Known Issues & Limitations

Last Updated July 24, 2010

Known Issues

• TrueCrypt 7.0 on Windows 7/Vista/2008: Some custom (non-Microsoft) drivers for storage device controllers contain a bug causing an incompatibility with hibernation filter drivers (TrueCrypt installs such a filter driver starting with version 7.0). This might prevent your system from hibernating (a system error might occur instead of hibernation).
  
  Possible solutions:
  
  
  • Uninstall any non-Microsoft drivers for storage device controllers and use standard Microsoft drivers supplied with Windows instead. To do so, follow these steps: select Control Panel > Hardware and Sound > Device Manager. Then double-click IDE ATA/ATAPI controllers, or (if this group does not contain any controllers with custom drivers) double-click Storage controllers. Right-click the controller device item and select Update Driver Software > Browse my computer for driver software > Let me pick from a list of device drivers. Select one of the drivers and click next to install it. Then double-click the controller device item in the Device Manager window, select the Driver tab and verify whether the Driver Provider is Microsoft. If it is not, repeat the above steps but select a different driver. When you find a driver whose provider is Microsoft, install it and restart the computer.
    
    Or:
    
    
  • Do not use hibernation on your computer (instead of hibernating it, shut it down) until the issue has been resolved. We are considering implementing a workaround for this issue (the workaround currently appears to be forbidden by the Microsoft guidelines for driver design).
    
    

Limitations

• [Note: This limitation does not apply to users of Windows Vista and later versions of Windows.] On Windows XP/2003, TrueCrypt does not support encrypting an entire system drive that contains extended (logical) partitions. You can encrypt an entire system drive provided that it contains only primary partitions. Extended (logical) partitions must not be created on any system drive that is partially or fully encrypted (only primary partitions may be created on it). Note: If you need to encrypt an entire drive containing extended partitions, you can encrypt the system partition and, in addition, create partition-hosted TrueCrypt volumes within any non-system partitions on the drive. Alternatively, you may want to consider upgrading to Windows Vista or a later version of Windows.
  
  
• TrueCrypt currently does not support encrypting a system drive that has been converted to a dynamic disk.
  
  
• TrueCrypt does not support pre-boot authentication for operating systems installed within VHD files.
  
  
• TrueCrypt volume passwords must consist only of printable ASCII characters. Non-ASCII characters in passwords are not supported and may cause various problems (e.g., inability to mount a volume).
  
  
• To work around a Windows XP issue, the TrueCrypt boot loader is always automatically configured for the version of the operating system under which it is installed. When the version of the system changes (for example, the TrueCrypt boot loader is installed when Windows Vista is running but it is later used to boot Windows XP) you may encounter various known and unknown issues (for example, on some notebooks, Windows XP may fail to display the log-on screen). Note that this affects multi-boot configurations, TrueCrypt Rescue Disks, and decoy/hidden operating systems (therefore, if the hidden system is e.g. Windows XP, the decoy system should be Windows XP too).
  
  
• The ability to mount a partition that is within the key scope of system encryption without pre-boot authentication (for example, a partition located on the encrypted system drive of another operating system that is not running), which can be done e.g. by selecting System > Mount Without Pre-Boot Authentication, is limited to primary partitions (extended/logical partitions cannot be mounted this way).
  
  
• Due to a Windows 2000 issue, TrueCrypt does not support the Windows Mount Manager under Windows 2000. Therefore, some Windows 2000 built-in tools, such as Disk Defragmenter, do not work on TrueCrypt volumes. Furthermore, it is not possible to use the Mount Manager services under Windows 2000, e.g., assign a mount point to a TrueCrypt volume (i.e., attach a TrueCrypt volume to a folder).
  
  
• The Windows Volume Shadow Copy Service is currently supported only for partitions within the key scope of system encryption (for example, a system partition encrypted by TrueCrypt or a non-system partition located on a system drive encrypted by TrueCrypt). Note: For other types of volumes, the Volume Shadow Copy Service is not supported because the documentation for the necessary API is available from Microsoft only under a non-disclosure agreement (which is impossible to comply with because TrueCrypt is open source).
  
  
• Windows boot settings cannot be changed from within a hidden operating system if the system does not boot from the partition on which it is installed. This is due to the fact that, for security reasons, the boot partition is mounted as read-only when the hidden system is running. To be able to change the boot settings, please start the decoy operating system.
  
  
• Encrypted partitions cannot be resized except partitions on an entirely encrypted system drive that are resized while the encrypted operating system is running.
  
  
• When the system partition/drive is encrypted, the system cannot be upgraded (for example, from Windows XP to Windows Vista) or repaired from within the pre-boot environment (using a Windows setup CD/DVD or the Windows pre-boot component). In such cases, the system partition/drive must be decrypted first. Note: A running operating system can be updated (security patches, service packs, etc.) without any problems even when the system partition/drive is encrypted.
  
  
• When the notebook battery power is low, Windows may omit sending the appropriate messages to running applications when the computer is entering power saving mode. Therefore, TrueCrypt may fail to auto-dismount volumes in such cases.
  
  
• Due to a Windows limitation, a container stored in a remote filesystem shared over a network cannot be mounted as a system favorite volume (however, it can be mounted as a regular, non-system, favorite volume when a user logs on).
  
  
• Preserving of the timestamp of any file (e.g. a container or keyfile) is not guaranteed to be reliably and securely performed (for example, due to filesystem journals, timestamps of file attributes, or the operating system failing to perform it for various documented and undocumented reasons). Note: When you write to a file-hosted hidden volume, the timestamp of the container may change. This can be plausibly explained as having been caused by changing the (outer) volume password. Also note that TrueCrypt never preserves timestamps of system favorite volumes (regardless of the settings).
  
  
• Special software (e.g., a low-level disk editor) that writes data to a disk drive in a way that circumvents drivers in the driver stack of the class 'DiskDrive' (GUID of the class is 4D36E967-E325-11CE-BFC1-08002BE10318) can write unencrypted data to a non-system drive hosting a mounted TrueCrypt volume ('Partition0') and to encrypted partitions/drives that are within the key scope of active system encryption (TrueCrypt does not encrypt such data written that way). Similarly, software that writes data to a disk drive circumventing drivers in the driver stack of the class 'Storage Volume' (GUID of the class is 71A27CDD-812A-11D0-BEC7-08002BE2092F) can write unencrypted data to TrueCrypt partition-hosted volumes (even if they are mounted).
  
  
• For security reasons, when a hidden operating system is running, TrueCrypt ensures that all local unencrypted filesystems and non-hidden TrueCrypt volumes are read-only. However, this does not apply to filesystems on CD/DVD-like media and on custom, atypical, or non-standard devices/media (for example, any devices/media whose class is other than the Windows device class 'Storage Volume' or that do not meet the requirements of this class (GUID of the class is 71A27CDD-812A-11D0-BEC7-08002BE2092F)).
  
  
• Device-hosted TrueCrypt volumes located on floppy disks are not supported. Note: You can still create file-hosted TrueCrypt volumes on floppy disks.