Quote:TrueCrypt is a software system for establishing and maintaining an on-the-fly-encrypted volume (data storage device). On-the-fly encryption means that data is automatically encrypted or decrypted right before it is loaded or saved, without any user intervention. No data stored on an encrypted volume can be read (decrypted) without using the correct password/keyfile(s) or correct encryption keys. Entire file system is encrypted (e.g., file names, folder names, contents of every file, free space, meta data, etc).

Files can be copied to and from a mounted TrueCrypt volume just like they are copied to/from any normal disk (for example, by simple drag-and-drop operations). Files are automatically being decrypted on the fly (in memory/RAM) while they are being read or copied from an encrypted TrueCrypt volume. Similarly, files that are being written or copied to the TrueCrypt volume are automatically being encrypted on the fly (right before they are written to the disk) in RAM. Note that this does not mean that the whole file that is to be encrypted/decrypted must be stored in RAM before it can be encrypted/decrypted. There are no extra memory (RAM) requirements for TrueCrypt. For an illustration of how this is accomplished, see the following paragraph.

Let's suppose that there is an .avi video file stored on a TrueCrypt volume (therefore, the video file is entirely encrypted). The user provides the correct password (and/or keyfile) and mounts (opens) the TrueCrypt volume. When the user double clicks the icon of the video file, the operating system launches the application associated with the file type – typically a media player. The media player then begins loading a small initial portion of the video file from the TrueCrypt-encrypted volume to RAM (memory) in order to play it. While the portion is being loaded, TrueCrypt is automatically decrypting it (in RAM). The decrypted portion of the video (stored in RAM) is then played by the media player. While this portion is being played, the media player begins loading next small portion of the video file from the TrueCrypt-encrypted volume to RAM (memory) and the process repeats. This process is called on-the-fly encryption/decryption and it works for all file types, not only for video files.

Note that TrueCrypt never saves any decrypted data to a disk – it only stores them temporarily in RAM (memory). Even when the volume is mounted, data stored in the volume is still encrypted. When you restart Windows or turn off your computer, the volume will be dismounted and files stored in it will be inaccessible (and encrypted). Even when power supply is suddenly interrupted (without proper system shut down), files stored in the volume are inaccessible (and encrypted). To make them accessible again, you have to mount the volume (and provide the correct password and/or keyfile).

Source: http://www.truecrypt.org/docs/

Quote:This isn't meant to be advertising for or against computer encryptions. Facts are, I encrypted my computer and it saved my life, my reputation and everything I have.

In February 2004 my house was raided by the FBI. They came with the full van and armed agents. They rushed in, presented a warrant and mentioned they had proofs somebody here had downloaded child pornography. Now understand this: this isn't a whole child pornography is good / child pornography is bad story. I don't know if people who watch child pornography turn into pedophiles or not (I don't think they do). I am not saying what I did was good, or even legal.

I had downloaded some child pornography. Not a lot of it, maybe 30 pictures. I am NOT sexually attracted to children and promptly deleted most of them. Since I had a large pornographic collection, there might have been a few I wasn't able to find, and delete. I never watched these pictures or masturbated to them. That being said, I accept my responsability of downloading them. One thing I should say: I downloaded them all in one day, without knowing it was actual pornography (i.e. downloaded a file that wouldn't indicate it contains child pornography).

They promptly took my computer, my external external hard drive and my laptop. They took my parents' computer as well. I was detained for interrogation.

And I was smart.

The very first thing I said, even before the interviewer dropped his pen, is "I want my attorney." Note: I had no attorney. I was bluffing. The officer said "Sure," took a few notes, and asked me for a few details "to file the case." Yes, he tried to trick me into talking, or at least starting to talk. I immediately repeated: "I want my attorney." That is the ONLY thing I said. I wanted to yell at him "I DON'T GIVE A SHIT ABOUT YOUR FILE" but I did not.

He eventually complied, asked for his details, at which point I said I did not have an attorney but was in the process of finding one. However, I wanted a public defender. They charged me with possession of child pornography, mentioning my computer as proof. Inside, I laughed a bit, knowing what was waiting.

I was formally charged, set bail, paid it, and let out. And then began a quite dramatic - but funny - turn of events. When you file charges in my state, the defendant has the right to a speedy hearing AND, of course, a preliminary hearing. I expressed my rights fully (eventually hired an attorney, my public defender didn't do much).

The police - and FBI - had one problem.

My hard drives were all encrypted.

Even my laptop was encrypted. Back home, I took care to properly destroy anything that could ever get me in trouble - even letters I wrote as a child. The police had rapidly checked for more evidence, but as they wouldn't find anything, they did not take the time to look for drugs, drugs equipment and other evidences for other crimes.

Two weeks later I got a call from someone claiming to work for the FBI. Apparently they were unable to decrypt my hard drives and required my help. I told them to talk to my attorney. I was summoned in and the only thing I told them was "I want my attorney".

They wanted the password

-We know you encrypted your data. We even know which program you used. By law, you are required to decrypt the data.

-I want my attorney.

They complied, my attorney came (at high cost) and the situation was re-explained to him (I, of course, already told him the situation, and he recommended not helping them a damn). He told them they had no legal stand.

They formely ordered me to decrypt my data, threatening to charge me with terrorism, and I refused one last time. I was jailed again for a night and new charges were pressed for obstruction (i.e. refusing to help on an investigation).

Fast-forward a week, I get a formal plea bargain. Ten years as a sex offender, six years probation, if I recognized guilt for possession of child pornography. The other charge would be drop. Quite a good deal, huh? My public defender STRONGLY told me to accept as the conviction rate was "nearly 99%". My attorney told me to invoke my 5th amendment and refuse any cooperation.

Fast-forward to the preliminary hearing. The judge has to decide whether or not there is enough evidence to prosecute me. He asks for the investigator, who explains the situation, and for the forensic expert. To make a short story, they mention my IP clearly downloaded child pornography. Looks like I'm finished.

Except for one thing. It has been so long between the download and the raid it was hard to prosecute me on the IP address alone. The record were old, incomplete, poorly filed. My attorney did a good job making the forensic expert admit "mistakes were possible."

Then came my turn. The expert told the judge they could not find any trace of child pornography because my hard drives were encrypted. He said it was a clear proof I "was hiding something probably worse" at which point he was promptly stopped by my attorney (speculation is not accepted in court). The judge agreed. The expert closed his statement by saying that I had not only encrypted my hard drives, but external drive and laptop.

Then came my turn. The judge summoned me, asked me a few questions, and finally asked: "Why did you encrypt your hard drive?" Think fast. What could I reply!!!

"For safety and privacy, your honor. In case of theft."

"Why do you refuse to decrypt your data?"

The $1,000 question (note: this is not exactly what was said, just how I recall it). What can I say? Quick, a word with a lawyer. Then, the genius answer:

"Your honor I would like to invoke my 5th amendment" "Alright".

Oh, the irony of 5th amendment. If you don't invoke it, you have to incriminate yourself. If you do invoke it, you indirectly admit guilt. Of course that can't be used against you, but whatever.

There were a few more statements, and eventually the prosecution had nothing. The judge took a moment to think, then said two words that would change my life. "Case dismissed" due to "lack of evidence". I was ecstasic.

The prosecution party was furious. They closed the file. The judge was about to end the audience when I said:

"Your honor, they still have my computer. I want it back!"

"You just had a criminal case dimissed."

"It's my stuff. I want it back"

"Very well. Your town's police department has 30 days to give you your material back. Audience finished".

I was very happy. I felt I added to the insult with that last request. The prosecution party couldn't believe it, after all that work.

I got my stuff back and it took me a full month before I dated to open my computer again. I was afraid they put a bug or would still try to harass me or incriminate me. I feared they were waiting for me to decrypt me to charge me again. I waited one whole month, then decrypted the file - saved the files I wanted to keep then formatted it all, writing random 0's and 1's.

So this is it. TrueCrypt certainly saved my life, reputation and money. Without it, there is no doubt the police would have found the pictures, and convicted me. I would be on the same registery as rapists and pedophiles - all this for a mistake of mine. But encryption - and refusing to give up despite the threats of being charged with a much more serious crime - kept me free.

1. Open TrueCrypt after you have it installed. Then select "Create Volume".
   
   


2. From the three choices, select "Create an encrypted file container"
   
   


3. Click Next and then select "Standard TrueCrypt Volume".
   Click next again.
   
   


4. Click "Select File" and navigate to the location on your hard drive where you want your volume to be, and specify a name for it.
   You actually have to give it a name, rather than just select a file. As you can see, I simply named mine "Volume 2", as I already have a Volume 1 that I use.
   You can move and re-name this after it is created.
   Spoiler (Click to View)
   [img]http://i52.[censored].com/14t7kut.jpg[/img]
   
   
   


5. Make sure that the box "Never Save History IS Checked". And click next.
   
   


6. Choose your encryption and hash algorithms.
   All methods are very strong and you're safe with them all. You can just leave them as the defaults (AES & RIPEMD-160).
   
   


7. Enter the size of the volume that you wish to create.
   
   


8. Enter your desired password. Ideally, make it longer than 35 characters.
   I don't recommend using keyfiles, because they can get deleted and you will be unable to recover the data in the archive.
   Just use a really good password consisting of uppercase, lowercase, special characters, and numbers.
   If you can't think of a password that is that long, try combining a few differnet passwords you may know, maybe a bank account number, some song lyrics, and keyboard configuration.
   Just basically anything that's going to get you to that length.
   This step is critical. Passwords are the biggest weakness.
   
   


9. Next just move your mouse around randomly for as long as you have patience to do so, and then select format.
   
   


10. Depending on the size of volume you chose to make, it may take a while to create a volume.
    
    


11. That's it you're done! Spoiler (Click to View) [img]http://i53.[censored].com/308kz8j.jpg[/img]
    

1. Open TrueCrypt after you have it installed, on the tabs at the top, select the drop-down menu "Volumes"
   
   


2. Click "Create New Volume"
   
   


3. From the three choices, select "Create an encrypted file container"
   
   


4. Click Next and then select "Hidden TrueCrypt Volume". Click next again.
   
   


5. Select "Normal Mode" from the two options available.
   You can experiment with Direct Mode if you wish, but it requires you to have a volume already made, that you wish to convert into a hidden archive.
   
   


6. Click "Select File" and navigate to the location on your hard drive where you want your volume to be, and specify a name for it.
   You actually have to give it a name, rather than just select a file.
   The name and location can be changed after creation.
   
   


7. Click next to begin specifying the options for the outer volume.
   This is the part of the volume that you are going to be giving up to someone in case something very bad happens.
   Ideally you should still use a strong password, and posssibly keyfiles to make it look legitimate.
   
   


8. Next click "Open Outer Volume" and put in some documents that are somewhat sensitive that you may have a legitimate reason to hide.
   Examples of this could be your bank account statements, a text file containing your own passwords, documents outlining how to make explosives. Use your imagination.
   But make sure that whatever you put in there isn't going to get you in too much trouble, but that it still explains your purpose for using TrueCrypt.
   
   


9. Click next. Now we begin to specify the settings for the hidden volume. It is important that you make this one stronger than the first with regards to password length etc.
   
   


10. Next specify the space you wish your archive to fill.
    You are limited to the difference of the space between what you initially made your Outer Volume, minus the contents you put in your Outer Volume. e.g. (Outer Volume Space - Contents of Outer Volume = Max Space Available for Hidden Archive).
    So it's important to make sure that your Outer Volume is initially created with an adequate size for both your Outer and Hidden Volumes.
    
    


11. Next enter your password and use and key-files that you may want for your Hidden Archive. If you still haven't got if yet, you need to use a separate password for both your Outer and Hidden Volumes.
    
    


12. Depending on the size of volume you chose to make, it may take a while to create a volume.
    And then you're done!
    For instructions on how to mount and use your TrueCrypt file container see refer to the section "Mounting Your TrueCrypt Volumes"
    

1. Insert the flash drive or connect the external hard drive to the computer.
   
   


2. Open TrueCrypt after you have it installed, on the tabs at the top, select the drop-down menu "Volumes".
   
   


3. Click "Create New Volume".
   
   


4. Select "Encrypt a non-system partition/drive".
   
   


5. Select whether you'd like to create a standard or hidden TrueCrypt volume.
   If you don't understand what these are, refer to an earlier section.
   For this demonstration, we will be creating a standard volume.
   If you are creating a hidden volume on a USB or system drive, the steps are the same as creating a hidden file container.
   
   


6. Hit next, and then click "Select Device". This will bring up a list of all the drives attached to the computer.
   
   


7. Select the drive or partition that you wish to encrypt from the list.
   
   


8. Now there are two options at this step.
   If you have data on the drive that you wish to preserve, select "Encrypt partition in place" - it will take longer, but nothing will be deleted.
   This only works on NTFS Drives.
   Alternatively, if you don't really care about anything on the drive, or make a backup you plan on moving in, you can select "Create encrypted volume and format it" - This will delete all data on the drive!
   
   


9. Next select your encryption methods.
   
   


10. Enter your desired password.
    Ideally, make it longer than 35 characters.
    I don't recommend using keyfiles, because they can get deleted and you will be unable to recover the data in the archive.
    Just use a really good password consisting of uppercase, lowercase, special characters, and numbers.
    If you can't think of a password that is that long, try combining a few differnet passwords you may know, maybe a bank account number, some song lyrics, and keyboard configuration.
    Just basically anything that's going to get you to that length.
    This step is critical. Passwords are the biggest weakness.
    
    


11. Next click "Format" a dialog box will appear notifying you that all data on the drive will be deleted. Click OK to continue formatting.
    
    


12. Depending on the size of volume you chose to make, it may take a while to create a volume. And then you're done! For instructions on how to mount and use your TrueCrypt volume, refer to the section "Mounting Your TrueCrypt Volumes"
    

1. Open TrueCrypt after you have it installed, and then click on "Create Volume".
   
   


2. Select "Encrypt the system partition or entire system drive" and click next.
   
   


3. Select "Normal" and click next. You are free to experiment with the any other options, but I recommend starting with a normal archive just to get your feet wet.
   
   


4. Now when selecting which area to encrypt, I recommend you just select "Encrypt the whole drive".
   You may choose the other one but the setup will change a little, and it is more for those with multi-boot setups.
   
   


5. Next it will ask you whether you want to encrypt the "Host Protected Area".
   I recommend that you do not encrypt this (e.g. select NO), but again it is up to you to know whether your computer manufacturer uses these areas to store data or not.
   So assuming you selected No, click next to continue.
   
   


6. Next click Single-Boot. Unless you have multiple operating systems and decide you want the other's encrypted as well.
   The majority of users here probably only have a single boot system.
   
   


7. Now choose your encryption and hash algorithms. As noted earlier, all methods are very strong and you're safe with them all. You can just leave them as the defaults (AES & RIPEMD-160). If you wish to research more on the methods, and come to a conclusion on which is best, feel free to do so.
   
   


8. Choose the password that you will use every time your computer is turned on.
   Do NOT forget this password. EVER.
   If you decide to change this later, you may. Also note that key-files are not supported for full drive encryption.
   
   


9. Next just move your mouse around randomly for as long as you have patience to do so, and then select next.
   
   


10. You will now have to create a "Rescue Disk" for three reasons that are outlined in the TrueCrypt dialog box.
    Please read over these steps and become familiar with them.
    The rescue disk will basically allow you to boot your operating system from a disk to repair it if something becomes damaged.
    Even if someone, including you, finds this disk, they will be unable to boot the computer without knowing the password. So again, DO NOT forget your password.
    So select the location where you want the save the ISO, and name the file.
    


11. You will now need to burn this ISO to a disc.
    If you are confused about how to do this, or need software, TrueCrypt has some links to free software that you can use here.
    I recommend ImgBurn for burning ISO files.
    It can be found for download here.
    


12. Upon successfully burning the ISO file to the disc, you can click next, and TrueCrypt will verify that you have done it correctly.
    


13. Now you will have to decide what kind of Wipe Method you want to use.
    Depending on you computer's speed, and your patience, you can choose a different wipe method over another.
    This step basically help's keep the data secure and unrecoverable.
    Of course I recommend the Gutmann 35-pass method, but this is not appropriate for everyone. However, I suggest that you at least use SOME method of wipe.
    Please note that you will still be able to use your computer if you decide to use the Gutmann or DOD methods, it will simply run in the background when your computer is started until it finally finished wiping and encrypting.
    Just as an example, I have a 1TB hard drive, and when encrypting it, I used the Gutmann method. It took almost 4 days of running it non-stop on 8GB of RAM and an i5 processor.
    
    


14. After you have decided on a Wipe method, TrueCrypt will want to make sure everything is going to work properly in a System Encryption Pretest. Click Test.
    A dialog box will appear with instructions about what's going to happen, and what to do if something malfunctions.
    I recommend copying the contents of this to a text file and e-mailing it to yourself in case you need to read it from another computer.
    
    


15. You will now have to restart your computer. Click "Yes" to restart.
    
    


16. Upon booting up your computer, you will come to a black CMD screen which says "TrueCrypt Boot Loader 7.0a - Enter Your Password" etc.
    
    


17. You will need to enter the password you chose here. It will then flash "Booting" across the screen and your operating system will be loaded like normal.
    
    


18. Once your computer is booted, TrueCrypt will be loaded and it will tell you that the Pre-Test was completed successfully.
    Next click Encrypt to start encrypting. It will give you another dialog box pop-up. It is a good idea to copy this down in a text file and e-mail it to yourself like the last set of instructions.
    
    


19. Now it will start encrypting your hard drive.
    Depending on whether you chose a wipe method or not, and how large your hard drive is, this can take anywhere from an hour or so all the way up to weeks before it completes.
    As explained earlier, you can still use your computer while this process works in the background.
    
    


20. After it is done encrypting, TrueCrypt will now tell you that it has completed the encryption successfully. Hit "OK", and then finish.
    

1. Open TrueCrypt and select the drive letter that you wish to mount your volume to.
   


2. Click "Select File" and navigate to the location that you have your file container at and select your container. Then click open.
   


3. Next click "Mount", with the drive letter you want your volume to be mounted as.
   


4. You will be prompted to enter your password, and load any key-files that you may have used. Leave the box "Cache passwords and keyfiles in memory" unchecked.
   After loading any keyfiles, and/or entering your password, click OK.
   


5. You will now see your drive mounted under "My Computer" and TrueCrypt as the drive that you selected when you mounted it.
   You may choose any available drive from letters A-Z.
   


6. It now act's like a normal drive. You can cut, copy, paste anything to and from the drive.
   


7. When you are done with the archive, you may dismount it.
   


8. Dismount the drive by ensuring that every process or location utilizing that drive is first closed to prevent damage to the volume.
   


9. Next, select the drive from TrueCrypt, and select Dismount. The drive will disappear from TrueCrypt and from My Computer
   

• Encrypt the entire drive so that there is no empty space left on it.
  - This is the method outlined earlier under "Encrypting a USB Drive or Encrypted Drive Partition".
  It will require you to have TrueCrypt installed on the computer that you are trying to mount the removable media to.
  
  


• Create an encrypted file folder large (or small) enough to fit onto the flash drive or external hard drive.
  - I am far more fond of this method. It allows you to actually have TrueCrypt on the removable device so that it's contents may be mounted wherever you are. I highly recommend this method over the first for removable storage.
  If using this method, the way to mount the drive is exactly the same as mounting an Encrypted File Container because, well, that's exactly what it is.

1. Open up TrueCrypt, and this time, instead of clicking "Select File", click "Select Device".
   


2. Have your device (USB/External HD) already connected to the computer.
   


3. Next select your device from the list of available devices and partitions, then click OK.
   


4. From here on out it is just like mounting a file container. If you initially created a hidden folder on your device/drive, you can enter a differnet password to get to that area of the drive.
   


5. It will then become visible under TrueCrypt, and My Computer, as the drive letter that you specified for it when mounting.
   


6. To dismount, make sure all folders and processes utilizing the drive are closed, then simply highlight the drive in TrueCrypt and select "Dismount".
   

1. Open TrueCrypt, and under settings, at the top, select preferences.
   


2. Uncheck the box "Start TrueCrypt Background Task" under "Actions to perform upon logon to windows"."
   


3. Click OK and then Exit. Restart to see the changes take place. You will notice that TrueCrypt no longer is int he task manager, and that it is not running in the processes under Task Manager
   

• Tip #1: When working with detected files, malware in particular, it can often times be frustrating when your Anti-Virus deletes the files that you are using.
  To avoid this problem, add an exclusion in your Anti-Virus as an entire drive letter, such as drive Z:\. Then create a TrueCrypt file container, and inside the TrueCrypt volume, keep all the files that are detected, along with all your hacking material.
  Mount this file container as that drive letter you added to your exclusions list in your AntiVirus.
  This keeps all of your sensitive files safe from prying eyes, and allows you to scan your entire computer for infections, with the TrueCrypt volume dismounted, without worrying about false positives.
  Nothing gets in, and nothing gets out, without your permission.
  

• Tip #2: Think about setting up a Virtual Machine that you do alot of your hacking from, and keep this in a TrueCrypt container.
  This will make it so that some of the temporary files, time, and system logs that Windows and other operating systems keep are never found, and there will be no evidence, or time log against you in case of a lawsuit.
  You can use your normal operating system, but you need to be good at deleting your logs using a secure deletion method.
  

1. Download CCleaner from this link.
   


2. Install and run the software.
   


3. Go to Options > Settings > "Secure Deletion" Change drop down box to Gutmann (35 passes).
   


4. Click on Cleaner on the left hand side.
   


5. Down at the bottom, under "Advanced", check the very bottom box, "Wipe Free Space".
   


6. This, most likely is going to take a ton of time depending on your hard drive space and computing speed. Just be patient with it, this is very important.
   

(Oct 20, 2010 01:39 AM)★DNZ★ Wrote:  nice tutorial

i was thinking about crypting my harddrive with truecrypt but didnt know how to ;)

(Nov 29, 2010 01:18 AM)Cybomber Wrote:  I was thinking of using truecrypt disk encryption but will that screw up my ability to restore my computer?

(Nov 29, 2010 06:27 PM)Grimskulls Wrote:  Thanks, my computer is finally secured.

But keep in mind some computers (with eligible harddrives) have the ability (in bios) to put a password on their hdd and require an entry before boot. I don't know how secure it is, but its another step of protection.