by Gina Trapani
Everyone's got files they'd like to keep out the the hands of intruders or casual passerby. Ever concerned you'll lose the thumb drive where you backed up four years of post-graduate research? Every worried your 5-year-old will accidentally open the um, grownup files just meant for Mommy and Daddy? Worry no more. Today we'll go over a simple way to encrypt sensitive files or entire external disk drives to protect them from prying eyes.
Recently-featured TrueCrypt is a free, open source encryption application that works on Windows and Linux. Given the right credentials, TrueCrypt will create a virtual hard drive that will read and write encrypted files on the fly. Huh-wha? Fear not; this'll make sense once we get it set up. Let's get started.
Set up the encrypted volume location
- Download TrueCrypt, install and launch.
- Hit the "Create Volume" button to launch the wizard that prepares the encrypted drive location. Choose "Create a Standard TrueCrypt Volume" and hit Next. Hit the "Select File" button and navigate to a location to store your encrypted files and type a name for it. I'm going with "C:\Documents and Settings\gina\My Documents\gtrapani.4meonly" as shown. (Click to enlarge.)
(That .4meonly extension is my own creation; your file can have any - or no - extension.) Keep in mind that this isn't the file you want to encrypt; it's a big file container that will store the files you want encrypted all scrambled up like eggs inside it. Hit Next.
- Choose your encryption algorithm. The curious can flip through the dropdown and view info on each option, but you pretty much can't go wrong here; the default AES selection will work for most purposes. (Hey, if it works for Top Secret government files, it probably will work for you.) Hit Next. Choose the size of the virtual drive - for example, 100MB, as shown. (Click to enlarge.)
Yes, it's a pain to have to commit to a size beforehand, but the advantage here is that the file will always look like it's exactly 100MB, giving no hint to the actual size of its contents. Hit Next.
- Choose your volume password. TrueCrypt wants something totally badass, like 20 characters with letters and numbers mixed together, something hard to crack. The whole point here is to keep snoopers at bay, so make your password reasonably difficult to crack or guess.
- Format the "volume." This part is cool: TrueCrypt gathers random information from your system - including the location of your mouse pointer - to format the file drive location with random data to make it impossible to read. Hit the Format button to go ahead with this operation, which may slow down your computer for a few seconds. (And don't be scared by the word "Format"; you're not erasing your hard drives or anything, you're just formatting the drive location file - in this example, the gtrapani.4meonly file - you just created.)
Congrats! Your encrypted volume location is ready for use.
Store and retrieve files from the encrypted volume
Now you've got a TrueCrypt file that can hold all your highly-sensitive data files locked up tight as a drum. Here's how to get to it.
- From TrueCrypt, choose "Select File" and navigate to the volume file you created above, as shown. (Click to enlarge.)
- Select an available drive letter from the list in TrueCrypt, like Z:. Hit the "Mount" button, and enter the volume password you created above.
- If you enter the correct password, the virtual drive Z: will be mounted. Go to My Computer and listed alongside all the other drives on your computer, there will be a new one listed "Local Disk Z:." Drag and drop all your sensitive data to this drive and work from it as if you would any other disk.
- Once you're finished working with the data, in TrueCrypt, select the mounted drive (like Z:) and hit the "Dismount" button. The Z: drive will no longer be available, and all you'll have left is the gtrapani.4meonly file you created, which can be dropped onto a thumb drive, emailed to yourself, burned to CD or placed on your iPod, totally encrypted.
Note: Using TrueCrypt you can secure an entire drive - like a USB thumb drive. To do so, instead of hitting "Select File," use "Select Device" and choose your thumb drive.
Alternate Method: OpenSSL
The downside to TrueCrypt is that
it has to be installed everywhere you want to access the passworded files, and it's not compatible with Mac OS X. (Note: Reader pmhesse says you can carry around the TrueCrypt files on a thumb drive and use it from there instead of installing the whole app on every computer you need it.)
For those of you comfortable on the command line, there's an alternative way to password a file using the free utility OpenSSL. Say you want to password protect a tar archive of documents called unencrypted-data.tar.
From the command line, type:
$ openssl des3 -salt -in unencrypted-data.tar -out encrypted-data.tar.des3 enter des-ede3-cbc encryption password: Verifying - enter des-ede3-cbc encryption password: $
That command will encrypt the unencrypted-data.tar file with the password you choose and output the result to encrypted-data.tar.des3. To unlock the encrypted file, use the following command:
$ openssl des3 -d -salt -in encrypted-data.tar.des3 -out unencrypted-data.tar enter des-ede3-cbc encryption password: $
This method works with Cygwin on Windows, OS X and Linux.
How do you keep your sensitive files from getting into the wrong hands? Let us know in the comments or to tips at lifehacker.com.
Gina Trapani, the editor of Lifehacker, is currently encrypting all the terrible poetry and humiliating love stories she's ever written. Her semi-weekly feature, Geek to Live, appears every Wednesday and Friday on Lifehacker. Subscribe to the Geek to Live feed to get new installments in your newsreader.