diff --git a/doc/chm/VeraCrypt User Guide.chm b/doc/chm/VeraCrypt User Guide.chm index 757bcb20..05304065 100644 Binary files a/doc/chm/VeraCrypt User Guide.chm and b/doc/chm/VeraCrypt User Guide.chm differ diff --git a/doc/chm/en/VeraCrypt.hhc b/doc/chm/en/VeraCrypt.hhc index bf6f0bfc..0364eab3 100644 --- a/doc/chm/en/VeraCrypt.hhc +++ b/doc/chm/en/VeraCrypt.hhc @@ -229,6 +229,16 @@ +
  • diff --git a/doc/chm/en/VeraCrypt.hhp b/doc/chm/en/VeraCrypt.hhp index 3df7306d..7f3a444f 100644 --- a/doc/chm/en/VeraCrypt.hhp +++ b/doc/chm/en/VeraCrypt.hhp @@ -52,6 +52,8 @@ Cascades.html Changing Passwords and Keyfiles.html Choosing Passwords and Keyfiles.html Command Line Usage.html +Command Line Usage for Windows.html +Command Line Usage for Unix.html CompilingGuidelineLinux.html CompilingGuidelines.html CompilingGuidelineWin.html @@ -180,4 +182,3 @@ Wear-Leveling.html Whirlpool.html [INFOTYPES] - diff --git a/doc/html/en/Command Line Usage for Unix.html b/doc/html/en/Command Line Usage for Unix.html new file mode 100644 index 00000000..aa2b0ec8 --- /dev/null +++ b/doc/html/en/Command Line Usage for Unix.html @@ -0,0 +1,337 @@ + + + + +VeraCrypt - Free Open source disk encryption with strong security for the Paranoid + + + + + + +
    +VeraCrypt +
    + + + +
    +

    +Documentation +>> +Command Line Usage +>> +Linux and macOS +

    + +
    +
    +

    Command Line Usage for Linux and macOS

    +

    This section applies to VeraCrypt on Unix-like systems, including Linux and macOS. The Windows command-line syntax is documented separately in Command Line Usage for Windows.

    +

    To display the command-line help for the installed VeraCrypt build in a terminal, run:

    +

    veracrypt -t --help

    +

    The -t or --text option selects the text user interface and must be specified as the first argument. Without -t, veracrypt --help may show the graphical help window when the graphical user interface is available.

    + +

    Syntax

    +

    veracrypt [OPTIONS] COMMAND

    +

    veracrypt [OPTIONS] VOLUME_PATH [MOUNT_DIRECTORY]

    +

    If no explicit command is specified and a volume path is given, VeraCrypt mounts the volume. When MOUNT_DIRECTORY is omitted, VeraCrypt uses the default mount directory.

    + +

    Commands

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    --auto-mount=devices|favoritesAuto-mount device-hosted volumes, favorite volumes, or both when the values are combined with a comma.
    --backup-headers [VOLUME_PATH]Back up volume headers to a file. Required values not specified on the command line are requested from the user.
    -c or --create [VOLUME_PATH]Create a new volume. Most values are requested from the user if not specified on the command line. See also --encryption, --filesystem, --hash, --keyfiles, --password, --pim, --random-source, --quick, --size, and --volume-type.
    --create-keyfile [FILE_PATH]Create a new keyfile containing pseudo-random data.
    -C or --change [VOLUME_PATH]Change a volume password, PIM, keyfiles, and/or header key derivation algorithm. See also --hash, --new-hash, --new-keyfiles, --new-password, --new-pim, --password, --pim, and --random-source.
    -u or --unmount [MOUNTED_VOLUME]
    -d or --dismount [MOUNTED_VOLUME]    		Unmount a mounted volume. If no mounted volume is specified, all mounted VeraCrypt volumes are unmounted. --dismount is deprecated; use --unmount.
    --delete-token-keyfilesDelete keyfiles from security tokens.
    --export-token-keyfileExport a keyfile from a security token.
    --import-token-keyfilesImport keyfiles to a security token. See also --token-lib.
    -l or --list [MOUNTED_VOLUME]Display mounted volumes. By default, only the volume path, virtual device, and mount point are shown. Use --verbose for more details.
    --list-token-keyfilesDisplay all available token keyfiles.
    --list-securitytoken-keyfilesDisplay all available security token keyfiles.
    --list-emvtoken-keyfilesDisplay all available EMV token keyfiles.
    --mount [VOLUME_PATH]Mount a volume interactively. The volume path and missing options are requested from the user.
    --restore-headers [VOLUME_PATH]Restore volume headers from the embedded backup header or from an external backup file.
    --save-preferencesSave user preferences.
    --testTest internal algorithms used in the process of encryption and decryption.
    --versionDisplay VeraCrypt version information.
    --volume-properties [MOUNTED_VOLUME]Display properties of a mounted volume.
    + +

    MOUNTED_VOLUME

    +

    A mounted volume can be specified in any of the following forms:

    +
      +
    • Path to the encrypted VeraCrypt volume.
      • +
    • Mount directory of the volume's filesystem, if mounted.
      • +
    • Slot number of the mounted volume, when used with --slot.
      • +
    + +

    Options

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    --allow-insecure-mountAllow mounting volumes on mount points that are in the user's PATH.
    --allow-screencaptureAllow VeraCrypt windows to be included in screenshots and screen recordings. This option applies to macOS builds.
    --background-taskStart the VeraCrypt background task.
    --display-passwordDisplay password characters while typing.
    --encryption=ENCRYPTION_ALGORITHMUse the specified encryption algorithm when creating a new volume. For cascades, use the algorithm name shown by VeraCrypt, for example AES-Twofish.
    --exploreOpen a file manager window after the volume is mounted.
    --filesystem=TYPEFilesystem type to mount or create. For mounting, the type is passed to the system mount command. none disables filesystem mounting or creation. Supported creation types depend on the platform: Linux supports FAT, Ext2, Ext3, Ext4, NTFS, exFAT, and Btrfs; macOS supports FAT, HFS/HFS+/MacOsExt, exFAT, and APFS; FreeBSD and Solaris builds support FAT and UFS. Non-FAT creation requires the corresponding system formatter to be available.
    -f or --forceForce mounting of a volume in use, unmounting of a volume in use, or overwriting a file. The exact effect depends on the operating system.
    --fs-options=OPTIONSFilesystem mount options passed to the system mount command with -o. This option is available on Linux and other Unix-like builds where supported, but not on macOS.
    --hash=HASHUse the specified header key derivation algorithm when mounting, creating a volume, or changing password/keyfiles. This option also specifies the mixing hash of the random number generator when applicable.
    -h or --helpDisplay detailed command-line help.
    -k KEYFILE1[,KEYFILE2,...] or --keyfiles=KEYFILE1[,KEYFILE2,...]Use the specified keyfiles. When a directory is specified, all files inside it are used non-recursively. Use a double comma (,,) for a comma contained in a keyfile name. A keyfile stored on a security token can be specified as token://slot/SLOT_NUMBER/file/FILENAME; an EMV token keyfile can be specified as emv://slot/SLOT_NUMBER. Use -k "" to disable interactive keyfile prompts.
    --legacy-password-maxlengthUse the legacy maximum password length of 64 UTF-8 bytes.
    --load-preferencesLoad user preferences before processing command-line options, allowing command-line options to override preferences.
    -m OPTION1[,OPTION2,...] or --mount-options=OPTION1[,OPTION2,...]Set VeraCrypt volume mount options. Supported options are headerbak, nokernelcrypto, readonly or ro, system, and timestamp or ts.
    --new-hash=HASHSet the new header key derivation algorithm when changing a volume password or keyfiles. This option is used with --change.
    --new-keyfiles=KEYFILE1[,KEYFILE2,...]Set the new keyfiles when changing a volume password or keyfiles. This option is used with --change.
    --new-password=PASSWORDSet the new password when changing a volume password or keyfiles. This option is used with --change.
    --new-pim=PIMSet the new PIM when changing a volume password or keyfiles. This option is used with --change.
    --no-size-checkDisable the check that verifies the requested container size against available free disk space.
    --non-interactiveDo not interact with the user. This option is supported only in text mode.
    -p PASSWORD or --password=PASSWORDUse the specified password to mount or open a volume. An empty password can be specified with -p "".
    --pim=PIMUse the specified PIM to mount or open a volume.
    --protect-hidden=yes|noWrite-protect a hidden volume when mounting an outer volume. If enabled, VeraCrypt uses the hidden volume credentials to determine the hidden area and protects it against writes.
    --protection-hash=HASHUse the specified header key derivation algorithm for the hidden volume protected by --protect-hidden=yes.
    --protection-keyfiles=KEYFILE1[,KEYFILE2,...]Use the specified keyfiles for the hidden volume protected by --protect-hidden=yes.
    --protection-password=PASSWORDUse the specified password for the hidden volume protected by --protect-hidden=yes.
    --protection-pim=PIMUse the specified PIM for the hidden volume protected by --protect-hidden=yes.
    --quickEnable quick formatting when creating a volume. This option must not be used when creating an outer volume.
    --random-source=FILEUse the specified file as a source of random data, for example when creating a volume.
    --slot=SLOTUse the specified slot number when mounting, unmounting, listing, or displaying properties of a volume.
    --size=SIZE[K|KiB|M|MiB|G|GiB|T|TiB] or --size=maxUse the specified size when creating a new volume. If no suffix is specified, the value is interpreted in bytes. max uses all available free space.
    --stdinRead the password from standard input. This option can be used only with --non-interactive and cannot be combined with --password.
    -t or --textUse the text user interface. This option must be specified as the first argument.
    --token-lib=LIB_PATHUse the specified PKCS #11 security token library.
    --token-pin=PINUse the specified security token PIN.
    --use-dummy-sudo-passwordUse a dummy password in sudo to detect whether sudo is already authenticated. This option is available on Linux and FreeBSD builds.
    -v or --verboseEnable verbose output.
    --volume-type=normal|hiddenUse the specified volume type when creating a new volume.
    + +

    Security Notes

    +

    Passing a password, PIM, token PIN, or hidden-volume protection password on the command line can be insecure because command-line arguments may be visible in process listings, shell history, or system logs. When possible, let VeraCrypt prompt for sensitive values interactively, or use --stdin with --non-interactive where appropriate. Users must also follow the security requirements and precautions listed in Security Requirements and Precautions.

    + +

    Examples

    +

    Create a new volume using the text user interface:

    +

    veracrypt -t -c

    +

    Mount a volume:

    +

    veracrypt volume.hc /media/veracrypt1

    +

    Mount a volume read-only, using keyfiles:

    +

    veracrypt -m ro -k keyfile1,keyfile2 volume.hc /media/veracrypt1

    +

    Mount a volume without mounting its filesystem:

    +

    veracrypt --filesystem=none volume.hc

    +

    Mount a volume prompting only for its password:

    +

    veracrypt -t -k "" --pim=0 --protect-hidden=no volume.hc /media/veracrypt1

    +

    Mount a volume non-interactively and read the password from standard input:

    +

    printf '%s\n' "$VERACRYPT_PASSWORD" | veracrypt -t --non-interactive --stdin --pim=0 --protect-hidden=no volume.hc /media/veracrypt1

    +

    List mounted volumes with detailed information:

    +

    veracrypt -t -v --list

    +

    Unmount a volume:

    +

    veracrypt -u volume.hc

    +

    Unmount all mounted VeraCrypt volumes:

    +

    veracrypt -u

    + +

    Hidden Volume Creation in Text Mode

    +

    Inexperienced users should use the graphical user interface to create a hidden volume. When using the text user interface, the following procedure must be followed:

    +
      +
    1. Create an outer volume with no filesystem.
      2. +
    2. Create a hidden volume within the outer volume.
      3. +
    3. Mount the outer volume using hidden volume protection.
      4. +
    4. Create a filesystem on the virtual device of the outer volume.
      5. +
    5. Mount the new filesystem and fill it with data.
      6. +
    6. Unmount the outer volume.
      7. +
    +

    If hidden volume protection is triggered at any step, start again from the first step.

    + +
    +
    diff --git a/doc/html/en/Command Line Usage for Windows.html b/doc/html/en/Command Line Usage for Windows.html new file mode 100644 index 00000000..b490ec8e --- /dev/null +++ b/doc/html/en/Command Line Usage for Windows.html @@ -0,0 +1,339 @@ + + + + +VeraCrypt - Free Open source disk encryption with strong security for the Paranoid + + + + + + +
    +VeraCrypt +
    + + + +
    +

    +Documentation +>> +Command Line Usage +>> +Windows +

    + +
    +
    +

    Command Line Usage for Windows

    +

    This section applies to the Windows version of VeraCrypt. The Unix-style command-line syntax used on Linux and macOS is documented separately in Command Line Usage for Linux and macOS.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    /help or /?Display command line help.
    /truecrypt or /tcActivate TrueCrypt compatibility mode which enables mounting volumes created with TrueCrypt 6.x and 7.x series.
    /hashIt must be followed by a parameter indicating the PRF hash algorithm to use when mounting the volume. Possible values for /hash parameter are: sha256, sha-256, sha512, sha-512, whirlpool, blake2s and blake2s-256. When /hash is omitted, VeraCrypt will try + all possible PRF algorithms thus lengthening the mount operation time.
    /volume or /v +

    It must be followed by a parameter indicating the file and path name of a VeraCrypt volume to mount (do not use when unmounting) or the Volume ID of the disk/partition to mount.
    +The syntax of the volume ID is ID:XXXXXX...XX where the XX part is a 64 hexadecimal characters string that represent the 32-Bytes ID of the desired volume to mount.
    +
    +To mount a partition/device-hosted volume, use, for example, /v \Device\Harddisk1\Partition3 (to determine the path to a partition/device, run VeraCrypt and click +Select Device). You can also mount a partition or dynamic volume using its volume name (for example, /v \\?\Volume{5cceb196-48bf-46ab-ad00-70965512253a}\). To determine the volume name use e.g. mountvol.exe. Also note that device paths are case-sensitive.
    +
    +You can also specify the Volume ID of the partition/device-hosted volume to mount, for example: /v ID:53B9A8D59CC84264004DA8728FC8F3E2EE6C130145ABD3835695C29FD601EDCA. The Volume ID value can be retrieved using the volume properties dialog.

    +
    /letter or /lIt must be followed by a parameter indicating the driver letter to mount the volume as. When /l is omitted and when /a is used, the first free drive letter is used.
    /explore or /eOpen an Explorer window after a volume has been mounted.
    /beep or /bBeep after a volume has been successfully mounted or unmounted.
    /auto or /aIf no parameter is specified, automatically mount the volume. If devices is specified as the parameter (e.g., /a devices), auto-mount all currently accessible device/partition-hosted VeraCrypt volumes. If favorites is specified as the parameter, auto-mount + favorite volumes. Note that /auto is implicit if /quit and /volume are specified. If you need to prevent the application window from appearing, use /quit.
    /unmount or /uUnmount volume specified by drive letter (e.g., /u x). When no drive letter is specified, unmounts all currently mounted VeraCrypt volumes.
    /dismount or /dDeprecated. Please use /unmount or /u.
    /force or /fForces unmount (if the volume to be unmounted contains files being used by the system or an application) and forces mounting in shared mode (i.e., without exclusive access).
    /keyfile or /kIt must be followed by a parameter specifying a keyfile or a keyfile search path. For multiple keyfiles, specify e.g.: /k c:\keyfile1.dat /k d:\KeyfileFolder /k c:\kf2 To specify a keyfile stored on a security token or smart card, use the following syntax: + token://slot/SLOT_NUMBER/file/FILE_NAME
    /tryemptypass   ONLY when default keyfile configured or when a keyfile is specified in the command line.
    +If it is followed by y or yes or if no parameter is specified: try to mount using an empty password and the keyfile before displaying password prompt.
    +if it is followed by n or no: don't try to mount using an empty password and the keyfile, and display password prompt right away.
    /nowaitdlgIf it is followed by y or yes or if no parameter is specified: don’t display the waiting dialog while performing operations like mounting volumes.
    +If it is followed by n or no: force the display waiting dialog is displayed while performing operations.
    /secureDesktopIf it is followed by y or yes or if no parameter is specified: display password dialog and token PIN dialog in a dedicated secure desktop to protect against certain types of attacks.
    +If it is followed by n or no: the password dialog and token PIN dialog are displayed in the normal desktop.
    /tokenlibIt must be followed by a parameter indicating the PKCS #11 library to use for security tokens and smart cards. (e.g.: /tokenlib c:\pkcs11lib.dll)
    /tokenpinIt must be followed by a parameter indicating the PIN to use in order to authenticate to the security token or smart card (e.g.: /tokenpin 0000). Warning: This method of entering a smart card PIN may be insecure, for example, when an unencrypted command + prompt history log is being saved to unencrypted disk.
    /cache or /cIf it is followed by y or yes or if no parameter is specified: enable password cache; +
    +If it is followed by p or pim: enable both password and PIM cache (e.g., /c p).
    +If it is followed by n or no: disable password cache (e.g., /c n).
    +If it is followed by f or favorites: temporary cache password when mounting multiple favorites  (e.g., /c f).
    +Note that turning the password cache off will not clear it (use /w to clear the password cache).
    /history or /hIf it is followed by y or no parameter: enables saving history of mounted volumes; if it is followed by +n: disables saving history of mounted volumes (e.g., /h n).
    /wipecache or /wWipes any passwords cached in the driver memory.
    /password or /pIt must be followed by a parameter indicating the volume password. If the password contains spaces, it must be enclosed in quotation marks (e.g., /p ”My Password”). Use /p ”” to specify an empty password. +Warning: This method of entering a volume password may be insecure, for example, when an unencrypted command prompt history log is being saved to unencrypted disk.
    /pimIt must be followed by a positive integer indicating the PIM (Personal Iterations Multiplier) to use for the volume.
    /quit or /qAutomatically perform requested actions and exit (main VeraCrypt window will not be displayed). If preferences is specified as the parameter (e.g., /q preferences), then program settings are loaded/saved and they override settings specified on the command + line. /q background launches the VeraCrypt Background Task (tray icon) unless it is disabled in the Preferences.
    /silent or /sIf /q is specified, suppresses interaction with the user (prompts, error messages, warnings, etc.). If /q is not specified, this option has no effect.
    /mountoption or /m +

    It must be followed by a parameter which can have one of the values indicated below.

    +

    ro or readonly: Mount volume as read-only.

    +

    rm or removable: Mount volume as removable medium (see section + +Volume Mounted as Removable Medium).

    +

    ts or timestamp: Do not preserve container modification timestamp.

    +

    sm or system: Without pre-boot authentication, mount a partition that is within the key scope of system encryption (for example, a partition located on the encrypted system drive of another operating system that is not running). + Useful e.g. for backup or repair operations. Note: If you supply a password as a parameter of /p, make sure that the password has been typed using the standard US keyboard layout (in contrast, the GUI ensures this automatically). This is required due to the + fact that the password needs to be typed in the pre-boot environment (before Windows starts) where non-US Windows keyboard layouts are not available.

    +

    bk or headerbak: Mount volume using embedded backup header. Note: All volumes created by VeraCrypt contain an embedded backup header (located at the end of the volume).

    +

    recovery: Do not verify any checksums stored in the volume header. This option should be used only when the volume header is damaged and the volume cannot be mounted even with the mount option headerbak. Example: /m ro

    +

    label=LabelValue: Use the given string value LabelValue as a label of the mounted volume in Windows Explorer. The maximum length for +LabelValue  is 32 characters for NTFS volumes and 11 characters for FAT volumes. For example, +/m label=MyDrive will set the label of the drive in Explorer to MyDrive.

    +

    noattach: Only create virtual device without actually attaching the mounted volume to the selected drive letter.

    +

    Please note that this switch may be present several times in the command line in order to specify multiple mount options (e.g.: /m rm /m ts)

    +
    /DisableDeviceUpdate Disables periodic internel check on devices connected to the system that is used for handling favorites identified with VolumeID and replace it with on-demande checks.
    /protectMemory If it is followed by y or yes or if no parameter is specified: Activates a mechanism that protects VeraCrypt process memory from being accessed by other non-admin processes. +
    +If it is followed by n or no (ONLY allowed for portable mode): disables the memory protection mechanism (e.g., /protectMemory n).
    +
    /protectScreen If it is followed by y or yes or if no parameter is specified: Activates a mechanism that protects VeraCrypt against screenshots and screen recordings. +
    +If it is followed by n or no (ONLY allowed for portable mode): disables the screen protection mechanism (e.g., /protectScreen n).
    +
    /signalExit It must be followed by a parameter specifying the name of the signal to send to unblock a waiting WAITFOR.EXE command when VeraCrypt exists.
    +The name of signal must be the same as the one specified to WAITFOR.EXE command (e.g."veracrypt.exe /q /v test.hc /l Z /signal SigName" followed by "waitfor.exe SigName"
    +This switch is ignored if /q is not specified
    +

    VeraCrypt Format.exe (VeraCrypt Volume Creation Wizard):

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    /createCreate a container based volume in command line mode. It must be followed by the file name of the container to be created.
    /size +

    (Only with /create)
    +It must be followed by a parameter indicating the size of the container file that will be created. This parameter is a number indicating the size in Bytes. It can have a suffixe 'K', 'M', 'G' or 'T' to indicate that the value is in Kilobytes, Megabytes, Gigabytes + or Terabytes respectively. For example:

    +
      +
    • /size 5000000: the container size will be 5000000 bytes
    • /size 25K: the container size will be 25 KiloBytes.
    • /size 100M: the container size will be 100 MegaBytes.
    • /size 2G: the container size will be 2 GigaBytes.
    • /size 1T: the container size will be 1 TeraBytes.
    +
     /password (Only with /create)
    +It must be followed by a parameter indicating the password of the container that will be created.
     /keyfile or /k (Only with /create)
    +It must be followed by a parameter specifying a keyfile or a keyfile search path. For multiple keyfiles, specify e.g.: /k c:\keyfile1.dat /k d:\KeyfileFolder /k c:\kf2 To specify a keyfile stored on a security token or smart card, use the following syntax: + token://slot/SLOT_NUMBER/file/FILE_NAME
    /tokenlib (Only with /create)
    +It must be followed by a parameter indicating the PKCS #11 library to use for security tokens and smart cards. (e.g.: /tokenlib c:\pkcs11lib.dll)
    /tokenpin (Only with /create)
    +It must be followed by a parameter indicating the PIN to use in order to authenticate to the security token or smart card (e.g.: /tokenpin 0000). Warning: This method of entering a smart card PIN may be insecure, for example, when an unencrypted command + prompt history log is being saved to unencrypted disk.
     /hash(Only with /create)
    +It must be followed by a parameter indicating the PRF hash algorithm to use when creating the volume. It has the same syntax as VeraCrypt.exe.
    /encryption(Only with /create)
    +It must be followed by a parameter indicating the encryption algorithm to use. The default is AES if this switch is not specified. The parameter can have the following values (case insensitive): +
      +
    • AES
    • Serpent
    • Twofish
    • Camellia
    • Kuznyechik
    • AES(Twofish)
    • AES(Twofish(Serpent))
    • Serpent(AES)
    • Serpent(Twofish(AES))
    • Twofish(Serpent)
      • +
    • Camellia(Kuznyechik)
      • +
    • Kuznyechik(Twofish)
      • +
    • Camellia(Serpent)
      • +
    • Kuznyechik(AES)
      • +
    • Kuznyechik(Serpent(Camellia))
      • +
    +
    /filesystem(Only with /create)
    +It must be followed by a parameter indicating the file system to use for the volume. The parameter can have the following values: +
      +
    • None: don't use any filesystem
    • FAT: format using FAT/FAT32
    • NTFS: format using NTFS. Please note that in this case a UAC prompt will be displayed unless the process is run with full administrative privileges. +
      • +
    • ExFAT: format using ExFAT. This switch is available starting from Windows Vista SP1
      • +
    • ReFS: format using ReFS. This switch is available starting from Windows 10
      • +
    +
    /dynamic(Only with /create)
    +It has no parameters and it indicates that the volume will be created as a dynamic volume.
    /force(Only with /create)
    +It has no parameters and it indicates that overwrite will be forced without requiring user confirmation.
    /silent(Only with /create)
    +It has no parameters and it indicates that no message box or dialog will be displayed to the user. If there is any error, the operation will fail silently.
    /noisocheck or /nDo not verify that VeraCrypt Rescue Disks are correctly burned. WARNING: Never attempt to use this option to facilitate the reuse of a previously created VeraCrypt Rescue Disk. Note that every time you encrypt a system partition/drive, + you must create a new VeraCrypt Rescue Disk even if you use the same password. A previously created VeraCrypt Rescue Disk cannot be reused as it was created for a different master key.
    /nosizecheckDon't check that the given size of the file container is smaller than the available disk free. This applies to both UI and command line.
    /quickPerform quick formatting of volumes instead of full formatting. This applies to both UI and command line.
    /FastCreateFileEnables a faster, albeit potentially insecure, method for creating file containers. This option carries security risks as it can embed existing disk content into the file container, possibly exposing sensitive data if an attacker gains access to it. Note that this switch affects all file container creation methods, whether initiated from the command line, using the /create switch, or through the UI wizard.
    /protectMemory Activates a mechanism that protects VeraCrypt Format process memory from being accessed by other non-admin processes.
    /secureDesktopIf it is followed by y or yes or if no parameter is specified: display password dialog and token PIN dialog in a dedicated secure desktop to protect against certain types of attacks.
    +If it is followed by n or no: the password dialog and token PIN dialog are displayed in the normal desktop.
    +

    Syntax

    +

    VeraCrypt.exe [/tc] [/hash {sha256|sha-256|sha512|sha-512|whirlpool |blake2s|blake2s-256}][/a [devices|favorites]] [/b] [/c [y|n|f]] [/d [drive letter]] [/e] [/f] [/h [y|n]] [/k keyfile or search path] [tryemptypass [y|n]] [/l drive letter] [/m {bk|rm|recovery|ro|sm|ts|noattach}] + [/p password] [/pim pimvalue] [/q [background|preferences]] [/s] [/tokenlib path] [/v volume] [/w]

    +

    "VeraCrypt Format.exe" [/n] [/create] [/size number[{K|M|G|T}]] [/p password]  [/encryption {AES | Serpent | Twofish | Camellia | Kuznyechik | AES(Twofish) | AES(Twofish(Serpent)) | Serpent(AES) | Serpent(Twofish(AES)) | Twofish(Serpent) | Camellia(Kuznyechik) | Kuznyechik(Twofish) | Camellia(Serpent) | Kuznyechik(AES) | Kuznyechik(Serpent(Camellia)))}] [/hash {sha256|sha-256|sha512|sha-512|whirlpool|blake2s|blake2s-256}] + [/filesystem {None|FAT|NTFS|ExFAT|ReFS}] [/dynamic] [/force] [/silent] [/noisocheck] [FastCreateFile] [/quick]

    +

    Note that the order in which options are specified does not matter.

    +

    Examples

    +

    Mount the volume d:\myvolume as the first free drive letter, using the password prompt (the main program window will not be displayed):

    +

    veracrypt /q /v d:\myvolume

    +

    Unmount a volume mounted as the drive letter X (the main program window will not be displayed):

    +

    veracrypt /q /d x

    +

    Mount a volume called myvolume.tc using the password MyPassword, as the drive letter +X. VeraCrypt will open an explorer window and beep; mounting will be automatic:

    +

    veracrypt /v myvolume.tc /l x /a /p MyPassword /e /b

    +

    Create a 10 MB file container using the password test and formatted using FAT:

    +

    "C:\Program Files\VeraCrypt\VeraCrypt Format.exe" /create c:\Data\test.hc /password test /hash sha512 /encryption serpent /filesystem FAT /size 10M /force

    +
    +
    diff --git a/doc/html/en/Command Line Usage.html b/doc/html/en/Command Line Usage.html index 117921c5..c27c8da2 100644 --- a/doc/html/en/Command Line Usage.html +++ b/doc/html/en/Command Line Usage.html @@ -34,305 +34,12 @@

    Command Line Usage

    -

    Note that this section applies to the Windows version of VeraCrypt. For information on command line usage applying to the -Linux and Mac OS X versions, please run: veracrypt –h

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    /help or /?Display command line help.
    /truecrypt or /tcActivate TrueCrypt compatibility mode which enables mounting volumes created with TrueCrypt 6.x and 7.x series.
    /hashIt must be followed by a parameter indicating the PRF hash algorithm to use when mounting the volume. Possible values for /hash parameter are: sha256, sha-256, sha512, sha-512, whirlpool, blake2s and blake2s-256. When /hash is omitted, VeraCrypt will try - all possible PRF algorithms thus lengthening the mount operation time.
    /volume or /v -

    It must be followed by a parameter indicating the file and path name of a VeraCrypt volume to mount (do not use when unmounting) or the Volume ID of the disk/partition to mount.
    -The syntax of the volume ID is ID:XXXXXX...XX where the XX part is a 64 hexadecimal characters string that represent the 32-Bytes ID of the desired volume to mount.
    -
    -To mount a partition/device-hosted volume, use, for example, /v \Device\Harddisk1\Partition3 (to determine the path to a partition/device, run VeraCrypt and click -Select Device). You can also mount a partition or dynamic volume using its volume name (for example, /v \\?\Volume{5cceb196-48bf-46ab-ad00-70965512253a}\). To determine the volume name use e.g. mountvol.exe. Also note that device paths are case-sensitive.
    -
    -You can also specify the Volume ID of the partition/device-hosted volume to mount, for example: /v ID:53B9A8D59CC84264004DA8728FC8F3E2EE6C130145ABD3835695C29FD601EDCA. The Volume ID value can be retrieved using the volume properties dialog.

    -
    /letter or /lIt must be followed by a parameter indicating the driver letter to mount the volume as. When /l is omitted and when /a is used, the first free drive letter is used.
    /explore or /eOpen an Explorer window after a volume has been mounted.
    /beep or /bBeep after a volume has been successfully mounted or unmounted.
    /auto or /aIf no parameter is specified, automatically mount the volume. If devices is specified as the parameter (e.g., /a devices), auto-mount all currently accessible device/partition-hosted VeraCrypt volumes. If favorites is specified as the parameter, auto-mount - favorite volumes. Note that /auto is implicit if /quit and /volume are specified. If you need to prevent the application window from appearing, use /quit.
    /unmount or /uUnmount volume specified by drive letter (e.g., /u x). When no drive letter is specified, unmounts all currently mounted VeraCrypt volumes.
    /dismount or /dDeprecated. Please use /unmount or /u.
    /force or /fForces unmount (if the volume to be unmounted contains files being used by the system or an application) and forces mounting in shared mode (i.e., without exclusive access).
    /keyfile or /kIt must be followed by a parameter specifying a keyfile or a keyfile search path. For multiple keyfiles, specify e.g.: /k c:\keyfile1.dat /k d:\KeyfileFolder /k c:\kf2 To specify a keyfile stored on a security token or smart card, use the following syntax: - token://slot/SLOT_NUMBER/file/FILE_NAME
    /tryemptypass   ONLY when default keyfile configured or when a keyfile is specified in the command line.
    -If it is followed by y or yes or if no parameter is specified: try to mount using an empty password and the keyfile before displaying password prompt.
    -if it is followed by n or no: don't try to mount using an empty password and the keyfile, and display password prompt right away.
    /nowaitdlgIf it is followed by y or yes or if no parameter is specified: don’t display the waiting dialog while performing operations like mounting volumes.
    -If it is followed by n or no: force the display waiting dialog is displayed while performing operations.
    /secureDesktopIf it is followed by y or yes or if no parameter is specified: display password dialog and token PIN dialog in a dedicated secure desktop to protect against certain types of attacks.
    -If it is followed by n or no: the password dialog and token PIN dialog are displayed in the normal desktop.
    /tokenlibIt must be followed by a parameter indicating the PKCS #11 library to use for security tokens and smart cards. (e.g.: /tokenlib c:\pkcs11lib.dll)
    /tokenpinIt must be followed by a parameter indicating the PIN to use in order to authenticate to the security token or smart card (e.g.: /tokenpin 0000). Warning: This method of entering a smart card PIN may be insecure, for example, when an unencrypted command - prompt history log is being saved to unencrypted disk.
    /cache or /cIf it is followed by y or yes or if no parameter is specified: enable password cache; -
    -If it is followed by p or pim: enable both password and PIM cache (e.g., /c p).
    -If it is followed by n or no: disable password cache (e.g., /c n).
    -If it is followed by f or favorites: temporary cache password when mounting multiple favorites  (e.g., /c f).
    -Note that turning the password cache off will not clear it (use /w to clear the password cache).
    /history or /hIf it is followed by y or no parameter: enables saving history of mounted volumes; if it is followed by -n: disables saving history of mounted volumes (e.g., /h n).
    /wipecache or /wWipes any passwords cached in the driver memory.
    /password or /pIt must be followed by a parameter indicating the volume password. If the password contains spaces, it must be enclosed in quotation marks (e.g., /p ”My Password”). Use /p ”” to specify an empty password. -Warning: This method of entering a volume password may be insecure, for example, when an unencrypted command prompt history log is being saved to unencrypted disk.
    /pimIt must be followed by a positive integer indicating the PIM (Personal Iterations Multiplier) to use for the volume.
    /quit or /qAutomatically perform requested actions and exit (main VeraCrypt window will not be displayed). If preferences is specified as the parameter (e.g., /q preferences), then program settings are loaded/saved and they override settings specified on the command - line. /q background launches the VeraCrypt Background Task (tray icon) unless it is disabled in the Preferences.
    /silent or /sIf /q is specified, suppresses interaction with the user (prompts, error messages, warnings, etc.). If /q is not specified, this option has no effect.
    /mountoption or /m -

    It must be followed by a parameter which can have one of the values indicated below.

    -

    ro or readonly: Mount volume as read-only.

    -

    rm or removable: Mount volume as removable medium (see section - -Volume Mounted as Removable Medium).

    -

    ts or timestamp: Do not preserve container modification timestamp.

    -

    sm or system: Without pre-boot authentication, mount a partition that is within the key scope of system encryption (for example, a partition located on the encrypted system drive of another operating system that is not running). - Useful e.g. for backup or repair operations. Note: If you supply a password as a parameter of /p, make sure that the password has been typed using the standard US keyboard layout (in contrast, the GUI ensures this automatically). This is required due to the - fact that the password needs to be typed in the pre-boot environment (before Windows starts) where non-US Windows keyboard layouts are not available.

    -

    bk or headerbak: Mount volume using embedded backup header. Note: All volumes created by VeraCrypt contain an embedded backup header (located at the end of the volume).

    -

    recovery: Do not verify any checksums stored in the volume header. This option should be used only when the volume header is damaged and the volume cannot be mounted even with the mount option headerbak. Example: /m ro

    -

    label=LabelValue: Use the given string value LabelValue as a label of the mounted volume in Windows Explorer. The maximum length for -LabelValue  is 32 characters for NTFS volumes and 11 characters for FAT volumes. For example, -/m label=MyDrive will set the label of the drive in Explorer to MyDrive.

    -

    noattach: Only create virtual device without actually attaching the mounted volume to the selected drive letter.

    -

    Please note that this switch may be present several times in the command line in order to specify multiple mount options (e.g.: /m rm /m ts)

    -
    /DisableDeviceUpdate Disables periodic internel check on devices connected to the system that is used for handling favorites identified with VolumeID and replace it with on-demande checks.
    /protectMemory If it is followed by y or yes or if no parameter is specified: Activates a mechanism that protects VeraCrypt process memory from being accessed by other non-admin processes. -
    -If it is followed by n or no (ONLY allowed for portable mode): disables the memory protection mechanism (e.g., /protectMemory n).
    -
    /protectScreen If it is followed by y or yes or if no parameter is specified: Activates a mechanism that protects VeraCrypt against screenshots and screen recordings. -
    -If it is followed by n or no (ONLY allowed for portable mode): disables the screen protection mechanism (e.g., /protectScreen n).
    -
    /signalExit It must be followed by a parameter specifying the name of the signal to send to unblock a waiting WAITFOR.EXE command when VeraCrypt exists.
    -The name of signal must be the same as the one specified to WAITFOR.EXE command (e.g."veracrypt.exe /q /v test.hc /l Z /signal SigName" followed by "waitfor.exe SigName"
    -This switch is ignored if /q is not specified
    -

    VeraCrypt Format.exe (VeraCrypt Volume Creation Wizard):

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    /createCreate a container based volume in command line mode. It must be followed by the file name of the container to be created.
    /size -

    (Only with /create)
    -It must be followed by a parameter indicating the size of the container file that will be created. This parameter is a number indicating the size in Bytes. It can have a suffixe 'K', 'M', 'G' or 'T' to indicate that the value is in Kilobytes, Megabytes, Gigabytes - or Terabytes respectively. For example:

    +

    VeraCrypt uses different command-line syntaxes on Windows and on Unix-like systems. Select the page that matches your operating system:

      -
    • /size 5000000: the container size will be 5000000 bytes
    • /size 25K: the container size will be 25 KiloBytes.
    • /size 100M: the container size will be 100 MegaBytes.
    • /size 2G: the container size will be 2 GigaBytes.
    • /size 1T: the container size will be 1 TeraBytes.
    -
     /password (Only with /create)
    -It must be followed by a parameter indicating the password of the container that will be created.
     /keyfile or /k (Only with /create)
    -It must be followed by a parameter specifying a keyfile or a keyfile search path. For multiple keyfiles, specify e.g.: /k c:\keyfile1.dat /k d:\KeyfileFolder /k c:\kf2 To specify a keyfile stored on a security token or smart card, use the following syntax: - token://slot/SLOT_NUMBER/file/FILE_NAME
    /tokenlib (Only with /create)
    -It must be followed by a parameter indicating the PKCS #11 library to use for security tokens and smart cards. (e.g.: /tokenlib c:\pkcs11lib.dll)
    /tokenpin (Only with /create)
    -It must be followed by a parameter indicating the PIN to use in order to authenticate to the security token or smart card (e.g.: /tokenpin 0000). Warning: This method of entering a smart card PIN may be insecure, for example, when an unencrypted command - prompt history log is being saved to unencrypted disk.
     /hash(Only with /create)
    -It must be followed by a parameter indicating the PRF hash algorithm to use when creating the volume. It has the same syntax as VeraCrypt.exe.
    /encryption(Only with /create)
    -It must be followed by a parameter indicating the encryption algorithm to use. The default is AES if this switch is not specified. The parameter can have the following values (case insensitive): - -
    /filesystem(Only with /create)
    -It must be followed by a parameter indicating the file system to use for the volume. The parameter can have the following values: -
      -
    • None: don't use any filesystem
    • FAT: format using FAT/FAT32
    • NTFS: format using NTFS. Please note that in this case a UAC prompt will be displayed unless the process is run with full administrative privileges. -
      • -
    • ExFAT: format using ExFAT. This switch is available starting from Windows Vista SP1
      • -
    • ReFS: format using ReFS. This switch is available starting from Windows 10
      • -
    -
    /dynamic(Only with /create)
    -It has no parameters and it indicates that the volume will be created as a dynamic volume.
    /force(Only with /create)
    -It has no parameters and it indicates that overwrite will be forced without requiring user confirmation.
    /silent(Only with /create)
    -It has no parameters and it indicates that no message box or dialog will be displayed to the user. If there is any error, the operation will fail silently.
    /noisocheck or /nDo not verify that VeraCrypt Rescue Disks are correctly burned. WARNING: Never attempt to use this option to facilitate the reuse of a previously created VeraCrypt Rescue Disk. Note that every time you encrypt a system partition/drive, - you must create a new VeraCrypt Rescue Disk even if you use the same password. A previously created VeraCrypt Rescue Disk cannot be reused as it was created for a different master key.
    /nosizecheckDon't check that the given size of the file container is smaller than the available disk free. This applies to both UI and command line.
    /quickPerform quick formatting of volumes instead of full formatting. This applies to both UI and command line.
    /FastCreateFileEnables a faster, albeit potentially insecure, method for creating file containers. This option carries security risks as it can embed existing disk content into the file container, possibly exposing sensitive data if an attacker gains access to it. Note that this switch affects all file container creation methods, whether initiated from the command line, using the /create switch, or through the UI wizard.
    /protectMemory Activates a mechanism that protects VeraCrypt Format process memory from being accessed by other non-admin processes.
    /secureDesktopIf it is followed by y or yes or if no parameter is specified: display password dialog and token PIN dialog in a dedicated secure desktop to protect against certain types of attacks.
    -If it is followed by n or no: the password dialog and token PIN dialog are displayed in the normal desktop.
    -

    Syntax

    -

    VeraCrypt.exe [/tc] [/hash {sha256|sha-256|sha512|sha-512|whirlpool |blake2s|blake2s-256}][/a [devices|favorites]] [/b] [/c [y|n|f]] [/d [drive letter]] [/e] [/f] [/h [y|n]] [/k keyfile or search path] [tryemptypass [y|n]] [/l drive letter] [/m {bk|rm|recovery|ro|sm|ts|noattach}] - [/p password] [/pim pimvalue] [/q [background|preferences]] [/s] [/tokenlib path] [/v volume] [/w]

    -

    "VeraCrypt Format.exe" [/n] [/create] [/size number[{K|M|G|T}]] [/p password]  [/encryption {AES | Serpent | Twofish | Camellia | Kuznyechik | AES(Twofish) | AES(Twofish(Serpent)) | Serpent(AES) | Serpent(Twofish(AES)) | Twofish(Serpent) | Camellia(Kuznyechik) | Kuznyechik(Twofish) | Camellia(Serpent) | Kuznyechik(AES) | Kuznyechik(Serpent(Camellia)))}] [/hash {sha256|sha-256|sha512|sha-512|whirlpool|blake2s|blake2s-256}] - [/filesystem {None|FAT|NTFS|ExFAT|ReFS}] [/dynamic] [/force] [/silent] [/noisocheck] [FastCreateFile] [/quick]

    -

    Note that the order in which options are specified does not matter.

    -

    Examples

    -

    Mount the volume d:\myvolume as the first free drive letter, using the password prompt (the main program window will not be displayed):

    -

    veracrypt /q /v d:\myvolume

    -

    Unmount a volume mounted as the drive letter X (the main program window will not be displayed):

    -

    veracrypt /q /d x

    -

    Mount a volume called myvolume.tc using the password MyPassword, as the drive letter -X. VeraCrypt will open an explorer window and beep; mounting will be automatic:

    -

    veracrypt /v myvolume.tc /l x /a /p MyPassword /e /b

    -

    Create a 10 MB file container using the password test and formatted using FAT:

    -

    "C:\Program Files\VeraCrypt\VeraCrypt Format.exe" /create c:\Data\test.hc /password test /hash sha512 /encryption serpent /filesystem FAT /size 10M /force

    +

    On Linux and macOS, command-line help for the installed VeraCrypt build can also be displayed in a terminal with:

    +

    veracrypt -t --help

    diff --git a/doc/html/en/Default Mount Parameters.html b/doc/html/en/Default Mount Parameters.html index c96f050e..3df16e05 100644 --- a/doc/html/en/Default Mount Parameters.html +++ b/doc/html/en/Default Mount Parameters.html @@ -45,7 +45,7 @@

    All subsequent password request dialogs will use the default values chosen previously. For example, if in the Default Mount Parameters dialog you check TrueCrypt Mode and you select SHA-512 as a PRF, then subsequent password dialogs will look like:
    Mount Password Dialog using default values

     

    -

    Note: The default mount parameters can be overridden by the Command Line switches +

    Note: The default mount parameters can be overridden by the Command Line switches /tc and /hash which always take precedence.

     

    diff --git a/doc/html/en/Documentation.html b/doc/html/en/Documentation.html index 1510847b..f0f4c178 100644 --- a/doc/html/en/Documentation.html +++ b/doc/html/en/Documentation.html @@ -91,6 +91,10 @@
  • Supported Operating Systems
  • Command Line Usage +
  • Security Model
  • Security Requirements And Precautions
     diff --git a/doc/html/en/FAQ.html b/doc/html/en/FAQ.html index c8cf862c..e62492f6 100644 --- a/doc/html/en/FAQ.html +++ b/doc/html/en/FAQ.html @@ -602,7 +602,7 @@ pre-boot authentication password, select 'System Note: It is not required to burn each VeraCrypt Rescue Disk ISO image to a CD/DVD. You can maintain a central repository of ISO images for all workstations (rather than a repository of CDs/DVDs). For more information see the section - + Command Line Usage (option /noisocheck).