Welcome to part two of this module.
In this video we're going to be seeing how to fully encrypt an entire Windows operating system using
barrack crypt.
This will be full disk encryption meaning the entire system partition is going to be encrypted.
And if your system only has one partition that means your entire system.
There are a couple of things to go over before we begin however.
The first thing to say is that this video and the next one are going to be very similar.
And there may be some repeat.
Here we are going to see how to encrypt a single Windows operating system from XP onward to Windows
10 in the second video.
We're going to see how to create a hidden operating system with many of the steps you're about to see
repeated.
If you're more interested in the hidden system you could skip this video.
Although I do recommend that you practice doing this in virtual box before attempting it on your own
system.
This is because there is an element of risk involved here.
It is possible to mess up your system if you do this incorrectly so if you do decide you want to employ
full disk encryption please be aware that you do so at your own risk before you begin.
I strongly recommend that you have your real Windows product key written down somewhere and some form
of installation media for the Windows version that you are using.
If anything goes seriously wrong it may become necessary to reinstall windows.
Be sure to backup all of your important files to some form of external media storage.
It is possible to unencrypted system after it has been encrypted.
This is easier with a single encrypted system.
It gets very complicated and messy when you have multiple operating systems.
So that is something to consider as well.
In addition to your windows installation media I recommend having some form of boot repair and media
also prepared just in case you need to fix a broken bootloader.
The process here is actually very simple despite how intimidating I've made it sound stated briefly.
We boot up Windows install very script which you've kind of already seen how to do in the prior video
we just download it and install it then use it to fully encrypt the system partition which is going
to install a bootloader which will prompt you for your password when you turn on the computer.
If you press the escape key at this prompt you may select other mutable partitions.
However we'll be looking at dual booting in the next video so please keep in mind this current presentation
assumes you only have windows installed and nothing else.
If you have multiple operating systems installed skip this video.
One more thing I suggest making sure your windows is fully up to date before you encrypt your system
particularly Windows 10.
The reason is Windows 10 really likes to download updates at odd moments.
Even when you tell it not to and if one of those updates happens to massively reconfigure your system
right in the middle of a critical reboot you might run into some trouble for reasons of security both
very script and true crypto manuals suggest that you authenticate your copy of Windows prior to encrypting
to avoid any errors later on.
Finally I must remind you that very crypto has you EFI support True Crypt does not if you wish to use
True Crypt instead you'll have to go into your bios and switch to a legacy bootloader you do this at
your own risk and this may not be possible on all versions of bios on the other hand if you have an
older computer using MPR instead of you EFI and you don't have any weird protected boot settings in
your BIOS True Crypt maybe a better choice from a performance point of view if your system bios has
secure boot enabled it may be necessary to disable it users who prefer True Crypt will need to change
their bootloader in bios strum you EFI to legacy and this may require a full re installation of Windows
in some cases both of these actions are taken at your own risk.
In any case let's begin to get started.
Let's go ahead and open up Vera crypt.
And please keep in mind that for this full disk encryption that we're about to employ you can't do this
in portable mode.
You absolutely have to install Vera crypt to your system.
The same is true for True Crypt.
So we open up Vera crypt and there are two ways we could do this we could click the create volume button
or we could go to system and click encrypt system partition drive.
Remember that this first video will be for full disk encryption of Windows with no hidden operating
systems.
We're gonna be looking at hidden systems in the next presentation.
So for right now make sure that the normal radial button is selected and click next.
The screen is asking us which areas we want to encrypt.
If you have non sys partitions you may wish to select the second option encrypt the whole drive.
You might do this if you have extra partitions that you use for storage.
Do not do this.
If those partitions contain different operating systems as this will render them totally unusable the
assumption of this presentation is that you only have windows installed with no extra partitions.
So we'll be going with the first option when you've made your choice click next this next screen is
fiendishly deceptive but I'll refrain from explaining it until we are ready to look at dual booting
for right now.
We're going to select the single boot radial button and we're going to click next.
We are now presented with our encryption options.
This will be the encryption and hash algorithms that very crypto will be using
as before we have the option of using a single algorithm or a cascade of algorithms.
The choice is yours.
However I strongly recommend you to select a single algorithm.
The reason is that using multiple algorithms is going to slow your system performance down considerably.
If system performance is not a concern and you want maximum security by all means do as you like but
realize that all of these are solid choices.
The United States military itself uses advanced encryption standard or AP s to encrypt top secret data
and that will be good enough for this demonstration.
We also need to select our hash.
Interesting.
I said in the last video that very crypto removed our IP BMD dash 160.
Apparently I was mistaken.
You may select either our IP MMD dash 160 or SHA 256.
I will be selecting SHA 256 when you've made your selection click next.
Now we set our password since this is a single operating system with no hidden system.
There won't be any second password or hidden password.
Using this method whatever password you set here is the one and only key.
Do not lose this password let me say that again.
Do not lose this password.
There is no way to recover a lost password and you may find yourself locked out of your own system.
It is important that you set a strong password here.
Anything less than 20 characters and you might as well not even bother with encryption at all.
Pick a password that would take millions of years to brute force.
I explained about key files and Pym in the last video so I won't be going into great detail about them
here except to say that key files add an extra layer of security by requiring certain files to be present
when the password is entered.
If these files are lost or become corrupted by even a few kilobytes they will no longer function.
So do use them at your own risk.
Once you've selected your password click next and because this is a demonstration I will be ignoring
this warning.
Obviously my password is a very weak.
This is our random pool and as we move the mouse around within the very crypto or True Crypt window
the complexity of this pool will grow.
This is one of the safety precautions these pieces of software use so that you are not 100 percent dependent
upon windows cryptographic functions.
These functions can fail and they can also be potentially compromised by nation state actors to produce
a weak or predictable random pool.
This would make it trivially easy to obtain the master key and access the operating system for that
reason.
It is recommended that you waive your mouse cursor around inside this window like a crazy person for
as long as you can stand it in order to increase the cryptographic strength and randomness of the encrypted
container file or partitions.
Do this for as long as you can.
The little bar here at the bottom of the screen is really just a suggestion.
If you click the display pool button the obscuring symbols will be changed to hexadecimal when you are
satisfied with the strength of your pool click next click.
Yes to this prompt are keys are now generated.
You can display them or hide them by checking in on checking this little box.
Once you're ready click next.
Now comes the tricky bit both True Crypt and very crypt require you to create a rescue disk.
If you encounter a situation where windows will not start or if the very crypt bootloader itself gets
messed up or otherwise corrupted somehow the disk will allow you to repair the damage.
Keep one very important detail in mind however the rescue disk is not a substitute for the password
and or key files.
If you forget your password or lose your key files you're just out of luck.
We can use the browse button to select where we want to save the iso file this file will then be placed
on some form of external media such as a USP or you would burn it onto a C.D. before proceeding.
Very crypt gives you the option of skipping the rescue disk verification which is handy if your system
doesn't have any way to mount it.
True Crypt does not have this option.
If you're using True Crypt you will need to melt the iso file somehow after it is created either by
right clicking it and selecting mount option in certain versions of Windows or by using third party
software and Windows 7 to melt the iso file as if it were a drive for this tutorial.
I will be clicking the skip verification box when you're ready click next.
Now we're being told essentially what I just said that the ISO for the rescue desk has been created
in the directory that we specified and that it should at this time be moved to external media or burned
to a disk.
I won't be doing this.
This is just a demonstration but I do recommend that you follow this step when you're ready.
Click Next the prompt we now receive is warning us that all of our script rescue disks are unique to
the system that they were created for.
In other words you cannot use someone else's rescue disk on this system.
If you lose your rescue disk you're simply out of luck.
Much like if you lose your password click OK.
Finally we need to select the WIP mode as you know when you simply delete something off a computer.
The information remains on the hard disk and can be recovered by certain tools.
There are many forensic techniques that can recover data even after it has been overwritten by other
data.
For that reason it is recommended that you allow Vera crypt to overwrite deleted data with pseudo random
and certain non-random data.
If you select three passes then all deleted data and empty space will be overwritten three times.
This will be your one and only chance to overwrite this data and if you do not do so it may be possible
for a determined adversary to recover things like your encryption key.
There are two things you must consider though before making or selection.
First if you're using a solid state hard drive remember that such drives have a limited number of read
rights before they start to fail.
Selecting 7 or more passes is going to be very hard on them.
Second consider how much time you want this to take relative to to your security needs a 500 gigabyte
hard drive might take as long as several days to fully encrypt.
Adding in a lot of random passes is going to increase that time.
I would also suggest that you not use the Gutman wipe as this is extremely hard on even traditional
drives Guttman is really only used on drives you plan to ultimately destroy 7 passes is very high security
but will tack on a lot of time to an already lengthy process three passes is considered adequate by
the Department of Defense of the United States.
One is a very light wipe but may be good enough if you simply wish to secure a laptop against common
thieves.
With all that being said I'm going to select none because this is only a demonstration when you've made
your selection click next.
The last step is going to be the system encryption pretest when we click the test button.
Windows is going to reboot and we will be presented with the very script password screen.
If we fail to enter our password or if something gets broken along the way the test will fail and no
harm will be done.
If the password works and everything functions correctly will be prompted to proceed with the encryption
process.
Here we are on the very script bootloader screen cosmetically.
This is almost identical to the true crypt bootloader screen except we have the option to show our password
and P I am and also to skip authentication with the escape key.
Remember this is only the pre-test.
Our system is not yet being encrypted.
Enter the password that you selected
and under Pym.
Just press enter unless you entered a specific value in which case you would type in that value now.
True Crypt has no Pym option.
It will now verify our password and this may take a minute or two.
Once done windows should boot normally.
There we go.
Windows is now booting Great.
Our protest was successful.
We could click the defer button if we don't wish to begin encrypting right now.
Or if we're ready we click encrypt read through this pop up and print it if you wish.
It is simply telling you how to use the rescue disk if you need to.
When you're ready click OK click yes to authorize very crypt.
Now we can see the encryption progress it would begin with the wiping of free space.
If I had selected a white mode other than none I really can't stress enough just how long this takes.
You're seeing this performed on a very small amount of disk space but for a real system this process
can take days.
A four terabyte hard drive might take up to a week or more.
Of course it depends on many factors.
I therefore suggest that you place your system somewhere cool and keep all potentially flammable objects
away from it.
As you may need to leave it on for an extended period of time unattended in the heavy drive usage may
cause it to heat up considerably.
Please also keep in mind the laws of your region of the world concerning encryption.
As I mentioned in the last video I am not an international lawyer.
Depending on where you are in the world encryption may not be legal or you may be under a legal obligation
to surrender your password and keys if requested to do so by certain authorities.
Even if they do not have a warrant as such.
If you fail to comply with these laws you may end up in hot water.
This is very important to remember when traveling abroad.
It might be 100 percent legal to encrypt your laptop in the United States but you might be in for a
nasty shock when you travel to certain parts of the world and airport authorities demand that you decrypted
or worse you must do your due diligence and make certain that you are employing these techniques in
a way consistent with the laws of wherever you happen to be to avoid getting into legal trouble.
Now you can defer this process even after it has begun but be aware that if you choose to do so the
entire process will begin again from the start when you resume it.
If you wanted to do that you would just click this defer button.
At this point I'm going to make an edit the video to skip to the end of this process and there we go
our system has been successfully encrypted.
Now we're gonna go ahead and we're going to reboot our system
and here were once again presented with the very script bootloader screen.
If we enter an incorrect password the verification will fail and we won't be able to boot the system
so we'll go ahead and enter our real password
remembering to just press enter when it says p.m. unless you specified a value password verification
successful and rebooting normally and there we go encrypting a computer such as a laptop is generally
a very strong security precaution.
After all if the device is ever stolen your whole life might be on that thing.
Cash eight passwords important files customer personal information compromising pictures from your college
days.
Who knows even if someone live boots the computer let's say with like a Linux distribution or something
of that nature they won't be able to access the files on the encrypted disk.
I already spoke at length in the last video about the differences between open source and commercial
offerings.
You can of course use any encryption software that you desire including things like bit locker if you
personally feel they are a better choice.
Just remember that right now only very crypt and its precursor True Crypt are capable of creating a
hidden Windows operating system.
We'll be looking at doing that in the next video.
But what if you decide that you want to remove the encryption.
I hear you ask.
It is possible to restore the disk to an unencrypted state so once again we're going to open up very
crypt.
We will select our encrypted partition which in my case is going to be C..
Yours may vary once that's highlighted.
We're going to go up to system and click the permanently decrypt system partition slash drive confirm
administrator privileges click.
Yes again.
You really do want to decrypt authorize yet again and then just wait the decryption process should take
exactly as long as it did to encrypt the drive originally.
It is really that simple.
Just remember that the very script bootloader will be uninstalled at the end of the procedure.
So having a boot repair disk handy may be wise in some cases.
Alternatively you could always just install grub.
If your BIOS is using MDR and there we go.
The system is now decrypted and you could reboot it normally and the bootloader will have been removed
and you will have to restart to make this official.
I'm not going to.
There we go.
And that's really about it.
As scary as I probably made it sound encrypting your Windows operating system really isn't all that
difficult unless of course your BIOS has the aforementioned Secure Boot enabled in that event.
You may need to disable it in the settings and the process for this will vary from bios version to bios
version but it's usually just a selection that you toggle.
Please read up on your unique version of bios to make sure how to do it and whether or not it is advisable
for your computer in the next video we'll be covering how to create a hidden operating system as well
as a decoy system.
This will work exactly like the outer and hidden containers seen in the first video.
After that we'll examine how to dual boot windows and linux when both systems are encrypted.
I hope you found this video helpful and I'll see you next time.