Welcome to part three of this module.
This video will be covering how to create a hidden operating system as well as a decoy operating system
using their script.
This is not an especially easy process and it does entail some risk.
It is required not recommended but required that you have installation media already created for whatever
version of Windows you're currently running a rescue disk is not adequate.
You will be called upon to reinstall windows as part of this procedure.
And the two installation versions must match.
In other words if you're currently running Windows 10 professional you're going to need a Windows 10
professional ISO either in the form of an installation C.D. or USP stick these ISO files can actually
be downloaded directly from the Microsoft Web page.
If you don't have your original disk it is also very important to make sure that you have your original
Windows product key so that you can activate your second Windows installation.
Both versions of windows need to be authenticated before you begin encrypting them or else you can run
into problems.
Keep in mind that this procedure is the same for True Crypt except that True Crypt has no use EFI GP
support you may wish to use True Crypt on older computers with MDR partitions especially 32 bit machines
like old laptops or what have you.
Because the performance is likely to be a lot better before we dive in.
I need to reiterate that this process is complicated and it can mess up your computer.
The best time to set up a hidden operating system is when you are first setting up your machine such
as a new machine.
There is a danger that if something goes wrong you could end up losing data.
So with that in mind please take all appropriate steps to safeguard your files backup anything important
to external media because if you end up needing to start over from scratch that may mean wiping your
computer completely and having to reinstall windows.
This tutorial assumes that you only want to create a hidden Windows operating system and a decoy a Windows
operating system.
If you also want a third encrypted system such as for example Cally Linux please see the next video
on dual booting.
Although do keep in mind that when you start getting into dual boot situations with hidden operating
systems things get very very complicated and the risk of making a mistake that will require you to reformat
your hard drive doesn't crease.
One more thing if your BIOS has secure boot enabled it will be necessary to disable it.
You do so at your own risk.
It may not be possible in all versions of bios to disable secure boot.
So please read the documentation for whatever version of bios you happen to be running.
In most cases it is simply necessary to toggle enabled to disabled and then save the changes.
It is likewise possible in some versions of bios to change from you CFI to legacy.
Again simply by toggling a switch.
This is also done entirely at your own risk and will most certainly require you to do a complete Ring
installation of your Windows operating system before you begin.
I can't stress enough how important it is to have all of your data backed up externally and that you'd
be 100 percent comfortable reformatting your hard drive if anything goes wrong.
Another thing to point out is that this tutorial is assuming you have a rather generic partition arrangement
which is to say you have your system partition.
If your computer has an odd partition arrangement it may be necessary for you to restructure it before
you're able to follow the steps in this tutorial.
Unfortunately this will be different for everybody who has a different setup so I can't really demonstrate
how that would work but hopefully from what you see of making changes to the partition table in this
video you'll have enough information that you'll feel confident doing that.
Please be sure to fully update your Windows installation before you proceed.
You can of course still download updates after encryption but nothing is worse than being in the middle
of a critical reboot and having an update totally reconfigure everything and again both Windows installations
the hidden and the decoy absolutely must be authenticated before you encrypt them.
It's very important.
OK.
Let's dive in.
You have your Windows product key.
Your installation disk your boot repair disk and maybe also a way to wipe your hard drive such as Derek's
boot nuke from more information on that last one.
Please see the appropriate video.
This demonstration will be using Windows 10 although the procedure is the same for older versions of
Windows.
The first thing we need to do is press the Windows plus X key and then select disk management.
What we're doing here is creating a second partition that is going to exist behind our current system
partition.
The idea is that we're going to turn the second partition into an encrypted container very script is
then going to migrate the Windows installation that we're running right now into the encrypted volume.
Essentially it's going to copy it over this installation is going to become our hidden operating system.
In this demonstration the current windows that we're running right now on C drive is going to be moved
over to D Drive which we're about to create.
This is going to leave the C drive completely empty or to put it another way the first partition will
be completely empty when we're done and the second partition that we're about to create will contain
our hidden operating system.
We're then going to install a fresh installation of Windows on our now empty first partition or C drive
and that is going to be our decoy operating system.
The end goal is to have two windows installations at once.
One Password will cause the decoy system to boot and unencrypted and another password will boot.
The hidden operating system if set up properly it is theoretically impossible to tell through any form
of analysis of the hard drive.
There are two operating systems present.
Please read through the very crypto documentation very carefully if you wish to understand how this
so-called plausible deniability works within the decoy system.
The D Drive is going to appear to be just a normal encrypted partition that is to say the second partition
that we're creating.
You can even mount that partition using a password to make the deception appear genuine.
We will be placing some sensitive looking files into this partition.
At the time of its creation.
That way if we're ever called upon to mounted we can do so and it will appear to simply be an encrypted
non system partition.
In reality this partition will contain our hidden operating system.
With that in mind it is a requirement that we allocate more than half of the available space to the
second partition.
In fact you need to allocate 5 percent more than half of the maximum amount of space.
In other words if you have a 200 gigabyte hard drive your second partition needs to be at least 105
gigabytes in size half as big plus 5 percent.
If your second partition is not large enough when you try to initiate the process very script will throw
up an error telling you to allocate more space before proceeding.
So what we're going to do is run to right click on our system volume and we're going to select shrink
volume for this demonstration I'm going to leave the minimum amount on the first partition so we can
see that our second partition which we're about to create is unallocated space and it is significantly
larger than our system partition.
You can allocate this however you like.
We will right click on our unallocated space and select new simple volume click Next we're going to
allocate all of this space click next.
You can assign a particular drive letter if you wish click Next we'll go ahead and format to NTFS click
next and finish with this done we can close out of disk management and go ahead and launch Vera script.
Please keep in mind that Vera crypt must be installed to your hard drive for this procedure to work.
It will not allow you to create a hidden system in the portable mode to start with.
We need to click on system encrypt system partition drive.
This will seem familiar if you've watched the prior videos only this time we're going to click the second
radial button to create a hidden operating system.
Click next and next again provided that you allocated enough disk space to your second partition you
should see this message otherwise you will be prevented from proceeding until you've made the necessary
adjustment read this warning carefully.
It is telling you what I've essentially already said you must be ready to install a fresh copy of Windows
to the decoy partition.
Once the hidden system is created.
Make sure you have all of the disks you need and all of your important files backed up before proceeding
when you're ready click OK.
And yes we are going to grant authorization now.
You may or may not receive this message.
Depending on how your windows is configured if you don't see this then you can skip to the next step.
If you do what this is telling you is that there are paging files on non system partitions.
This can adversely affect plausible deniability of the hidden operating system.
It is therefore very strongly recommended that you click yes here which will configure windows to create
paging files only on the windows partition from now on.
Doing this will require a system reboot.
So I'm going to go ahead and click yes here and we will reboot the system and we're back from our reboot.
Windows has been reconfigured.
Let me just get back to where we were so we are going to open up very crypt system in crypt system partition
drive hidden.
Now we find ourselves on the screen of doom.
I call it the screen of doom because it is fiendishly deceptive where a lot of people go wrong is the
select multi boot thinking that because you're dealing with two windows operating systems such as as
shown in the example that this is the correct option hits really not in fact even when setting up multiple
operating systems.
This is still really not the right way to go.
So we're going to select the single boot radial button and we're going to click next this pop up is
basically telling you about two important salient points.
First your hidden operating system won't be allowed to hibernate your decoy system can hibernate normally
you can select no at this point.
However removing the extra boot partition is outside of the scope of this tutorial the next pop up is
advising us that for security reasons we must make sure that the current operating system is activated
and authenticated before proceeding.
This is your last chance to do so before we begin.
So if you haven't exit Vera crypt and do so you have click.
Yes with all of that preamble out of the way it is now time to create our hidden volume.
This should seem very familiar if you watched the prior videos in this module.
This so-called outer volume is going to be our decoy partition.
In other words when we are in our decoy operating system the hidden system is going to appear to be
a regular encrypted partition to make sure that the deception is convincing.
We need to create this outer volume and put some sensitive looking files into it in case wherever called
upon to mount that partition inside the decoy operating system we are now presented with our encryption
options.
These will be the encryption and hash algorithms that very crypto will be using as before we have the
option of using a single algorithm or a cascade of algorithms.
The choice is yours.
However I strongly recommend you to select a single algorithm for system encryption.
The reason is that using multiple algorithms is going to be slow and it will drag your system performance
down considerably.
If system performance is not a concern and you want maximum security well by all means do as you like
but realize that all of these are solid choices.
The United States military itself uses advanced encryption standard to encrypt top secret data and that
will be good enough for this demonstration.
Also keep in mind you aren't likely to ever use the decoy partition for anything and in fact you really
shouldn't.
As you run the risk of corrupting your hidden operating system.
As for the hash algorithm there really isn't a wrong choice here.
You can read up on the different algorithms if you desire but they are all rock solid for this demonstration.
I'll be using SHA 256 when you've made your selections click next.
Notice that on this next screen the option to change volume size is great out.
Just click next.
Now we need to set our password.
This is actually more tricky than it sounds.
You probably won't ever use this password since in the normal scheme of things you won't ever be accessing
the decoy partition so you need to remember this password so that you can access the partition if you're
ever called upon to do so.
Yet if you make the password simple enough to be easily brute forced it won't be convincing.
After all if you use a password less than 20 characters long why did you even bother to encrypt at all.
I really can't give you any specific advice here.
You just have to use your best judgment.
Pick a password that can't be brute forced easily and you'll remember despite the fact that you'll probably
never have any occasion to use it.
I explained about key files and P.M. in the last video so I won't go into length about them here except
to say that key files add an extra layer of security by requiring certain files to be present when the
password is entered.
If these files are lost or become corrupted by even a few killer bytes they will no longer function.
So do this at your own risk.
Also keep in mind that if you are ever ordered by a legal authority to grant access to this volume and
you find that you can't because the key files have become lost or corrupted you may be in seriously
hot water legally speaking.
Even if there is nothing important stored on the decoy drive for this reason I recommend against using
key files and I further recommend that you avoid the P.M. option.
The choice is of course yours when you're ready click next.
This looks really simple and it is but it's also complicated very crypto is asking you if you wish to
store files larger than 4 gigabytes on the decoy drive in the prior video covering how to encrypt a
USP device.
I rather mischaracterized the selection of NTSC f format for the outer volume by saying that it cuts
the available space in half.
It does but only relative to how much data you have on the drive.
In other words what I should have said is if you save a 4 gigabyte file and format the outer volume
to enter CSF around a little more than 8 gigabytes worth of space is going to end up being used up or
double the total amount of space used in the container.
This is because NTFS likes to put stuff in the middle of the partition.
This may be a bit confusing so to cut right to the point you really want to click no here.
If you decide to click yes and go with NTFS you'll be wasting some space.
This is our Random pool and as we move the mouse around within the very crypt or True Crypt window the
complexity of the pool will grow.
This is one of the safety precautions that these pieces of software use so that you're not 100 percent
dependent upon windows cryptographic functions.
These functions can fail and they can also be potentially compromised by nation state actors to produce
weak or predictable random pools.
This would make it trivially easy to obtain the master key and access the file.
For that reason it is recommended that you waive your mouse cursor around inside this window like a
crazy person for as long as you can stand it in order to increase the cryptographic strength and randomness
of your encrypted container file or partition.
Do this for as long as you can.
The little bar down here at the bottom of the screen is really just a suggestion.
If we click the display pool button in the obscuring symbols will be changed to hexadecimal.
When you're satisfied with the cryptographic strength of your pool click format.
You of course don't have any files on your newly created partition but very crypt is being nice here
and warning you all the same if you do.
These files will be overwritten So with that in mind click.
Yes if you're ready.
Very crypt is now going to format the outer volume depending on the size the partition.
This can take hours days or even weeks.
Please make sure that your system is kept somewhere cool and then nothing flammable as nearby as it
may heat up somewhat during this process.
I find this is especially true with old laptops with poorly functioning cooling systems.
Please also make sure that at no point during this process your system loses power.
This is not the sort of thing that you can stop and then resume later.
I will of course be making a cut to this recording to speed this process along.
But when you do this yourself you will need to be patient
okay with that step out of the way it is now time to fill up the outer volume.
I need to stress that this is going to be your one and only chance to do so.
You cannot add files to the outer volume later without running the risk of corrupting your hidden operating
system.
Click the open volume button.
And then drag sensitive looking files that you have chosen into this seeming partition remember.
The idea here is that this is a decoy drive.
If someone literally forces you to give up your password you give the password to the to this outer
volume instead of your hidden operating system.
If they can't tell the difference but this really only works if you have something within the outer
volume that looks like something that you'd want to hide.
Just remember not to put anything you truly wish to hide or make use of inside.
So I've gone ahead and I've created this text file that says secret looking information and I'm just
going to drag it right into the partition once you're done.
You can close out of this and click the next button.
It is now time to create the real hidden volume.
This is going to be your hidden Windows operating system.
This pop up is very very important.
You need to remember which algorithms you select in the next step and make sure that the exact same
choices are used when you set up your decoy system.
I suggest you write down your choices on a piece of paper.
Remember that using a cascade of encryption methods like ATX to fish serpent is going to substantially
reduce your system performance.
It's fine for a USP drive but it will drive you absolutely crazy if you do it on a laptop.
It is of course up to you.
As I said in prior videos there is no wrong choice here advanced encryption standard by itself or a
yes is used by the United States military.
As I said to secure secret data and Serpent and to fish are also very popular choices.
Read up on these different algorithms if you like.
Just remember that using multiple algorithms will reduce your loading speeds for this demonstration.
I'm going to select a s for the hash algorithm.
You have a choice between SHA 256 and or IP BMD 160.
I will select SHA 256 when you've made your selections click Next notice that we're being told to select
a distinctive password.
This is important.
Whatever password we select for the hidden operating system needs to be substantially different than
the one that we use for the outer volume and the decoy operating system.
Even though I'll be using a simple password in this demonstration you really don't want to use less
than 20 characters.
He files are an option and you can set your P I am.
However PJM is really a bit advanced if you don't set it.
It uses the default which really is just fine.
It is your option.
While I do not recommend using key files for the reasons I have already stated you have that choice
as well.
Remember one thing.
If you lose your password or if you lose your key files or they become corrupted or if you set pin and
then forget the value that you set there is absolutely no way to recover this information and access
your hidden operating system.
You will be out of luck.
When you've set up your credentials click Next
I trust.
By now this screen needs no further explanation wave your mouse cursor around for as long as you can
stand it.
Remember that the little bar at the bottom of the screen is only a suggestion.
The longer you do this the better.
Notice that the file system and cluster options are great out at this stage.
These will be automatically determined by Vera crypt based on the options you've already selected.
And I do want to throw in a little footnote here about the difference between true crypt and Vera crypt.
True Crypt was found in the audit to contain a slight bug that was fixed in Vera crypt in the unlikely
event that Windows cryptographic were to fail.
Then this header and master key would be very easy to deconstruct if it were only relying upon windows
cryptographic.
Now as I said waving the mouse cursor around and gathering entropy increases the cryptographic strength
and means you're not completely dependent on us.
Now the reason I'm pointing this out is that the bug is that true crypt will allow you to proceed even
if Windows cryptographic were to fail when what it should do is barf catch fire and explode a very crypt
will not so very crypt will prompt you if there's some problem with your cryptographic set.
I have never seen this happen but I wanted to point it out and now seemed like a good time.
So when you're ready click format.
Done and done.
Just like with the creation of a hidden volume on USP the creation of a hidden volume happens almost
instantly click next.
Now get ready for the pain you thought creating outer volume took a long time.
You ain't seen nothing yet.
As soon as we click the Start button bear crypt will begin to copy this current version of Windows that
we are in right now into the hidden volume that we just created.
It is then going to wipe out all traces of the existence of the current windows installation in a secure
manner that we that we will be prompted to specify when you're ready click Start.
We are now going to be required to restart our computer once again.
So we will click yes.
Welcome to the very crypt bootloader.
If you watch the prior videos this should seem familiar to you.
It is possible to abort at this stage by pressing the escape key which will let you boot into windows.
We haven't as of yet done anything.
As soon as we put in our password to our hidden operating system however everything is going to be set
in motion.
Enter your hidden password.
Now
if you selected a specific value for Pym you would enter it now.
Otherwise just press the Enter key the password will now verify I've noticed that this verification
process takes substantially longer with Vera crypt than it does with true crypt.
Presumably this is a result of updated security although the true crypt audit which you can read about
online if you're interested and I do encourage you to do so.
Found no flaws with the bootloader implementation.
In any case you are in for a bit of a wait here.
But once the password does verify the process of copying the hidden operating system will begin.
There we go.
The version of Windows we were just using on the C partition or first partition is now being copied
into the hidden container or volume that we have created on the D partition.
That's the second partition.
Once this is done we'll boot into the hidden operating system on our newly created second partition
and be prompted to securely delete and wipe all data located on that first partition.
Once that is done we are going to install the exact same version of Windows as the one that we're using
on the hidden operating system onto the newly wiped C drive or first partition.
Then we're going to activate it download all of the updates which you won't actually see me do but you
should do it and then we're going to encrypt it as if it were a single operating system.
Once both systems are encrypted the very script bootloader will direct you to the correct system based
on which password you enter.
In other words if you wish to boot into the decoy system you would supply the decoy password.
If you want to boot into hidden operating system which is currently being created for us at this moment
then you'll need to supply the hidden password.
It is strongly recommended that you read through all of the very crypto documentation on hidden operating
systems so that you can maintain plausible deniability.
It is also recommended that you use your decoy operating system from time to time so that it shows signs
of being used a decoy system that is never used.
Makes a very poor decoy.
I would also like to note in case you are a little worried at this point that the decoy system works
exactly like a normal windows installation since there are actually two separate partitions you can
save files on the decoy operating system normally without any fear of corrupting the hidden system as
would be the case if you saved files to the outer volume without first placing it into protected mode.
This will be demonstrated a little later in this video for right now.
I'm going to make a cut to the recording so that we can skip to the end of this process and we can rejoin
it as soon as we're back in Windows.
Copying is now complete.
So enter the password to your hidden operating system.
Remember to just press enter for the PEM unless you set a specific value.
Then you'd enter that value.
Now windows should boot and I'll see you in a moment.
Fantastic.
Our hidden system has now started.
You can read through this if you want to.
It is just telling you that even though we appear to be on the C drive or the first partition we are
in fact on the second partition.
Of course your partition designations may vary but the point is that applications will not be able to
tell the difference between hidden and decoy systems because both systems will appear to be the primary
system partition or the C drive while you're using them.
If we click the defer button we can postpone the next step until our next reboot.
If you're ready to proceed click Next time to wait again.
The original system needs to be securely deleted as you know.
Simply deleting something off a hard drive won't actually make the information go away.
It can still be recovered with certain tools and forensic techniques to truly secure data.
We're going to need to overwrite the data we delete with random nonsense.
The more we do this the harder it will be to recover the original operating system or to detect that
one existed.
So we're going to click next as I explained in the prior video.
The number of passes indicates how securely your data is going to be wiped but also adds time to this
already lengthy process.
One pass will simply overwrite the operating system and that's that.
Three passes is a better level of security and is used by the Department of Defense of the United States
to wipe secret data seven passes is used by the DOJ to wipe data classified top secret and above 35
passes a.k.a. the Gutman wipe is generally used only when you plan to ultimately discard the drive.
It is extremely taxing on even conventional hard drives.
And remember also that solid state drives have a limited number of rewrites before they begin to fail.
The choice is yours but three passes should be very sufficient for most users.
If you have the time to devote and if you are paranoid 7 passage should be enough to defeat even the
most determined adversary however if your life hangs in the balance and absolutely positively must do
so then you can select Guttman.
I've never heard of anyone selecting 256 passes.
It was I wasn't even aware very crypt added this option and frankly it's beyond insane.
If you ever have a hard drive that requires that level of time and effort to wipe.
Honestly you're better off just smashing it to bits and burying the pieces.
250 passes will not be a good choice for hard drive longevity and I strongly recommend that you not
choose it anyway.
Make your selection and click next
click wipe.
Once again you'll be prompted with a warning that the entire contents of the original operating system
will be erased.
Once again we're going to be asked to generate entropy through mouse movements for a random pool.
This is because Windows cryptographic functions can potentially fail or be compromised.
As I've spoken about at some length
doing this may seem silly or burdensome but it adds an extra layer of security that is not easily sabotaged
when you're done click continue and yes to authorize.
As always we have to authorize and once done very crypto will proceed to wipe the original drive.
Keep in mind as you watch this that the amount of space that we're dealing with in this demonstration
is quite small and I'm only doing a single pass.
That's to say a single wipe for a modern hard drive.
Be prepared to devote many hours to the stage of the process and if you selected something like Gutmann
or 256 passes you're gonna be here a while.
All right.
The contents of the original system have now been securely erased.
Our first partition that we started out on is now totally blank.
You should read through this information carefully and maybe even printed the first thing it is telling
you to do is power off your computer and leave it powered off for at least several minutes.
Although ideally you should do so for up to an hour.
This is because memory still remains active in the RAM chips until they have had time to cool.
And this might include evidence of your hidden system's existence.
Once that is done the next step will be to install windows onto the now empty first partition.
Remember this has to be the same version of windows as the hidden system.
If you're running Windows 10 professional for your hidden system.
You need to install Windows 10 professional as your decoy.
If your hidden system was Windows XP you'll need to install Windows XP.
The third point to be aware of is that once you install windows the very crypt bootloader is going to
be erased and hidden operating system will not be mutable.
That is normal.
Don't panic.
It's part of the process.
You can read the rest of this if you want to but you'll be seeing me do it in a moment.
Do notice number 8 that you need to select the same algorithms for the decoy system as you did for the
hidden operating system.
That is why I said to write them down and here again we're being warned of the same thing.
I find that the hourglass continues to spin pretty much forever but we are done with this step so we
can actually exit the very crypt window.
Now we're going to shut down our computer and we're going to leave it off for a good long while.
Which of course you won't see represented in this video again.
I recommend you do this for about an hour.
It is up to you.
The documentation says a few minutes do as you wish.
After that we're going to need to insert our windows installation media whether it's a C.D. or a USB
stick and we're gonna boot our computer from it and then install Windows normally.
The key that you press when your computer reboots.
That allows you to boot from either CDE or USP will vary from computer to computer.
You can also make changes in your BIOS boot order if you wish.
That will cause your CV drive or USP stick to be checked first before your hard drive and will boot
from those devices.
If media is present so this is going to be a very straightforward process of reinstalling windows all
of which you'll see me do though I will make recording edits here and there to speed things along.
So when you're ready go ahead and shut down and will begin when you power backup.
All right.
So here we are.
Our computer has been off for a while and now we've rebooted using our Windows Media.
In this case Windows 10 and we're going to walk through the process of installing windows.
This is all very straightforward.
There shouldn't be any hiccups.
We're going to click.
Next we're going to click install now.
This is a very straightforward process of following prompts all of which you'll see me do.
So this is where we would enter our product key.
You should do so now.
You can't skip this step if you don't have it.
But remember you need to activate your Windows installation before you encrypted.
And this is very important.
Now obviously it doesn't matter if you're doing it in virtual box for practice but you will run into
problems later on if you're doing this on a real system.
And it could compromise your deniability and your anonymity.
So I'm going to click I don't have a product key.
Select your operating system.
You may not receive this prompt if you only have one on your disk.
I'm using Windows 10 professional.
Click Next agree to the Foulston contract with Microsoft and click next click custom.
Now remember the first partition after the system reserved is the one that we wiped.
The second partition contains our hidden operating system.
If you get confused remember that the hidden partition is always the larger of the two make your selection
and click next.
If you were to select your hidden system by mistake you will erase it.
So be careful.
Now we just wait and wait and wait some more.
Windows will carry itself through the installation process once all of the files are copied you'll be
asked to toggle a few preference switches.
You can flip these switches in any way that suits you or you can use the Express settings.
And with that done you will eventually find yourself back in windows.
I will make a recording edit to skip all of that unnecessary dross and get right to the point.
You shouldn't run into any problems just follow the procedure and you will boot into windows normally.
Keep in mind that your true crypt bootloader is going to be deleted.
So until we complete the next steps you will not be able to access the hidden operating system at all.
Here we are in our freshly installed Windows 10.
Now we're just going to go to the very crypt Web site and we're going to download it normally.
Remember that we'll need to download the installer and not the portable version once downloaded.
We're going to run the installer normally
OK.
We're gonna run through the installation real quick.
Select your language agree to the terms click next and install
with the installation complete.
We're gonna go ahead and we're going to run very script normally from here.
We're going to go to system and we're going to choose encrypt system partition slash drive.
Now remember we've already created our hidden operating system.
So we're going to select normal and click Next we're going to select the first option encrypt the Windows
system partition click Next now comes the ultra deceptive screen of confusing.
Once again you might think that selecting multi boot would be the way to go here.
But in reality that is pretty much never the correct selection.
Select single boot and then click next.
It is super important that we get this next selection right.
Remember I said to write down your selections when you made the hidden system.
You must make the same choices on this screen as you did for the hidden system.
If you selected advanced encryption standard and SHA 256 for the hidden operating system you must make
that same selection here.
If either the encryption algorithm or the hash algorithm are different the hidden operating system is
not going to boot.
Once you're done click next.
Now we need to choose our password for the decoy operating system.
Again it is important that you pick a good password to make the deception credible.
You also need to remember it.
If you're ever forced to give up your password.
This is the password that you'd want to give up.
Again.
Key files are an option.
Do not select the use of Pim option unless you did so with the hidden system.
And if you did set Pym with the hidden system be sure to use the same setting here
when you've entered all of your credentials and made your selections click next.
This is the random pool collection.
By now I trust that it's pretty clear what's actually happening here.
Wave your mouse cursor around fill up the bar or longer if you wish.
And when you're ready you'll just click next.
There we go.
Go ahead and authorize her keys have now been generated.
Click next.
Now comes the tricky bit both true crypt and Vera crypt require you to create a rescue disk.
If you encounter a situation where windows will not start or if the very crypt bootloader itself gets
messed up or otherwise corrupted the disk will allow you to repair the damage and keep one very important
detail in mind.
However the rescue disk is not a substitution for the password and or key files and or Pim if you forget
your password or lose your keys or if you specify APM and you forget it you are simply out of luck.
We can use the Browse button to select where we want the iso file to be saved.
This file will then be placed on some form of external media such as a USP or burned to a C.D. before
proceeding.
Very cryptic gives you the option to skip the rescue disk verification which is handy if your system
doesn't have any way to mount it.
True Crypt does not give you this option.
If you're using True Crypt you will need to mount the iso image somehow either by right clicking it
and selecting the mount option in certain versions of Windows or by using third party software in Windows
7 to mount the ISO as if it were a drive for this tutorial.
I'm going to go ahead and click skip rescue just verification.
Once you've made your selection click Next the rescue disk has been created.
This is the time when you would burn it onto a city or place it onto a USP click next.
Now this warning is interesting and I'd like you to please take note of it.
This is telling us that each rescue disk is unique.
So if you've done this in the past or if you get a rescue disk from a friend it will not work.
You will need to use this rescue disc for this system click OK.
OK last but not least we need to once again select our WIP mode since we already covered this with the
hidden system creation.
I won't go over it again for this demonstration I am selecting none.
Keep in mind that the more passes you select the longer this process is going to take and the harder
it's going to be on your drive.
Please do not select Guttman unless you feel you absolutely have to.
When you're ready click next.
The last step is going to be the system encryption pretest when we click the test button.
Windows is going to reboot and we will be presented with the very script password screen.
If we fail to enter our password or if something broke along the way the test will fail and no harm
will be done.
If the password works and everything else functions correctly we'll be prompted to proceed with the
encryption process.
Please note however that you must not boot into the hidden system at this time.
It will seriously goof things up when you're ready click test.
You may wish to print this information read through it if you wish.
The important takeaway here is that if Windows does not start during the pre-test simply press the escape
key at the bootloader screen to end the test and boot the system normally will now be prompted asking
us if we're ready to restart.
We will say yes here we are once again on the bootloader screen cosmetically This is almost identical
to the true script bootloader screen except that we have the option to show our password in Pym and
also to skip authentication with the escape key.
Remember this is only the pre-test.
Our system is not yet being encrypted.
Enter the password you selected for the decoy operating system again.
Do not enter the password for the hidden system or the outer volume
under Pim.
Just press enter unless you specified a value remember.
True Crypt has no Pym prompt.
It will now verify our password and this may take a minute or two.
Once done windows should boot normally Great.
Our pretest was successful.
Now we could click the defer button.
If we don't wish to begin encrypting right now or if already will click and encrypt read through this
pop up and printed if you wish.
It is simply telling you how to use the rescue desk if you need to.
When you're ready click OK.
Click yes to grant authorization now we can see the encryption process.
It would begin with the wiping of free space.
If we had selected a white mode other than none.
I said all of this in the last video.
But you may have skipped it and it does bear repeating.
So I'll say it again now.
I really can't stress just how long this takes.
You're seeing this performed on a very small amount of space.
But for a real system this process can take days.
A four terabyte hard drive might take up to a week or more.
Of course it depends on many factors.
I therefore suggest that you place your system somewhere cool and keep all potentially flammable objects
away from it as you mean to leave it on for an extended period of time unattended.
And the hard drive usage may cause it to heat up considerably.
I found this to be quite a problem with older laptops that have poor cooling systems.
Please also keep in mind the laws of your region of the world concerning encryption.
As I mentioned in the last video I am not an international lawyer.
Depending on where you are in the world encryption may not be legal or you may be under a legal obligation
to surrender your password and keys upon request by certain authorities even if they do not have a warrant
as such.
If you fail to comply with these laws you may end up in hot water.
This is very important to remember when you're traveling abroad.
It might be 100 percent legal to encrypt your laptop in the United States but you might be in for a
nasty shock when you travel to certain parts of the world and airport authorities demand that you decrypt
your laptop or worse you must therefore do your due diligence and make certain that you are employing
these techniques in a way that is consistent with the laws of wherever you are to avoid getting into
any legal trouble.
The hidden operating system and plausible deniability exists so that in the event that some criminal
attempts to compel you to give up your password you have a way of protecting your real data withholding
the hidden password from lawful authorities when you are expressly required by law to give up all of
your encryption keys may be illegal.
Please have all of this sorted out in your head before you ever find yourself in a situation where you
need to think about it.
Encryption is a very good technology.
It protects innocent people from oppressive powers.
Helps to ensure honest journalism and protect important information from criminal theft.
There are many good and lawful reasons to employ encryption.
Even at the level that we're seeing in this video.
Well it wasn't absolutely necessary to download all updates for your operating system before encrypting
it.
The reason I suggested that you do this is because particularly with Windows 10 when rebooting your
operating system you may find that it has downloaded things behind your back and it goes through a massive
long reconfiguration process.
For example right in the middle of your encryption pretest and that's really a pain to deal with.
So it's something to keep in mind.
All right.
Encryption process is finished.
Now all we need to do is reboot or reboot normally I'm sure this screen needs no further introduction
should be familiar by now.
If we enter our decoy password our decoy operating system will boot if we enter our hidden password
our hidden operating system will boot.
We're going to be booting into our hidden system first to verify that everything did in fact work.
Remember just a press enter for the Pym unless you specified a value fantastic or hidden operating system
booted and is working normally.
And this pop up will continue to appear unless you click the do not show this again button and it is
simply reminding us about local unencrypted file systems and Non hidden very corrupt volumes are mounted
as being read only and this will include any USP devices that you plug into your system.
So we don't need this reminder forever I'm going to click do not show this again and now we're going
to reboot one more time in this time.
We're going to boot into the decoy operating system so here we are at the bootloader screen once again
we're going to enter our decoy password great.
The decoy has also booted normally.
All right.
We could end right here but there is one more detail to go over before we call it a job well done and
give ourselves a pat on the back.
Notice that we have two drives here CND.
Fun fact C is always going to be the operating system that you're currently in regardless of whether
you're running it in decoy or the hidden OS but the important takeaway here is that you have this second
partition and if you were to examine it closely it appears to be filled with random data.
If we try to open it we'll be prompted to format it.
Do not do this.
If you click format you will your race your hidden operating system.
How then can we explain this encrypted partition.
If someone were to ask this is where the outer volume password comes into play.
So we're going to open very crypt and we're going to go ahead and select a drive that is not currently
in use for simplicity's sake I'm going to highlight the Z drive.
Then we're going to click select device and we're going to choose this D partition click OK.
Now we're going to mount the volume by clicking mount and we're going to enter our outer volume password
click OK the partition is now mounted and registers as being a normal type.
It is actually anything but normal.
However this is all part of the deception.
Once the drive is mounted we can access it.
Normally under the newly mounted Z drive
inside this Z drive will be the sensitive looking files that look like something we would want to encrypt.
Someone very knowledgeable about how Barbara crypt works might suspect the deception but will be unable
to prove the existence of a hidden operating system.
This gives you the plausible deniability spoken about in the very cryptic documentation.
One last thing.
Do not under any circumstances add or modify files on this drive.
You run the risk of damaging your hidden operating system.
If you need to interact with this file space at a time when you're not under any sort of threat such
as when you're alone then you need to mount the drive in what is called protected mode.
However doing this will reveal to anyone who's watching that it is in protected mode and will reveal
the presence of a hidden operating system.
So to do this we're going to close this file and we're going to dismount the drive so we're going to
mount the file again just like we did before.
Only this time we're going to go into Mount options.
We're going to click protect hidden volume against damage caused by writing to the outer volume and
we're going to supply the password to our hidden operating system.
As well as any Pym or key files that we use then we're going to click OK
and then we're going to sort we're going to enter the outer volume password as a normal click.
OK this message is telling us that the hidden volume is now protected against damage until it is dismounted.
Notice that now the character of the volume is revealed as outer under type.
So only mount the volume in this way again when you're alone and then only when you absolutely have
to.
And that's really about it.
How you use your decoy and hidden operating systems is entirely up to you.
However I would suggest making frequent use of your decoy making your daily driver for most of the things
that you do only use the hidden system for activities or when dealing with data that needs to stay hidden.
That way if anyone ever has any cause to examine your decoy system it will appear lived in a decoy system
that is never used is going to look extremely suspicious.
Also remember that the hidden operating system right protects things like external media to prevent
data leaks.
So you may find that certain activities like transferring files by a USP is a pain when using the hidden
OS in the last video.
I gave a demonstration of how to remove the encryption for an operating system if you so desire.
Please see that video for more information about doing that.
If you wish.
However this will leave you with two windows systems installed side by side and a potentially broken
bootloader.
So please make sure you have a boot repaired disc handy.
If you decide to do that if at any point you wish to start over from scratch and I do mean from square
one or if you just wish to securely delete all encrypted data once you're done using all of your encrypted
systems please see the video later in this module covering Derek's boot and nuke boot and nuke will
completely wipe a hard drive including its partition table and allow you to start fresh with the obvious
catch being that all of your data will be totally erased securely but erased.
Finally it's worth repeating that for any of this to work you will need to disable protected boot settings
in your BIOS if they exist.
This is done at your own risk and may require you to reinstall your operating system.
It may also be possible to switch from GP t partitioning to MPR and put the boot loader into legacy
mode.
Again this is done at your own risk although it may make things much smoother because every version
of bios is a little different.
There isn't really any way to showcase this so you may need to research the subject a bit.
If you are considering doing it and to make sure it's right for you and your system I do recommend practicing
using a virtual machines until you get the hang of this before you try to do it on your actual system.
Thank you for your attention.
I'll see you in the next video.