Introduction

Beginner's Tutorial

System Encryption

 Supported Systems

 Hidden Operating System

 Rescue Disk

Plausible Deniability

 Hidden Volume

  Protection of Hidden Vol.

  Security Requirements

 Hidden Operating System

Parallelization

Pipelining

Hardware Acceleration

Encryption Algorithms

 AES

 Serpent

 Twofish

 Cascades

Hash Algorithms

 RIPEMD-160

 SHA-512

 Whirlpool

Technical Details

 Notation

 Encryption Scheme

 Modes of Operation

 Header Key Derivation

 Random Number Gen.

 Keyfiles

 Volume Format Spec.

 Standards Compliance

 Source Code

TrueCrypt Volume

 Creating New Volumes

 Favorite Volumes

 System Favorite Volumes

Main Program Window

 Program Menu

 Mounting Volumes

Supported Systems

Portable Mode

Keyfiles

Tokens & Smart Cards

Language Packs

Hot Keys

Security Model

Security Requirements

 Data Leaks

  Paging File

  Hibernation File

  Memory Dump Files

 Unencrypted Data in RAM

 Physical Security

 Malware

 Multi-User Environment

 Authenticity and Integrity

 New Passwords & Keyfiles

 Password/Keyfile Change

 Trim Operation

 Wear-Leveling

 Reallocated Sectors

 Defragmenting

 Journaling File Systems

 Volume Clones

 Additional Requirements

Command Line Usage

Backing Up Securely

Miscellaneous

 Use Without Admin Rights

 Sharing over Network

 Background Task

 Removable Medium Vol.

 TrueCrypt System Files

 Removing Encryption

 Uninstalling TrueCrypt

 Digital Signatures

Troubleshooting

Incompatibilities

Issues and Limitations

License

Future Development

Acknowledgements

Version History

References

   

Main Program Window >  Program Menu Search

Disclaimers





Please consider making a donation.

   Donate Now >> Donate   


Program Menu

Note: To save space, only the menu items that are not self-explanatory are described in this documentation.


Volumes -> Auto-Mount All Device-Hosted Volumes

See the section Auto-Mount Devices in the chapter Main Program Window.


Volumes -> Dismount All Mounted Volumes

See the section Dismount All in the chapter Main Program Window.


Volumes -> Set Header Key Derivation Algorithm

This function allows you to re-encrypt a volume header with a header key derived using a different PRF function (for example, instead of HMAC-RIPEMD-160 you could use HMAC-SHA-512). Note that the volume header contains the master encryption key with which the volume is encrypted. Therefore, the data stored on the volume will not be lost after you use this function. For more information, see the section Header Key Derivation, Salt, and Iteration Count.

Note: When TrueCrypt re-encrypts a volume header, the original volume header is first overwritten 256 times with random data to prevent adversaries from using techniques such as magnetic force microscopy or magnetic force scanning tunneling microscopy [17] to recover the overwritten header (however, see also the chapter Security Requirements and Precautions).


Volumes -> Change Volume Password

Allows changing the password of the currently selected TrueCrypt volume (no matter whether the volume is hidden or standard). Only the header key and the secondary header key (XTS mode) are changed – the master key remains unchanged. This function re-encrypts the volume header using a header encryption key derived from a new password. Note that the volume header contains the master encryption key with which the volume is encrypted. Therefore, the data stored on the volume will not be lost after you use this function (password change will only take a few seconds).

To change a TrueCrypt volume password, click on Select File or Select Device, then select the volume, and from the Volumes menu select Change Volume Password.

Note: For information on how to change a password used for pre-boot authentication, please see the section System > Change Password.

PKCS-5 PRF

In this field you can select the algorithm that will be used in deriving new volume header keys (for more information, see the section Header Key Derivation, Salt, and Iteration Count) and in generating the new salt (for more information, see the section Random Number Generator).

Note: When TrueCrypt re-encrypts a volume header, the original volume header is first overwritten 256 times with random data to prevent adversaries from using techniques such as magnetic force microscopy or magnetic force scanning tunneling microscopy [17] to recover the overwritten header (however, see also the chapter Security Requirements and Precautions).

See also the chapter Security Requirements and Precautions.


Volumes -> Add/Remove Keyfiles to/from Volume

Volumes -> Remove All Keyfiles from Volume

See the chapter Keyfiles.


System -> Change Password

Changes the password used for pre-boot authentication (see the chapter System Encryption).

WARNING: Your TrueCrypt Rescue Disk allows you to restore key data if it is damaged. By doing so, you also restore the password that was valid when the TrueCrypt Rescue Disk was created. Therefore, whenever you change the password, you should destroy your TrueCrypt Rescue Disk and create a new one (select System > Create Rescue Disk). Otherwise, an attacker could decrypt your system partition/drive using the old password (if he finds the old TrueCrypt Rescue Disk and uses it to restore the key data). See also the chapter Security Requirements and Precautions.

For more information on changing a password, please see the section Volumes > Change Volume Password above.


System -> Mount Without Pre-Boot Authentication

Check this option, if you need to mount a partition that is within the key scope of system encryption without pre-boot authentication. For example, if you need to mount a partition located on the encrypted system drive of another operating system that is not running. This can be useful e.g. when you need to back up or repair an operating system encrypted by TrueCrypt (from within another operating system).

Note: If you need to mount multiple partitions at once, click 'Auto-Mount Devices', then click 'Mount Options' and enable the option 'Mount partition using system encryption without pre-boot authentication'.

Please note you cannot use this function to mount extended (logical) partitions that are located on an entirely encrypted system drive.


Favorites -> Add Mounted Volume to Favorites

Favorites -> Organize Favorite Volumes

Favorites -> Mount Favorites Volumes

See the chapter Favorite Volumes.


Favorites -> Add Mounted Volume to System Favorites

Favorites -> Organize System Favorite Volumes

See the chapter System Favorite Volumes.


Tools -> Clear Volume History

Clears the list containing the file names (if file-hosted) and paths of the last twenty successfully mounted volumes.


Tools -> Traveler Disk Setup

See the chapter Portable Mode.


Tools -> Keyfile Generator

See the section Tools > Keyfile Generator in the chapter Keyfiles.


Tools -> Backup Volume Header


Tools -> Restore Volume Header

If the header of a TrueCrypt volume is damaged, the volume is, in most cases, impossible to mount. Therefore, each volume created by TrueCrypt 6.0 or later contains an embedded backup header, located at the end of the volume. For extra safety, you can also create external volume header backup files. To do so, click Select Device or Select File, select the volume, select Tools > Backup Volume Header, and then follow the instructions.

Note: A backup header (embedded or external) is not a copy of the original volume header because it is encrypted with a different header key derived using a different salt (see the section Header Key Derivation, Salt, and Iteration Count). When the volume password and/or keyfiles are changed, or when the header is restored from the embedded (or an external) header backup, both the volume header and the backup header (embedded in the volume) are re-encrypted with header keys derived using newly generated salts (the salt for the volume header is different from the salt for the backup header). Each salt is generated by the TrueCrypt random number generator (see the section Random Number Generator).

Both types of header backups (embedded and external) can be used to repair a damaged volume header. To do so, click Select Device or Select File, select the volume, select Tools > Restore Volume Header, and then follow the instructions.

WARNING: Restoring a volume header also restores the volume password that was valid when the backup was created. Moreover, if keyfile(s) are/is necessary to mount a volume when the backup is created, the same keyfile(s) will be necessary to mount the volume again after the volume header is restored. For more information, see the section Encryption Scheme.

After you create a volume header backup, you might need to create a new one only when you change the volume password and/or keyfiles. Otherwise, the volume header remains unmodified so the volume header backup remains up-to-date.

Note: Apart from salt (which is a sequence of random numbers), external header backup files do not contain any unencrypted information and they cannot be decrypted without knowing the correct password and/or supplying the correct keyfile(s). For more information, see the chapter Technical Details.

When you create an external header backup, both the standard volume header and the area where a hidden volume header can be stored is backed up, even if there is no hidden volume within the volume (to preserve plausible deniability of hidden volumes). If there is no hidden volume within the volume, the area reserved for the hidden volume header in the backup file will be filled with random data (to preserve plausible deniability).

When restoring a volume header, you need to choose the type of volume whose header you wish to restore (a standard or hidden volume). Only one volume header can be restored at a time. To restore both headers, you need to use the function twice (Tools > Restore Volume Header). You will need to enter the correct password (and/or to supply the correct keyfiles) that was/were valid when the volume header backup was created. The password (and/or keyfiles) will also automatically determine the type of the volume header to restore, i.e. standard or hidden (note that TrueCrypt determines the type through the process of trial and error).

Note: If the user fails to supply the correct password (and/or keyfiles) twice in a row when trying to mount a volume, TrueCrypt will automatically try to mount the volume using the embedded backup header (in addition to trying to mount it using the primary header) each subsequent time that the user attempts to mount the volume (until he or she clicks Cancel). If TrueCrypt fails to decrypt the primary header but it successfully decrypts the embedded backup header at the same time, the volume is mounted and the user is warned that the volume header is damaged (and informed as to how to repair it).


Settings -> Preferences

Invokes the Preferences dialog window, where you can change, among others, the following options:

Wipe cached passwords on exit

If enabled, passwords (which may also contain processed keyfile contents) cached in driver memory will be cleared when TrueCrypt exits.

Cache passwords in driver memory

When checked, passwords and/or processed keyfile contents for up to last four successfully mounted TrueCrypt volumes are cached. This allows mounting volumes without having to type their passwords (and selecting keyfiles) repeatedly. TrueCrypt never saves any password to a disk (however, see the chapter Security Requirements and Precautions). Password caching can be enabled/disabled in the Preferences (Settings > Preferences) and in the password prompt window. If the system partition/drive is encrypted, caching of the pre-boot authentication password can be enabled or disabled in the system encryption settings (Settings > 'System Encryption').

Open Explorer window for successfully mounted volume

If this option is checked, then after a TrueCrypt volume has been successfully mounted, an Explorer window showing the root directory of the volume (e.g., T:\) will be automatically opened.

Use a different taskbar icon when there are mounted volumes

If enabled, the appearance of the TrueCrypt taskbar icon (shown within the system tray notification area) is different while a TrueCrypt volume is mounted, except the following:

  • Partitions/drives within the key scope of active system encryption (e.g., a system partition encrypted by TrueCrypt, or a non-system partition located on a system drive encrypted by TrueCrypt, mounted when the encrypted operating system is running).

  • TrueCrypt volumes that are not fully accessible to the user account (e.g. a volume mounted from within another user account).

  • TrueCrypt volumes that are not displayed in the TrueCrypt application window. For example, system favorite volumes are not displayed within the GUI by an instance of TrueCrypt without administrator privileges when the option 'Allow only administrators to view and dismount system favorite volumes in TrueCrypt' is enabled.

TrueCrypt Background Task – Enabled

See the chapter TrueCrypt Background Task.

TrueCrypt Background Task – Exit when there are no mounted volumes

If this option is checked, the TrueCrypt background task automatically and silently exits as soon as there are no mounted TrueCrypt volumes. For more information, see the chapter TrueCrypt Background Task. Note that this option cannot be disabled when TrueCrypt runs in portable mode.

Auto-dismount volume after no data has been read/written to it for

After no data has been written/read to/from a TrueCrypt volume for n minutes, the volume is automatically dismounted.

Force auto-dismount even if volume contains open files or directories

This option applies only to auto-dismount (not to regular dismount). It forces dismount (without prompting) on the volume being auto-dismounted in case it contains open files or directories (i.e., file/directories that are in use by the system or applications).




 Ads by Google 




  Next Section >>


Legal Notices www.truecrypt.org

 Ads by Google