Encryption, done properly, is the answer.
I know how you feel. I also have sensitive information on my laptop.
I can handle losing the laptop, but thinking about the data in the wrong hands… well… that would be bad.
I’ve used different solutions over the years, and they all share one thing in common: encryption.
Securing your laptop
Encrypting data stored on your computer is important and can be done in several ways: manual individual file encryption, such as Zip; whole-disk encryption, such as BitLocker; encrypted vaults, managed by tools like VeraCrypt; or automatic individual file encryption using Cryptomator. Regardless of the tool, make sure you understand whether any unencrypted data is left, take care to never lose your encryption passphrase or recovery key, and of course, back up.
Encryption: a quick definition
Encryption is nothing more than scrambling data using a complicated mathematical formula and what’s known as an encryption key. Passwords are a good example of an encryption key.
For example, if we take the text phrase:
If it’s only in one place, it’s not backed up.
and encrypt it using a popular encryption algorithm1 with the password “yourpassword”, you might get a block of data that looks like this:
6153 746c 6465 5f5f c7a4 235c 8ae2 7006
abda 6b02 3f39 8d34 abbe 527e 1147 ffce
1cca 8e05 c62a f1bb 7e6a e2f0 afa6 02ec
ed26 9649 8526 8cd3 af06 f1cc 21ac 3cc6
Without that password (i.e., the encryption key), that looks like nothing more than purely random data, and there’s no way for you to reverse the encryption. This means the original data cannot be recovered. With the encryption key, of course, the original data can be restored via decryption.
Now let’s look at different encryption methods and which is best for what.
Help keep it going by becoming a Patron.
Encrypting individual files
Encrypting individual files or collections of files involves using archiving tools that allow you to scramble the file’s data using an encryption key.
A common approach is to use “zip” files and tools like 7-Zip. Zip files support password protection, encrypting the file’s contents.2 Originally, zip encryption was easily cracked, but it’s since improved to be quite good.
The problem with individual file encryption is that you must manually decrypt the file to use it. This also means you need to re-encrypt it when you’re done, and erase all traces of the work you did — such as temporary files — that might be left unencrypted.
Individual file encryption is appropriate for some things, but for frequent use, it’s too cumbersome.
Encryption of individual files offered by specific applications (such as password protection in Microsoft Office documents) can be good. Unfortunately, it can also be bad. Older versions of Office, for example, were quite poor at encryption. Current versions are better. If you go this route, you’re at the mercy of the individual application vendors’ expertise. I prefer dedicated encryption tools.
Related
How Do I Know If My Hard Disk Is BitLocker-Encrypted?
Even running Windows Home edition, your hard drive might be BitLocker-encrypted without you realizing it. If you don’t have the recovery key, you could lose everything. Learn how to check, why it matters, and the simple steps to protect yourself before it’s too late.#179885
Encrypting the entire hard drive
Whole-drive (or whole-disk) encryption is the other extreme. It protects the contents of your entire system rather than just one file.
System-provided solutions, like BitLocker in Windows Pro editions and Device Encryption in Windows 11 Home, use encryption keys based on your system login to encrypt the hard drive. If you can’t log in, you can’t access your data. It also protects your data should your hard disk be removed and attached to another computer.
If you lose your login account for any reason, you can lose access to your data permanently. BitLocker encourages you to back up the encryption key separately when you first encrypt your drive. If you use BitLocker, I strongly recommend you do so.
Third-party tools like VeraCrypt also support whole-drive encryption. This is independent of your system login and uses a secure passphrase to decrypt the drive and boot your system.
Important: With whole-drive encryption, your data is only secure if you log out or shut down. As long as you are logged in and able to access your data yourself, it’s available in unencrypted form. Avoid states like Sleep or Hibernate, neither of which is an actual logout.
I now use whole-drive encryption on my laptop, making sure to log out and shut down completely when appropriate.
Encrypted vaults
VeraCrypt is free, open-source, on-the-fly encryption software. It provides industrial-strength encryption while still being fairly easy to use.
The two most common ways it’s used are:
- To encrypt an entire disk volume, such as a USB thumb drive, single partition, or entire hard disk, as described above.
- To create an encrypted virtual disk “volume” or container.
It’s the latter approach I use, as it makes it easy to copy entire containers from machine to machine.
An encrypted virtual disk is a file that VeraCrypt “mounts” as an additional drive letter on your computer. You specify the passphrase when it’s mounted, and the unencrypted contents of the container appear as another drive.
For example, you might create an encrypted volume in a file c:\windowssecritstuf. If someone looked at its contents, they would see only random data — the result of encryption. When mounted by VeraCrypt, it appears as another drive, perhaps “P:”. Drive P: looks and operates like any other disk and contains the unencrypted contents of the encrypted drive. Encryption is as simple as moving or copying a file to the drive.
The trick for security is to never mount the drive automatically. When your computer boots up, “P:”, for example, would be nowhere to be found. The file c:\windowssecritstuf would be present, but only visible as encrypted gibberish. If someone stole your machine, that’s all they would find.
When you later use VeraCrypt to select the file (c:\windowssecritstuf) and choose to mount it as (P:), you would be prompted for a passphrase. Only then does the virtual drive mount and the data become accessible.
Related
Cryptomator vs VeraCrypt: Which Do You Want?
Cryptomator and VeraCrypt are both excellent encryption tools. We'll look at how to choose the right one for your situation.#178308
Encryption for the cloud
Yet another solution to laptop security uses a tool meant to keep your data secure in the cloud: Cryptomator.
You can think of Cryptomator as a kind of hybrid combination of VeraCrypt’s vault with individual file encryption. (Cryptomator: Encryption for Your Cloud Storage has a more detailed comparison.)
Instead of a file, you point Cryptomator at a folder — generally a folder in an online cloud storage service, like OneDrive — and it mounts that folder as a virtual drive. The data in the OneDrive folder is encrypted, and the virtual drive gives transparent access to the encrypted data, much like a VeraCrypt volume. Unlike VeraCrypt, the files are encrypted individually. When a file changes, only that file needs to be updated with the cloud provider. Only the encrypted files are uploaded to the cloud.
While Cryptomator is designed specifically to keep your cloud data secure, there’s nothing that says you can’t use it for other purposes. You can point it at any folder on your computer and have Cryptomator manage encrypting the contents.
If you’re already using Cryptomator for your cloud data, you wouldn’t have to install any other software to encrypt local data.
Encryption and security caveats
Most of these approaches are relatively straightforward. The trade-off is complexity in setup versus complexity to use.
But there are additional items to keep in mind whenever you secure your system in this way.
- Passphrases are the weakest link. Encryption does not make a bad passphrase any more secure. If you choose an obvious passphrase, a dictionary attack can certainly be used to unlock your encrypted volume or decrypt your encrypted file.
- Encrypted volumes and encrypted files do you no good if the files you care about are elsewhere on your computer in unencrypted form. This is one of the benefits of whole-drive encryption: it’s all encrypted, no matter what.
- You must back up. I recommend keeping the backups unencrypted but secure in some other way, in case you lose your computer, encrypted disk, or files, or forget your password. Without the password, encrypted data is not recoverable.
Do this
Encryption is an important part of your security strategy. Keeping sensitive data secure requires forethought and planning. With viruses and spyware running amok, not to mention theft, there’s no excuse not to take time now to save grief later, should the unthinkable happen.
Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.
Footnotes & References
1: The command used was:
echo “If it’s in only one place, it’s not backed up.” | openssl enc -aes-256-cbc -pbkdf2 -pass pass:yourpassword > encrypted.bin
2: The data is encrypted, but the file names remain visible. To hide those, zip the zip file with a password. In this case, the “inside” zip file need not have a password.
Both of my laptops are set up to require a BIOS password before booting into Windows. Make sure you don’t forget the password if you decide to do so. I’ve seen techs break out in a sweat when I mention I use one, thinking I’ve forgotten it. My understanding is that the only way around it is to replace the motherboard. Both machines have Windows 10 Pro and I use Bitlocker to encrypt the hard drives.
I back up using Macrium Reflect, which can be used to restore the image, even when encrypted. The drives that I back up to are unencrypted and the image files are still accessible. When restoring an image backup, if the Macrium rescue drive is properly set up, Macrium will remove Bitlocker encryption during the restoration. This requires going back to Bitlocker and encrypting the drive again after the image is restored. Just went through this after replacing a drive in one of my laptops with a larger drive.
When traveling, I just shutdown the laptop when I’m not actively using it. I also make sure I don’t leave it unsecured even then. I don’t leave it in a hotel room and take it with me.
If you use Bitlocker, the BIOS or UEFI password is overkill. I don’t see how you can forget a BIOS password you type every day.
A BIOS password would be another way to prevent the machine from being rebooted from something else. And, yes, I have heard of people forgetting it. (I think it’s mostly always-on machines so they’re not typing it every day.)
I believe whole disk encryption is better than a BIOS password. It’s easy to remove a hard drive and access it with another computer. If it’s encrypted, it’s uncrackable. Do you see any way a BIOS password would add to that? It seems like putting an uncrackable safe in a tool shed with a padlock.
The reason I use a BIOS password is that the laptop has a TPM module that Bitlocker stores the encryption key on. Booting the laptop automatically unlocks the drive. Which I understand would allow someone to access the data on the hard drives, if they know how to bypass the Windows password.
I use Bitlocker to negate the possibility of someone removing the hard drives to use on another machine.
If someone snatches the laptop and tries to resell it, they just stole a paperweight. If they were interested in the data, they are still blocked. I figure the more obstacles I can raise, the better.
Depends on how the machine is set up. I agree it’s probably redundant, but the BIOS password does protect against certain things that just encrypting the hard drive does not.
The only thing I can think of that the BIOS password would protect against is the person who has that computer won’t be able to install an new operating system on it. So you may want to brick it if it’s stolen.
My laptops have TPM chips, I don’t have to type in a password to access Bitlocker drives.
My concern with using VeraCrypt for whole-partition encryption has to do with file corruption. I currently have more than 130,000 files on my data (D:) drive. If one file gets corrupted I lose that file. But with whole-partition encryption, if the VeraCrypt container file becomes corrupted I would lose access to that entire volume. This would also be the case for files stores on my D: drive in a VeraCrypt (non whole-partition) container.
a) I believe that’s not the case. I believe (and you could check with them) that VeraCrypt encrypts at the sector level — meaning a single sector corruption would potentially only impact one file within the container.
b) if there’s any chance of data loss, you’re not backed up. And regardless of whether you use veracrypt or not there’s ALWAYS something that can fail without warning.