Review: Full disk encryption DiskCryptor v0.7.435.90

Most of you will have heard of Truecrypt, a free an open source hard disk encryption product, there are only another free and open source software for full disk encryption in Windows that I am aware of, DiskCryptor. You can download a 32bit or 64bit version of Diskcryptor depending on your OS.

I tested DiskCryptor using it for full disk encryption of my netbook, an Asus PC901 with a 12GB HDD divided in between two solid state disks of 8GB and 4GB. DiskCryptor is an ideal alternative to encrypt a netbook because netbooks do not have a CD drive and Truecrypt will force you to burn a CD to use system encryption, which DiskCryptor does not.

DiskCryptor cascade algortyhms
DiskCryptor cascade algortyhms

The first thing that impressed me of DiskCryptor is how small it is in size, a little over 500KB, but this comes at a price since the software manual does not come along and you get a link to their website instead.

I was pleased to see DiskCryptor offering a wide choice of encryption algorythms, AES-256, Twofish or Serpent algorithms in XTS mode, all of them seem to be pretty sound algorythms to me, and they can be used on cascade mode as well, VIA Padlock hardware accelaration for encryption and hashing is supported too.

The built-in benchmark shows the top speed with which cryptographic algorithms can perform, but I have to tell you that even on a netbook with a single core Intel Atom processor, regardless of the encryption algortyhm used I noticed no perfomance difference while using the netbook.

DiskCryptor encryption of partition
DiskCryptor encryption of partition

DiskCryptor allows wipe while encrypting, with three, seven or thirty five passes (Guttman method), but wiping a solid state disk like the one Asus Eee PC901 has is not safe, since solid state disks, like thumb drives, use wear levelling technology and the wiping passes are spread evenly accross the disk and not on the same sectors. If you are using a solid state disk, make sure it does not contain any confidential data that an electrons microscope could recover(very expensive to do right now), the only way to do this is by using a new disk, wiping it may fail to sanitize de disk.

With DiskCryptor you also can encrypt an ISO file and then burn it to CD-R/DVD/BD-R , after that you  will only be able to mount the image with DiskCryptor and the correct password/keyfile.

You can also set up a hot key to cause a blue screen of death, if you need to urgently shut down your computer when someone busts into your home unexpectedly this seems the way to go, it is quicker than clicking on the power off button.

The Good Stuff

DiskCryptor works with RAID volumes, you get a wide choice of algorythms, DiskCryptor is easy to use and unlike Truecrypt, it works on netbooks out of the box. DiskCryptor is open source, you can check for backdoors if you have the skills.

The software does not cost you any money, you can customize the boot loader widely, DiskCryptor boot loader customization is far better than Truecrypt, you can choose to install the bootloader on a CD/DVD, set up timeouts, choose if you want to use a QUERTY or DVORAK keyboard, and there is also a Windows live CD BartPE plugin for DiskCryptor.

The Bad Stuff

DiskCryptor should include some basic documentation at the very least, the GUI is easy to use and intuitive but encryption products need to come with instructions, a newbie could easily feel overwhelmed. DiskCriptor is only available for Windows, and there is no choice of hashing algorythms other than the default SHA-512.

There is also no choice of burning a recovery CD in case the boot loader gets corrupted (although you can backup the headers).

DiskCryptor password enter box
DiskCryptor password box

Conclusion

DiskCryptor is an excellent free and open source full disk encryption  alternative to Truecrypt, with a wide choice of encryption algorythms and easy to use, but they need to improve their poor documentation.

Their FAQ states that they are planning to implement a hidden OS in future versions, I think Diskcryptor looks promising and Truecrypt has a worthy competitor.

http://www.diskcryptor.net

Video: How to, encryption with PGP 9 Desktop

This is an introduction video for begginers, if you have never seen or heard of PGP Desktop, this video explains briefly in 5 minutes what it can do for your privacy.

If you want to keep all your computer data encrypted, including the OS, after Truecrypt and Drivecrypt Plus Pack , PGP Desktop would be my third choice. As far as I know all three of them are uncrackable, even by the highest powers out there. But bear in mind that it is illegal in the United Kingdom not to reveal your password to your encrypted files when requested by the authorities.

PGP 9 will not protect you against a Government forcing you to give away the password for your personal secrets, you should be using Truecrypt or Drivecrypt Plus Pack if you think this may happen to you. Both of those encryption schemes provide for a hidden operating system which existence can not be proven, you can not be asked to provide what can not be proven to exist.

If you are comparing encryption software you can read my past  review of Drivecrypt Plus Pack v3.94

Review: Drivecrypt Plus Pack v3.95, full disk encryption

Some people out there are antagonistic to encryption software that is not open source and can not be reviewed for backdoors. Drivecrypt Plus Pack is one such proprietary encryption product.

There maybe some reason why you may want to use it, for example some special feature of compatibility issues. I decided to download Drivecrypt Plus Pack after Truecrypt 6.1a started to give me problems at boot up time.

DriveCrypt Plus Pack full disk encryption has very few things in common with Truecrypt in relation to usability and functions, if you are a former Truecrypt user you will need to read the DCPP manual to understand some terms and features not present in Truecrypt.

DriveCrypt Plus Pack v3.94 Install

DriveCrypt Plus Pack v3.94 Install

DriveCrypt Plus Pack allows you to secure your disk, including removable media, with a powerful and proven encryption algorithm (AES-256), AES-256 is a FIPS approved symmetric encryption algorithm.

DriveCrypt Plus Pack main features:

- Full disk encryption, encrypts 100% of your hard disk including the operating system.

- Pre-boot authentication, before the machines boots a password is requested to decrypt the disk and start your machine.

- It can create an encrypted hidden operating system which existence can be denied, this is useful if you are ever forced to give out your password.

- Strong 256bit AES encryption

- Optional USB-Token authentication at pre-boot level

Before you start encrypting your disk you must install what DCPP calls BootAuth, this is the Master Boot Record, if you attempt to encrypt the disk without BootAuth you will be stopped and a message will warn you.

The Good Stuff

Once you are registered with Securstar website you will have access to video tutorials online about how to use DriveCrypt Plus Pack.

DCPP allows the use of a USB key as a password, but if you think that the Stasi or any other repressive government agency can raid your home, you will be better off memorasing your passphrase.

Drivecrypt Plus Pack has specific administator/user rights, ideal for corporations and multiuser computers.

The master password to access the encryption keys held in your keystore can be hidden in pictures (.bmp) or sounds (.wav) using steganography.

You can set up a logon password that when entered will destroy the BootAuth, deleting the bootloader and making the disk unbootable. To use this against a repressive regime avoiding being accussed of obstruction to justice you can write the destruction password down next to your computer with the word “password” on it, and the Stasi will enter it for you in their computer forensics laboratory, destroying the bootloader themselves.

DriveCrypt Plus Pack comes with various BootAuth, this is how DCPP names the logon screen, one of them consists of a black BootAuth with the message “Hard disk failure”. It will not fool a computer forensics expert but can be optimal to fool your noisy flatmate.

DriveCrypt Plus Pack manual also explains how you can create your own customized logon screen with an image editor.

Securstar, the company selling Drivecrypt Plus Pack, accepts payments by check, Paypal, credit card or bank transfer. There is a Windows Vista 64 bit version available as well as the most widely used 32 bit.

You can test the integrity of the encryption method with a small utility included in Drive Crypt Plus Pack.

You can assign a hotkey to lock your computer if you have to go away from your computer for a few moments, this will activate a password protected screensaver.

If you have any problem or query Securstar provides support via email.

DriveCrypt Plus Pack Keystorage

DriveCrypt Plus Pack Keystorage

The Bad Stuff

The software is propietary, nobody can access the source code and it only works in Windows.

Drive Crypt Plus Pack help file and instuctions are poor and not detailed enough,  the Red Screen and BootAuth destruction features in particular are poorly documented.

Their official online support team, although replying quickly, in my experience, are not too knowledgeable of the product.

Raid and dynamic disks are not supported, normally this should not be a problem for home users, only for businesses, it may still work but Securstar does not support it.

You can not use the non hidden operating system normally, only have it created in case you are forced to reveal the password.

A computer forensics investigator will be able to find out the last time you accessed that non hidden operating sytem by looking at the file timestamps.

Notice that Truecrypt hidden operating system feature also has the same problem, as the predicament arises from Windows itself,  download Mr. Bruce Schneir Defeating Deniable Encrypted File Systems research paper for more info on this.

You will need internet access to register the software.

Conclusion

Assuming you trust closed source full disk encryption software DriveCrypt will be a great choice. Unlike other similar commercial software like PGP whole disk encryption, DCPP has some features ideal for home users.

Some examples are: Creating an operating system which existance can not be proved, capability to destroy BootAuth entering a determined password to make the disk unbootable, use of steganography to hide your encryption keys inside a picture or sound file, realistic hard disk failure logon black screen and the possibility of creating your own preboot screen with a simple photo editor.

Truecrypt vs. DriveCrypt Plus Pack:

DriveCrypt Plus Pack is a commercial venture and can not compete in price against Truecrypt, which is free.

Truecrypt source code can be checked for backdoors and reliability (although to the best of my knowledge nobody qualified has looked into its source code yet and said it is safe).

DriveCrypt Plus Pack has a support team that will help you in case of problems, Truecrypt has not.

DriveCrypt Plus Pack has some extra features like customizing of boot up screen, hiding of encryption keys for the keystore through steganography and USB authentication token support.

Truecrypt works in Linux as well as Windows, if you encrypt an external hard disk with Truecrypt in Windows you can then open that encrypted disk with your Linux computer.

DriveCrypt Plus Pack does not force you to burn a CD before you install the software, this is my greatest grunge against Truecrypt developers. See my work around to install Truecrypt on a computer without CD drive if you want to install Truecrypt on your netbook.

Truecrypt instructions manual is first rate, and I think everyone should read it even if they do not use Truecrypt. Not only it contains help about their product but it also explains how you should tweak Windows to avoid data leaks. Truecrypt also has a wider choice of encryption algorythms than DriveCrypt Plus Pack, but DCPP AES256 is considered a standard and this is the one I would use with any encryption program.

DriveCrypt Plus Pack BootAuth in hidden mode

DriveCrypt Plus Pack BootAuth in hidden mode

PS:

Whole disk encryption booting up problem solved!

I have experienced this with Truecrypt and DriveCrypt Plus Pack, this is not a software issue, it can happen with ANY whole disk encryption program.

Your computer hard disk will spin non stop and you will see this message on the screen while booting up your computer:

>Verifying DMI pool data…
>Boot from CD:
>Disk boot failure, insert system disk and press enter

This is a BIOS problem, as far as I know there is no easy solution other than getting into the BIOS and disabling the booting from CD option, you should be able to do this on any modern BIOS. If you then one day need to boot from a CD-Rom you will need to enable this option again.

Installing Truecrypt 6.1a on a computer without CD drive

If you want to have whole disk encryption on your netbook you will be dissapointed with Truecrypt because unless you burn a .iso on a CD first, Truecrypt will not allow you to encrypt your drive, but there is a way around this, it worked for me so it should do it for you too.

Download software that will mount your .iso CDs virtually , I used Alcohol120,  this is not free, but the trial version worked well,  the only problem I had was finding out how to mount the virtual CD with Alcohol120 as I didnt really want to waste half day reading the manual. Once you mount your virtual .iso CD created by Truecrypt you are ready to go, Truecrypt will allow you to encrypt your whole Netbook Windows operating system as normal.

You can  also use Daemon Tools to emulate the mounting of your Truecrypt recovery disc virtually.

Asus eee pc 901

Asus eee pc 901

This is what the Truecrypt recovery disk looks like once mounted through a virtual drive using Alcohol:

Truecrypt revocovery disk mounted through a virtual drive
Truecrypt revocovery disk mounted through a virtual drive

You can also use this trick to avoid wasting a CD-Rom while installing Truecrypt on your desktop computer, it is pretty sad that Truecrypt developers are  not allowing people to make their own choices and making the creation of an emergency recovery disc compulsory.