Author Topic: password-protect external HD (USB)? (Read 56,684 times)

brotherS · « **on:** January 20, 2007, 12:48 PM »

Hi,

as some of you noticed in http://www.donationcoder.com/forum/index.php?topic=7068, I'm currently looking for an external HD. Is there a way to password-protect the content? Like that I would need to enter a password before Windows is able to really access the drive after I reconnect it?

It doesn't have to be CIA-proof (although that's never bad

), I'm just considering putting a backup HD in the hands (or drawer) of a friend or neighbor (in case my flat burns down to the ground) and don't want him to read all of my files.

CodeTRUCKER · « **Reply #1 on:** January 20, 2007, 01:06 PM »

If I'm not mistaken, that is why NTFS was created? If you're using a NTFS formatted drive that should be all you need?

brotherS · « **Reply #2 on:** January 20, 2007, 01:12 PM »

Quote from: Farmsteader on January 20, 2007, 01:06 PM

If I'm not mistaken, that is why NTFS was created? If you're using a NTFS formatted drive that should be all you need?

Err... I have no idea! That's why I'm asking

(I read that NTFS supports passwords, but have no idea how that works in real life... nor do I know how secure that is)

CodeTRUCKER · « **Reply #3 on:** January 20, 2007, 01:24 PM »

What about a non-technical solution, like putting the external hdd in a small fireproof box. They all come with keys which AFAIK must be locked to stay closed. That way you wouldn't have to answer any, "what, you don't trust me" kind of questions.

Can you get a external that is already formatted NTFS? AFAIK, NTFS would be secure.

brotherS · « **Reply #4 on:** January 20, 2007, 01:27 PM »

Thanks, that makes sense!

The HD I'll get will be NTFS-formatted already, I just need a guide regarding how I'd enable password protection. With pictures if possible

jgpaiva · « **Reply #5 on:** January 20, 2007, 01:30 PM »

Farmsteader: that's true, ntfs does support encryptation, but it's not out-of-the box. You have to configure it (somehow, i don't know how to do it). I own an external disk, formated in NTFS and i've used it in 2 computers without it prompting me for any password.
Also, there are other solutions like truecrypt.

mattsmith321 · « **Reply #6 on:** January 20, 2007, 01:39 PM »

Quote from: brotherS on January 20, 2007, 01:27 PM

The HD I'll get will be NTFS-formatted already, I just need a guide regarding how I'd enable password protection. With pictures if possible

Good question. I'm actually almost in the same boat and was wondering the same thing the other day. I'd forgotten about being able to do it with NTFS. While I don't have specific details, you can get started by right-clicking on your drive letter in File Explorer. Select Properties. There should be a tab called Security. On that tab, you would make the necessary changes to the users listed to control who has access to it. Again, I'm not sure the exact configuration but this should get you pointed in the right direction.

CodeTRUCKER · « **Reply #7 on:** January 20, 2007, 01:42 PM »

Quote from: jgpaiva on January 20, 2007, 01:30 PM

Farmsteader: that's true, ntfs does support encryptation, but it's not out-of-the box. You have to configure it (somehow, i don't know how to do it). I own an external disk, formated in NTFS and i've used it in 2 computers without it prompting me for any password.
...

Thanks! At least now I know I have had a good day... I learned something.

CodeTRUCKER · « **Reply #8 on:** January 20, 2007, 01:45 PM »

This is a very good place to expose one's ignorance. One is always corrected gently and without condescension. Great stuff!

brotherS · « **Reply #9 on:** January 20, 2007, 02:32 PM »

Quote from: jgpaiva on January 20, 2007, 01:30 PM

Farmsteader: that's true, ntfs does support encryptation, but it's not out-of-the box. You have to configure it (somehow, i don't know how to do it). I own an external disk, formated in NTFS and i've used it in 2 computers without it prompting me for any password.
Also, there are other solutions like TrueCrypt.

Wow, thanks, that looks good!

http://fileforum.betanews.com/detail/TrueCrypt/1102840595/1:

4.6 out of 5.0
OS Support: Windows 2000/2003/XP
Reviews sound like "Simply the best. Easy to use, open source.. Highly recommended."

nevf blogged about it: http://blog.surfulater.com/2005/06/09/securing-information

http://www.truecrypt.org/docs/tutorial.php

I need to read that more carefully tomorrow, when I have more time. Any TrueCrypt users here?

jgpaiva · « **Reply #10 on:** January 20, 2007, 02:38 PM »

Actually, i thought you knew about it, it's very used by members here.. Just check the search for "truecrypt". (strangelly, i can't make links for search results

)

f0dder · « **Reply #11 on:** January 20, 2007, 02:39 PM »

NTFS supports encryption, but if you want to access encrypted files from another box than your own, afaik you'll have to export some stuff from your own box and import it on the other - bother. TrueCrypt seems like a decent option.

CodeTRUCKER · « **Reply #12 on:** January 20, 2007, 02:48 PM »

A "decent option." Given your expressed propensity to be particular, that rates pretty high. Works for me.

aignes · « **Reply #13 on:** January 20, 2007, 04:03 PM »

Since a year or so I use TrueCrypt every day and never had a problem with it.

I have for example one TrueCrypt container on my hard drive where the whole development things are stored (source codes, customer data base, etc.), or another container on an external hard disk (~150 GB in size) which is only used to back up data (done with SyncBackSE). Also USB sticks can be encrypted!

TrueCrypt gives me also some kind of peace when I'm out of office, it's one of the tools I could not live without. Highly recommended.

jgpaiva · « **Reply #14 on:** January 20, 2007, 04:11 PM »

Just an heads-up about the ntfs encryption.
Using this system, the files are encrypted with a password you don't know. They are bound to that user and that windows instalation. If you reinstall windows or really wish to have access to those files in another computer, if you didn't unencrypt (does that word exist?) the files first, you're screwed.
From what i know, you're much better off with that truecrypt program or something similar.

f0dder · « **Reply #15 on:** January 20, 2007, 04:13 PM »

Quote

If you reinstall windows or really wish to have access to those files in another computer, if you didn't unencrypt (does that word exist?) the files first, you're screwed.

decrypt

And you don't need to decrypt, you just need to export the keys from the registry.

But yeah, I'd personally prefer truecrypt or a similar protection, you know what you get there - which includes Rijndael instead of DES/whatever.

cthorpe · « **Reply #16 on:** January 22, 2007, 03:14 PM »

As for encrypting with NTFS,

Right click on a folder, then select Advanced, then check the encrypt box.

mwb1100 · « **Reply #17 on:** January 22, 2007, 05:48 PM »

Quote from: jgpaiva on January 20, 2007, 04:11 PM

They are bound to that user and that windows instalation. If you reinstall windows or really wish to have access to those files in another computer, if you didn't unencrypt (does that word exist?) the files first, you're screwed.

This is a key point - if you want to use EFS (the encryption used with NTFS) you must understand how to be able to recover your data from a reinstalled Windows system, otherwise your data is in grave risk of being totally unrecoverable. It can definitely be done, but it's not a particularly simple process:

http://support.microsoft.com/kb/223316
http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/cryptfs.mspx
http://www.microsoft.com/technet/security/prodtech/windows2000/w2kccadm/dataprot/w2kadm21.mspx

Personally, I'd stick with TrueCrypt. with TrueCrypt, the only things you need to know to have recoverable backups are:

1) a backup of the encrypted container file (a single file, generally)
2) the password (or the keyfile if that's what you're using)

With those 2 things, you can recover your data on any system

brotherS · « **Reply #18 on:** January 22, 2007, 06:16 PM »

Thanks for all your comments, I decided I'll use TrueCrypt too!

How will it work in practice?

connect my external HD
start the HD: "power on"
what comes here?
Windows and all apps could access the encrypted container file

mwb1100 · « **Reply #19 on:** January 22, 2007, 10:04 PM »

Quote from: brotherS on January 22, 2007, 06:16 PM

what comes here?

I double-click on the encrypted volume container file and the TrueCrypt mount dialog comes up. I choose the drive letter to mount the volume on, click the 'mount' button, enter the passphrase, and I have a newly accessible drive letter.

Note that working this way (double-clicking on the container file) requires that TrueCrypt (TC) be installed on the computer, but TC will work without being installed - though you do need admin access to work without installation.

brotherS · « **Reply #20 on:** January 22, 2007, 10:17 PM »

Quote from: mwb1100 on January 22, 2007, 10:04 PM

Quote from: brotherS on January 22, 2007, 06:16 PM
what comes here?
I double-click on the encrypted volume container file and the TrueCrypt mount dialog comes up. I choose the drive letter to mount the volume on, click the 'mount' button, enter the passphrase, and I have a newly accessible drive letter.

Note that working this way (double-clicking on the container file) requires that TrueCrypt (TC) be installed on the computer, but TC will work without being installed - though you do need admin access to work without installation.

Interesting... is it possible to automate this (with AutoHotkey or however) so that I will automatically be asked for the password directly after Windows 'sees' the connected HD? I'd also like it to always get the same drive letter, so if that could be automated too it would be great

jgpaiva · « **Reply #21 on:** January 22, 2007, 10:24 PM »

Quote from: brotherS on January 22, 2007, 10:17 PM

I'd also like it to always get the same drive letter, so if that could be automated too it would be great

Not sure about the rest, but i think this does happen. My external usb disk always gets mounted with the same letter, even if i connect any usb drive with it disconnected and connect it after.

mwb1100 · « **Reply #22 on:** January 22, 2007, 11:01 PM »

I haven't tried automating TrueCrypt mounting, but TC has a commandline interface, so as long as you can get a specified command to execute when you attach the drive (I imagine that AHK can do this) then you can get the encrypted volume to automount.

tymrwt33 · « **Reply #23 on:** January 28, 2007, 12:19 AM »

NTFS drives are encryptable, but not automatically encryupted. If you use XP Pro it has an ability to encrypt, but you have to do it. XP Home does not. You have to use an outside program such as True Crypt, or a host of other freebies.
I move my USB NTFS Hard Drive between my desktop and laptop without any problem and can read and write on either computer.
If you give your neighbor an un-encrypted NTDF drive he will be able to read it on his computer.

CmputrAce · « **Reply #24 on:** February 01, 2007, 03:09 PM »

Truecrypt is really a good way to encrypt a thumb drive or USB hard drive. You just need to know a couple of things...

If you are going to carry this drive between computers and can't guarantee that the computer you will be connecting to has TrueCrypt installed on it, then you'll probalby want to put the TrueCrypt program on the drive with it's driver installation feature. What you will wind up with is an external drive that will take up TWO drive slots on the PC you are connecting to. One for the TrueCrypt software and one for the NTFS (hopefully) partition.

If TrueCrypt will be installed on all the PCs that you will be connecting to, then you can format the entire USB drive as a TrueCrypt volume and have the software auto-detect and auto-install the device when you plug it in.

It's not a simple program to install and understand, but if you take a little time to experiment, you'll come up with a setup that will serve you quite well.

I'm not a TrueCrypt god, just a basic user.