Menu ▾ ▴

Whole Drive (grayed out) vs Windows system partition - is there security differences?

Technical Topics
aidukonis
2018-03-08
2019-03-26

  • Alex

    Alex - 2018-03-09

    If C: is the only drive C: content is encrypted. Data outside C: is not encrypted (~100MB for ESP and MSR) It is normal level of security (like BitLocker) and easy to install.

    To achieve better level of security there are several ways:
    1. separate keys and data (move header to USB)
    2. create hidden OS
    3. use TPM and secure boot to protect boot loader from modification

     

  • aidukonis

    aidukonis - 2018-03-09

    Thank you very much Alex for prompt reply!
    I have Googled a lot about ESP and from your answer understood that despite I see a single drive:

    In reality I have several partitions:

    EasyUS Partition Master:

    (side-note: for clarity I have Win10 Home and BitLocker is not included)

    The ESP holds Boot, Recovery, Logs, etc:

    If I may re-phrase the question then, if I select "Encrypt the Windows system partition" for disk C:

    Is there a possibility for somebody (who theoretically acquires my PC without my knowledge and does not know the VeraCrypt password to access encrypted data on disk C), to somehow retrieve the data from disk C, because other partitions (e.g. ESP or other) is not encrypted and logs/backups the data from C drive for recovery or any other set-by-default reasons?

    If there is no such possibility, then encrypting data on C is totally sufficient to protect data. If it is somehow replicated/backuped/logged outside C drive OS partition (factory settings) on those unencrypted partitions, then there is a security pickle. This is why I am wondering about the difference between encrypting partition vs whole disk.

    Hope it helps others as well.

    I would very much appreciate your answer, Alex.

     
    Thumbnail
    Explore-ESP-partition.png

    • Alex

      Alex - 2018-03-10

      if someone found your notebook, data on C: drive is protected good enough.

      Notes: there are many possibilities to attack.
      e.g.
      1. Spy program can save data outside encrypted region - this is one of the ways. (it depends what do you use in the OS) It can be data or header with keys decrypted.
      2. Data is protected by password - the only authorization factor. (it is complex but the only) It is possible to capture it. e.g. via pre boot spy or external video.

      Security is balance. VeraCrypt can give good level (comparable to commercial software)

       

  • aidukonis

    aidukonis - 2018-03-10

    Thank you for the answer Alex!

     

  • drowned

    drowned - 2019-03-26

    Man, I'm just not happy with this! Aidukonis' screenshot of his sole drive shows a typical Windows security nightmare - there's stuff EVERYWHERE!!! Stupid little unexplained & cryptically named partitions, all clearly separate from C: and all outside Veracrypt's remit. Depending on your activities / location / endangerment etc any one of them could get you blackmailed, tortured, persecuted, imprisoned... Seriously, it's not good enough. Yes, I hugely admire the efforts of the Veracrypt team but that doesn't change the principal fact - that a secured system must be completely secured.

     

Log in to post a comment.