shear number of encryption programs and algorithms that currently exist with no backdoor 'skeleton keys' to be handed over. They'd all essentially have to be rewritten, but previous releases would still be unaffected.

As to knowing which may or may not have backdoors built in, it's nearly impossible to tell with proprietary software. Microsoft has strongly disputed claims stating that they have granted the US government backdoor access into Vista's Bitlocker, adding that they themselves do not have a secret entrance or method of decryption. That can't be easily proven one way or the other, but open-source offerings hold few secrets since anyone can view the source code and search for backdoors or other vulnerabilities. On that end see PGP/OpenPGP, for which there is reportedly no backdoor in existence.

John

TrueCrypt has many advantages, especially its Linux support and absentee price tag. However, Cryptainer is more convenient for me to use, particularly since:
1.) It has a PPC/WindowsMobile version.
2.) Cryptainer Mobile has been simpler and more reliable than TrueCrypt's "traveller mode," particularly when administrative limitations were imposed on the machine being used.
3.) The ability to send self-decrypting e-mail attachments is a nice touch instead of having to tell the recipient another program must be installed for the contents to be accessible.

I'd love to see TrueCrypt's 'plausible deniability' touches added, but for the time being Cryptainer is just the best match for my needs.

John

This info is not available over the internet BUT when I was at Area 51 this summer, they had a CD for sale with all the info.

Hope this helps.

Hy John,

I've been reading your reply to the question of the week. I'm wondering if you know if there are some software able to detect encripted files on a laptop which you didn't know that exist (I mean the encripted files of course). And in relation to this, if I install on my computer (system winxp)this truecrypt, can I encrypt all type of files like files with .exe extension permiting to they working with normality?

Regards,
Tuti

So far, any executable I've stuck in the Truecrypt mount points have worked, but I've only tested a few. I tend to prefer to install software in the native file systems, then point the data directories to the encrypted volume.

However, in a fit of misdirection, I have dropped an Alcohol 120% image of a CD into the Truecrypt mount (Windows XP), then mounted *that* image using Alcohol, and it ran fine, faster than from the CD and not significantly slower than from NTFS.

I've actually been asked that question quite a few times, though most frequently concerning military installations here in the US. It's a shame, though...I've always wanted to visit the UK.

John

Ive used FileBarricader 2004 for encryption of important documents. Its free and encrypts up to 256 bits.

Download at download.com

http://www.download.com/FileBarricader-2004/3000-2092_4-10454526.html?tag=lst-0-1

A computer is as open as any information on the net if someone wants it. The only way to protect information that is that important. You need an armored car. Anytime you open you computer you take a chance of loosing information. A firewall will help if no one wants what you have. But the best thing is not put that information on your computer. These days there are too many flash drives and other carry alone devices that is not open to any one but the guy that has the flash drive. The better ones have protection. You can have these for a few bucks these days. As the young man the broke the code for the Iphone. You know ATT spent a lot of money to make the Iphone thiers. But a 17 year old broke it. Locks have always been to keep the honest person honest. If they want in you can not keep them out if you leave an open door as the internet to them.

I use a very low cost ($37.50 U.S) program called AISBackup from http://www.aiscl.co.uk/. I use this in conjuction with 2 cheap External USB drives (swapped alternately offsite weekly). The program allows you to create a boot CD based on BartPE with a the AISBackup restore plugin so that you can boot into the Live CD in a Windows XP encironment and do a bare metal restore. AISbackup will backup Win9x/ME/NT/NT Server/2000/2000 Server/Windows XP/Windows Vista and Server 2003 (see http://www.aiscl.co.uk/requirements.php).

If your Hard drive fails, you just replace it with a new drive, boot into your Live CD, create & fornat a partition and restore from the attached Exterbal USB drive to the new drive via the AISRestore Plug-in.

AISBackup has many features including backup of open files, Registry, NTFS permissions and works in conjunction with FAM to even allow backup of opened Exclusive files (SQL, Exchange, etc) so that no programs have to be shutdown during the backup.

Files are backed up in groups into normal zip files that can be opened by any Zip compatible archiver. Since it uses zip, you can expect the backup to to be 1/10th to 1/2 the original data size. You can specify backup jobs to be session or generation based (see above link for explanation). A database of the backup is maintained on the local PC and on the external backup drive. The database allows every backup (except the first one) to be an incremental that is back filled to a full from the database. Since I swap drives weekly, I have the backup read the database from the backup media so that all my backups are able to back fill from the week that the drive was offsite.

I also backup both PC's to the same USB drive. One backups directly to the USB drive and the other backups across the network to a UNC or mapped drive. Backup to Email, FTP, DVD/CD or anything with that supports a drive letter is also supported. AISBackup allows you to use one license for two PCs (non-commercial) at no extra charge (site license available for commercial use).

You can download and try AISbackup for free for 30 days (non consecutive days aren't counted so if you use it one day a week, it will last 30 weeks, using it 10 times in one day still counts as 1 day). You can also request a re-trial for an additional 30days.

I have been using this program for about 8 years now and like it so much that I have become a reseller. You can purchase it online if you like it but I would appreciate it if this article has swayed you to put the business through me. After downloading and trying the software, Please contact me via email "jmt@world-net.co.nz" to organize a license key and payPal transaction.

I found a little free program called Kruptos 2 that I found works quite well. You can encrypt a file or folder using a password that you choose. I saw it listed on CNET last week.

Mudiaga, the first think is to check your OS. The 'business'/expanded versions of WinXP & Vista have the option of encrypting your NTSF files. Also OfficeXP [2002] & up files have the option to assign a password & encrypt their individual files in Word, Excel, PowerPoint, etc. & so may other sfw programs you have, have this password/encryption option. If for example you have the Home version of WinXP, as I do, then I would recommend 5 freeware programs, which you can probably find @ CNET's Download.com, as follows:
1. TRUECRYPT - offers several different encryption algorithems for encryption of whole a Hard Drive [HDD], a Partition or individual files or folders, at your option.
2. PASSWORDSAFE - this program will generate passwords for you & allow you to keep a listing of them. You can keep this password data file index on external media [e.g. floppy, thumb-drive, CD-R, ext. HDD, etc.]. I happen to keep mine on a SuperDisk, that I only insert, when I want to establish a new file password/user-id or retrive a stored one. The way this program 'pastes' this info into files, defeats 'keylogger' spyware.
3. AI ROBOFORM - this program will also generate passwords & store them & user-id & idenity info in a data file that has the option to be encrypted & password protected. AI ROBOFORM will login webpages with user-id & password that you have previously visited. It will also fill-out web forms w/identity info [name, address, social security #, credit card #s, phone number, etc.] & again it also will defeat keylogger spyware & helps protect against identity theft.
4. SHRED - deleting files/folders on your HDD does not remove the data, it just makes the space on the disk available to be written over & a good hacker could retrive this data before it's space is used several times again. While SHRED will allows you several options [including those meeting DoD stds] to overwrite the file several times with combinations of '1' & '0' until the info is not retriveable.
5. ZONE ALARM - if you don't already have a sfw firewall that prevents unathorized outgoing data transmittial; then I recommend this program be downloaded & installed on your PC to help with your data security. I already assume that you have Anti-Virus & Anti-Spyware programs & are keeping your OS & other sfw up to date. This will also make your PC harder for someone to 'hack' into or 'steal' data from you.

PASSWORDSAFE & AI ROBOFORM allow you to use 'strong' passwords, & other than remembering their passwords, you don't have to worry about forgetting the passwords you assign to different files, folders, webpages, etc. You will have better security against someone retriving the data on your HDD, if you use different 'strong' passwords for @ file, folder, webpage, etc.

I hope this helps answer your question.

P.S. I also use PASSWORDSAFE to store copies of my sfw 'keys', in case I have to reload a program w/one & associated user-id, as appropriate.

Go here and get this--I use it all the time and it is free.
www.shareup.com/Kruptos_2-download-38236.html

The encryption software that I use is CruzerLock. You can find the free 2.84MB flash drive version here: http://www.sandisk.com/Retail/Default.aspx?CatID=1274. Also, the PC version that is not free and may range from 15$ to 80$ can be found here: http://www.encryptx.com/eCommerce/productinfo.php?lic=RMA8QPLAQ73XGR3S4AGAPUK94C)%22=&rstn=sand001. Even though not free, the second software is for use with the PC, while the first, and free sofware is used for Flash drives only. If you really want to keep your PC files safe than I would suggest spending a couple bucks and getting good software that will really provide you with great file encryption! Make sure you read everything on the second link page so that you purchase the right software. :-)I hope I helped, and hope you find the right answer!