* New VeraCrypt interface (for system encryption) with improved usability
* System Encryption: translate password to US keyboard layout + improved new interface
* Windows: Fix build error following merge
* Windows: Remove unused variable
* Windows: Add missing string in Language.xml
* Windows: fix buffer overrun caused by wrong use of wmemset
* Do not delete password file
Since the file is only available in \Release\Setup Files\ it would be fully deleted after running this script the first time.
* Correct return code
Originally the function would have always returned the return-code 1 resulting that the user is not able to change the location for the rescue zip.
* Added hint for sysenc
Added a hint why the field for repeating the password is initially greyed out within the system encryption.
* Corrected spelling mistake
Corrected spelling mistake
* Removed not working copy job
The file to be copied was stored at the source location. Therefore the copyjob will not work. Instead the file is already in the target folder.
* Removed RIPEMD-160 from Product64.wxs
See commit from 21.03.2022
* Added german translation for new interface
* Fixed PIM bug
* Corrected translation file based on the guidelines within the pull request
* Fixing merge conflicts
* Fixed Compiling issues. Reverted keyboard translation
* Removed artifacts of password translation
* Corrected language.xml
* Fixed order within german language file
* Corrected positions
Co-authored-by: Bruna2803 <bruna.radeljak@hotmail.com>
Co-authored-by: felixreichmann <30237956+felixreichmann@users.noreply.github.com>
Co-authored-by: Mounir IDRASSI <mounir.idrassi@idrix.fr>
Github PR: https://github.com/veracrypt/VeraCrypt/pull/953
* Create CompilingGuidelinerh
* Initial Upload Windows Compiling Guide
* Removed RIPEMD-160 from Product64.wxs. See commit from 21.03.2022
* Completed Win compiling guideline
* Added link to detailed compiling guide
* Added link to detailed compiling guide
* Restructured docu main page
* Added sourceforge link
* Added compiling guide for Linux
* References to detailed instructions
* Revert "Removed RIPEMD-160 from Product64.wxs. See commit from 21.03.2022"
This reverts commit 024ae2a465.
* Correction of a div box
The variable has enough capacity so pointer &buffer[0] is valid but since clear method was called, we are not supposed to access element at index 0.
Related to Github issue #896
Under "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\veracrypt", create a REG_DWORD value named "VeraCryptEraseKeysShutdown" and set its value to 0.
* *: source files should not be executable
* *: make sure files have final newline
* *: remove BOM from text files
* translations: unify headers
* *: fix typos
* *: trim excess whitespace
We query the kern.geom.conftxt sysctl for the GEOM configuration to find
the partition offset. Technically speaking it would probably be better
to link against libgeom but this is less overall intrusive. Also
includes a small fix to find the parent device of an encrypted partition
when it is a GPT partition rather than a BSD slice.
* Adding more Turkish translations
This change is translating some still English lines to Turkish
* Fixing typo
Co-authored-by: Özgür Pekçağlıyan <zgrw@users.noreply.github.com>
Hooking is not allowed if thread is running in secure desktop so we ignore SetWindowsHookEx failure in this case and random generator will be initialized using the other entropy sources from the system.
this commit will add a sponsor button to the repository,
pointing to the donation page of the veracrypt website.
more information on github documentation under https://git.io/JL9e6
* new xml Tag for en and de
* add linux support for env LANG
* precopiled header into TrueCrypt.fdp to substitute '_()' with 'LangString[]'
* more LangString in Code
* add Language xml's to Linux Setup location
* backup language for linux is en
* remove Language.en.xml install
* rearange new xml lines to end
* yes/no dialogs now translated
* All OK/Cancel Button now support international
Co-authored-by: tb@tbon.de <tb@tbon.de>
* Update Chinese (Hong Kong) translation
- replace Mainland China wordings with Hong Kong wordings
- correcting size unit to use KiB, MiB, GiB, TiB
- using Windows default Chinese Traditional fonts
* Update Language.zh-hk.xml
* Update Language.zh-hk.xml
- translated some untranslated lines
- minor wording refinements
* Update Language.zh-hk.xml
daily commit for translation progress
* Update Language.zh-hk.xml
* Update Language.zh-hk.xml
* Update Language.zh-hk.xml
* Update Language.zh-hk.xml
* Update Language.zh-hk.xml
* Update Language.zh-hk.xml
* translated some more untranslated strings
* Update Language.zh-hk.xml
* Update Chinese (Hong Kong) translation
- replace Mainland China wordings with Hong Kong wordings
- correcting size unit to use KiB, MiB, GiB, TiB
- using Windows default Chinese Traditional fonts
* Update Language.zh-hk.xml
* Update Language.zh-hk.xml
- translated some untranslated lines
- minor wording refinements
Completely reworked Dutch translations (in accordance to the Microsoft style guide, as much as possible). Translated using the dedicated Transifex project by Localization Lab. (https://www.transifex.com/otf/veracrypt/dashboard/)
If needed, a Winmerge report (for visual comparison) can be generated.
Regards, Thomas De Rocker (RockyTDR)
* Adding Processor Groups support for more than 64 processors
* Revert " Adding Processor Groups support for more than 64 processors"
This reverts commit e1d5fe0a55.
* Adding Processor Groups support for >64 logical processors
* Revert "Linux: Fix failure to run VeraCrypt binary built for console mode on headless machines (fix issue https://github.com/veracrypt/VeraCrypt/issues/531)"
The build failure still exists for system wxGTK compiled with '--disable-gui':
```
In file included from TextUserInterface.cpp:27:
TextUserInterface.h: In member function ‘virtual bool VeraCrypt::TextUserInterface::Initialize(int&, wxChar**)’:
TextUserInterface.h:50:63: error: ‘wxAppBase’ has not been declared
50 | virtual bool Initialize (int &argc, wxChar **argv) { return wxAppBase::Initialize(argc, argv); }
```
This reverts commit 737e1f126b.
* Revert "Linux: fix compilation error when building console-only version of VeraCrypt that is statically linked to wxWidgets"
The build failure still exists for system wxGTK compiled with '--disable-gui':
```
In file included from TextUserInterface.cpp:27:
TextUserInterface.h: In member function ‘virtual bool VeraCrypt::TextUserInterface::Initialize(int&, wxChar**)’:
TextUserInterface.h:50:63: error: ‘wxAppBase’ has not been declared
50 | virtual bool Initialize (int &argc, wxChar **argv) { return wxAppBase::Initialize(argc, argv); }
```
This reverts commit 14bee5e6a2.
* src/Main/Main.make: simplify the WX_CONFIG_LIBS logic
Irrespective of whether we are linking against widgets statically or
dynamically, pull in only 'base' when GUI is disabled, and
'adv,core,base' when GUI is enabled. When GUI is disabled, the C/CXX
flag must include '-DwxUSE_GUI=0' for this to work.
* src/Makefile: pass '-DwxUSE_GUI=0' when NOGUI=1
veracrypt with NOGUI=1 fails to properly link against wxGTK compiled
with '--disable-gui' only using the 'base' library because the wx's
setup.h implicitly defines wxUSE_GUI=1, which then changes the
definition of various structures, requiring symbols from the core
library as well.
For example, wxwidgets include/wx/app.h defines:
#if wxUSE_GUI
class WXDLLIMPEXP_CORE wxAppBase : public wxAppConsole
...
[snip]
...
#else // !GUI
// wxApp is defined in core and we cannot define another one in wxBase,
// so use the preprocessor to allow using wxApp in console programs too
#define wxApp wxAppConsole
#endif // GUI/!GUI
To fix this, pass '-DwxUSE_GUI=0' when compiling veracrypt with
NOGUI=1.
Closes: https://github.com/veracrypt/VeraCrypt/issues/531
When my system broke and I had to use WindowsPE to rescue some files the password dialog always closed immediately. There was no chance to mount the system device using the GUI. It took me a while to realize that I could try using the CLI by passing the password as a parameter (which might not be so obvious for not advanced users).
Signed-off-by: Sven Strickroth <email@cs-ware.de>
* Start following IEEE 1541 agreed naming of bytes
This standard exists to prevent any confusion about the actual number of bytes. It has been agreed on by experts and is being used more widespead these day. Let's start properly naming the number of bytes, which is absolutely important in disk encryption software.
* Update LanguageStrings.cpp
* Update UserInterface.cpp
* kibibyte instead of kilobyte
* kibibyte instead of kilobyte
* MiB instead of MB
* undo accidental deletions
Odd indeed that two random lines were deleted in a previous commit. Probably happened when using a keyboard shortcut while editing the file. This fixes the issue.
* Mb to Mib
To get the size of each device / partition on the system, the method 'GetDeviceSize()' in 'src/Core/Unix/CoreUnix.cpp' first opens
the device / partition using 'open()' function to get a File Descriptor, then retrieves its size using this File Descriptor.
Starting OS X 10.11 ("El Capitan"), a feature called "System Integrity Protection (SIP)" or less formally, "rootless mode" has been added.
This feature blocks access to certain critical aspects of the OS and Hardware by 3rd-Party programs.
Specifically, low-level access to the system disks, devices and partitions is forbidden ; namely functions like 'open()' for instance fail
with the error code : "EPERM = Operation Not Permitted".
Therefore, for system devices / partitions, 'GetDeviceSize()' fails because of the failure of the 'open()' function, and throws an exception,
which is then caught inside the method 'GetHostDevices()' in '/src/Core/Unix/FreeBSD/CoreFreeBSD.cpp' : this leads to the size of the
device / partition being set to '0'.
Therefore, in the constructor of 'DeviceSelectionDialog' in 'src/Main/Forms/DeviceSelectionDialog.cpp', when the size of a device is '0',
the whole device is skipped, leading to all of its partitions not being treated or shown, even though some of these partitions may have a size which is != 0.
This commit fixes the issue by :
1 - First, checking whether the device size is '0'. If it is the case, the code loops through all the devices partitions : if there is at least one partition
with a size != 0, the device is not skipped. Otherwise, it is.
2 - Then, if the size of the device is '0', the size of the device is not shown to avoid confusing the user.
Also, since the device is not usable, the 'OK' button is not active when the device is selected.
3 - Finally, if a partition's size is '0', it is not shown since it is not usable : we cannot open it.
Signed-off-by: El Mostafa IDRASSI <el-mostafa.idrassi@prestalab.net>
Now, under Debian 10+ and Ubuntu 18.04+, we link against the GTK-3 version of wxWidgets (libwxgtk3.0-gtk3-0v5).
Under Debian 9- and Ubuntu 16.04, we link against the GTK-2 version of wxWidgets (libwxgtk3.0-0v5) which is the
only one available.
Also, we now have 2 separate RPM scripts : 'build_cmake_rpm_gtk2.sh' which builds wxWidgets and links it against GTK-2,
then links VeraCrypt against 'gtk2' package (typically to be used under CentOS 6) and 'build_cmake_rpm_gtk3' which builds
wxWidgets and links it against GTK-3, then links VeraCrypt against 'gtk3' package (typically to be used under CentOS 7+).
The DEB script builds VeraCrypt and links it against wxWidgets that comes with the distribution.
The RPM script awaits for wxWidgets-3.0.4 source code which it builds then links VeraCrypt statically to it.
Both scripts create the corresponding package after the build.
Compiling with -mxxx defines the corresponding macro of the intrinsics.
For example, -mssse3 defines __SSSE3__ macro to 1.
In GCC versions < 4.9, it is not possible to use and call x86 intrinsics only at runtime without
compiling the entire file with the -mxxx option.
For example, if we want to call SSSE3 intrinsics without compiling with -mssse3, the macro __SSSE3__ is not defined.
Therefore, when including <tmmintrin.h>, this results in "error "SSSE3 instruction set not enabled"" because of :
#ifndef __SSSE3__
# error "SSSE3 instruction set not enabled"
Since GCC 4.9, this has been fixed and it is possible to call x86 intrinsics from select functions in a file
that are tagged with the corresponding target attribute without having to compile the entire file with the -mxxx option.
This can be seen in <tmmintrin.h> which in recent versions (>= 4.9) contains :
#ifndef __SSSE3__
#pragma GCC push_options
#pragma GCC target("ssse3")
#define __DISABLE_SSSE3__
Since SSSE3 is only used under Windows for ChaCha256, this can be fixed by preceding '#include <tmmintrin.h>' with
#if defined (_MSC_VER) && !defined (TC_WINDOWS_BOOT).
See https://gcc.gnu.org/gcc-4.9/changes.html
in order for 'export TC_VERSION := $(shell grep VERSION_STRING ../Common/Tcdefs.h | head -n 1 | cut -d'"' -f 2)'
in 'src/Main/Main.make' to actually return the version rather than '-CustomEFI'.
* Update Language.ko.xml
* Update Language.ko.xml
* 509 line
* Update Language.ko.xml
* Update Language.ko.xml
200 line done
1281 line remaining
* Update Language.ko.xml
* 28% Done
* 446 line
* 530 line
* Update Language.ko.xml
* Update Language.ko.xml
* 600 line
* 651 line
* 1042 line
* Update Language.ko.xml
* Edit translator information & korean font name
* Revert previous commit
* Fix "Invalid characters..." issue by not using "foreach" macro
The "foreach" macro creates a copy of the container.
This copy is destroyed immediately after the iteration is completed.
C-strings pointers passed to the local array were invalidated
with destroying of "std::string"s contained in the copy.
Creating such a start menu entry is a leftover of the ancient Win 3.x time where there was no central control panel for removing programs.
Also see the Windows guidelines, where creating an uninstall shortcut is discouraged: https://msdn.microsoft.com/en-us/library/ms954377.aspx
Signed-off-by: Sven Strickroth <email@cs-ware.de>
Starting with glibc 2.26, macros "major" and "minor" are only
available from <sys/sysmacros.h> [0]. The build fails with the
following without including this header:
Unix/FilesystemPath.cpp:84:49: error: ‘major’ was not declared in this scope
Unix/FilesystemPath.cpp:84:113: error: ‘minor’ was not declared in this scope
[0] https://sourceware.org/ml/libc-alpha/2017-02/msg00079.html
@@ -110,17 +67,19 @@ First, create an environment variable 'WSDK81' pointing to the Windows SDK
for Windows 8.1 installation directory.
The folder "Signing" contains a batch file (sign.bat) that will sign all
VeraCrypt components using a code signing certificate present on the
certificate store and also build the final installation setup.
The batch file suppose that the code signing certificate is issued by Thawt.
This is the case for IDRIX's certificate. If yours is issued by another CA,
then you should put the Root and Intermediate certificates in the "Signing"
folder and then modify sign.bat accordingly.
certificate store and also build the final installation setup and MSI package.
The batch file suppose that the code signing certificate is issued by
GlobalSign. This is the case for IDRIX's certificate. If yours is issued by
another CA, then you should put its intermediate certificates in the "Signing"
folder and modify sign.bat accordingly.
In order to generate MSI packages, WiX Toolset v3.11 must be installed.
VeraCrypt EFI Boot Loader:
--------------------------
VeraCrypt source code contains pre-built EFI binaries under src\Boot\EFI.
The source code of VeraCrypt EFI Boot Loader is licensed under LGPL and
The source code of VeraCrypt EFI Boot Loader is licensed under LGPL and
it is available at https://github.com/veracrypt/VeraCrypt-DCS.
For build instructions, please refer to the file src\Boot\EFI\Readme.txt.
@@ -128,23 +87,20 @@ For build instructions, please refer to the file src\Boot\EFI\Readme.txt.
II. Linux and Mac OS X
======================
A detailed guide on how to build a dev environment and on how to compile VeraCrypt on Linux can be found at: https://www.veracrypt.fr/en/CompilingGuidelineLinux.html
Requirements for Building VeraCrypt for Linux and Mac OS X:
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
The Advanced Encryption Standard (AES) specifies a FIPS-approved cryptographic algorithm (Rijndael, designed by Joan Daemen and Vincent Rijmen, published in 1998) that may be used by US federal departments and agencies to cryptographically protect sensitive
information [3]. VeraCrypt uses AES with 14 rounds and a 256-bit key (i.e., AES-256, published in 2001) operating in
In June 2003, after the NSA (US National Security Agency) conducted a review and analysis of AES, the U.S. CNSS (Committee on National Security Systems) announced in [1] that the design and strength of AES-256 (and AES-192) are sufficient to protect classified
information up to the Top Secret level. This is applicable to all U.S. Government Departments or Agencies that are considering the acquisition or use of products incorporating the Advanced Encryption Standard (AES) to satisfy Information Assurance requirements
associated with the protection of national security systems and/or national security information [1].</div>
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
<p>We would like to thank the following people:</p>
<p>The TrueCrypt Developers team who have done an amazing job over the course of 10 years. Without their hard work, VeraCrypt would not exist today.</p>
<p>Paul Le Roux for making his E4M source code available. TrueCrypt 1.0 was derived from E4M and some parts of the E4M source code are still incorporated in the latest version of the TrueCrypt source code.</p>
<p>Brian Gladman, who wrote the excellent AES, Twofish, and SHA-512 routines.</p>
<p>Peter Gutmann for his paper on random numbers, and for creating his cryptlib, which was the source of parts of the random number generator source code.</p>
<p>Wei Dai, who wrote the Serpent and RIPEMD-160 and Whirlpool routines.</p>
<p>Tom St Denis, the author of LibTomCrypt which includes compact SHA-256 routines.</p>
<p>Mark Adler and Jean-loup Gailly, who wrote the zlib library.</p>
<p>The designers of the encryption algorithms, hash algorithms, and the mode of operation:</p>
<p>Horst Feistel, Don Coppersmith, Walt Tuchmann, Lars Knudsen, Ross Anderson, Eli Biham, Bruce Schneier, David Wagner, John Kelsey, Niels Ferguson, Doug Whiting, Chris Hall, Joan Daemen, Vincent Rijmen, Carlisle Adams, Stafford Tavares, Phillip Rogaway, Hans
Dobbertin, Antoon Bosselaers, Bart Preneel, Paulo S. L. M. Barreto.</p>
<p>Andreas Becker for designing VeraCrypt logo and icons.</p>
<p>Xavier de Carné de Carnavalet who proposed a speed optimization for PBKDF2 that reduced mount/boot time by half.</p>
<p>kerukuro for cppcrypto library (http://cppcrypto.sourceforge.net/) from which Kuznyechik cipher implementation was taken.</p>
<p><br>
Dieter Baron and Thomas Klausner who wrote the libzip library.</p>
<p><br>
Jack Lloyd who wrote the SIMD optimized Serpent implementation.</p>
<p>All the others who have made this project possible, all who have morally supported us, and all who sent us bug reports or suggestions for improvements.</p>
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
<ahref="Additional%20Security%20Requirements%20and%20Precautions.html">Additional Security Requirements and Precautions</a>
</p></div>
<divclass="wikidoc">
<div>
<h1>Additional Security Requirements and Precautions</h1>
<p>In addition to the requirements and precautions described in this chapter (<ahref="Security%20Requirements%20and%20Precautions.html"><em>Security Requirements and Precautions</em></a>), you must follow and keep in
mind the security requirements, precautions, and limitations listed in the following chapters and sections:</p>
<ul>
<li><ahref="How%20to%20Back%20Up%20Securely.html"><em><strong>How to Back Up Securely</strong></em></a>
</li><li><ahref="Security%20Requirements%20for%20Hidden%20Volumes.html"><em><strong>Security Requirements and Precautions Pertaining to Hidden Volumes</strong></em></a>
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
<ahref="Authenticity%20and%20Integrity.html">Authenticity and Integrity</a>
</p></div>
<divclass="wikidoc">
<div>
<h1>Authenticity and Integrity</h1>
<p>VeraCrypt uses encryption to preserve the <em>confidentiality</em> of data it encrypts. VeraCrypt neither preserves nor verifies the integrity or authenticity of data it encrypts or decrypts. Hence, if you allow an adversary to modify data encrypted by VeraCrypt,
he can set the value of any 16-byte block of the data to a random value or to a previous value, which he was able to obtain in the past. Note that the adversary cannot choose the value that you will obtain when VeraCrypt decrypts the modified block —
the value will be random — unless the attacker restores an older version of the encrypted block, which he was able to obtain in the past. It is your responsibility to verify the integrity and authenticity of data encrypted or decrypted by VeraCrypt (for
example, by using appropriate third-party software).<br>
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
https://fr.linkedin.com/in/idrassi</a>) is the creator and main developer of VeraCrypt. He managed all development and deployment aspects on all supported platforms (Windows,Linux and OSX).</p>
<p>Alex Kolotnikov (<ahref="https://ru.linkedin.com/in/alex-kolotnikov-6625568b"target="_blank">https://ru.linkedin.com/in/alex-kolotnikov-6625568b</a>) is the author of VeraCrypt EFI bootloader. He manages all aspects of EFI support and his strong expertise
helps bring new exciting features to VeraCrypt Windows system encryption.</p>
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
BLAKE2 is a cryptographic hash function based on BLAKE, created by Jean-Philippe Aumasson, Samuel Neves, Zooko Wilcox-O'Hearn, and Christian Winnerlein. It was announced on December 21, 2012. The design goal was to replace the widely used, but broken, MD5 and SHA-1 algorithms in applications requiring high performance in software. BLAKE2 provides better security than SHA-2 and similar to that of SHA-3 (e.g. immunity to length extension, indifferentiability from a random oracle, etc...).<br/>
BLAKE2 removes addition of constants to message words from BLAKE round function, changes two rotation constants, simplifies padding, adds parameter block that is XOR'ed with initialization vectors, and reduces the number of rounds from 16 to 12 for BLAKE2b (successor of BLAKE-512), and from 14 to 10 for BLAKE2s (successor of BLAKE-256).<br/>
BLAKE2b and BLAKE2s are specified in RFC 7693.
</p>
<p>
VeraCrypt uses only BLAKE2s with its maximum output size of 32-bytes (256 bits).
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
<h2>How to Create and Use a VeraCrypt Container</h2>
<p>This chapter contains step-by-step instructions on how to create, mount, and use a VeraCrypt volume. We strongly recommend that you also read the other sections of this manual, as they contain important information.</p>
<h4>STEP 1:</h4>
<p>If you have not done so, download and install VeraCrypt. Then launch VeraCrypt by double-clicking the file VeraCrypt.exe or by clicking the VeraCrypt shortcut in your Windows Start menu.</p>
The VeraCrypt Volume Creation Wizard window should appear.<br>
<br>
In this step you need to choose where you wish the VeraCrypt volume to be created. A VeraCrypt volume can reside in a file, which is also called container, in a partition or drive. In this tutorial, we will choose the first option and create a VeraCrypt volume
within a file.<br>
<br>
As the option is selected by default, you can just click <strong>Next</strong>.</p>
<p>Note: In the following steps, the screenshots will show only the right-hand part of the Wizard window.</p>
In this step you need to choose whether to create a standard or hidden VeraCrypt volume. In this tutorial, we will choose the former option and create a standard VeraCrypt volume.<br>
<br>
As the option is selected by default, you can just click <strong>Next</strong>.</p>
In this step you have to specify where you wish the VeraCrypt volume (file container) to be created. Note that a VeraCrypt container is just like any normal file. It can be, for example, moved or deleted as any normal file. It also needs a filename, which you
will choose in the next step.<br>
<br>
Click <strong>Select File</strong>.<br>
<br>
The standard Windows file selector should appear (while the window of the VeraCrypt Volume Creation Wizard remains open in the background).</p>
In this tutorial, we will create our VeraCrypt volume in the folder F<em>:\Data\ </em>
and the filename of the volume (container) will be <em>MyVolume.hc </em>(as can be seen in the screenshot above). You may, of course, choose any other filename and location you like (for example, on a USB memory stick). Note that the file
<em>MyVolume.hc </em>does not exist yet – VeraCrypt will create it.</p>
<p>IMPORTANT: Note that VeraCrypt will <em>not </em>encrypt any existing files (when creating a VeraCrypt file container). If you select an existing file in this step, it will be overwritten and replaced by the newly created volume (so the overwritten file
will be <em>lost</em>, <em>not </em>encrypted). You will be able to encrypt existing files (later on) by moving them to the VeraCrypt volume that we are creating now.*</p>
<p>Select the desired path (where you wish the container to be created) in the file selector. Type the desired container file name in the
<strong>Filename </strong>box.<br>
<br>
Click <strong>Save</strong>.<br>
<br>
The file selector window should disappear.<br>
<br>
In the following steps, we will return to the VeraCrypt Volume Creation Wizard.</p>
<p>* Note that after you copy existing unencrypted files to a VeraCrypt volume, you should securely erase (wipe) the original unencrypted files. There are software tools that can be used for the purpose of secure erasure (many of them are free).</p>
Here you can choose an encryption algorithm and a hash algorithm for the volume. If you are not sure what to select here, you can use the default settings and click
<strong>Next </strong>(for more information, see chapters <ahref="Encryption Algorithms.html">
<em>Encryption Algorithms</em></a> and <ahref="Hash%20Algorithms.html">
Here we specify that we wish the size of our VeraCrypt container to be 250 megabyte. You may, of course, specify a different size. After you type the desired size in the input field (marked with a red rectangle), click
This is one of the most important steps. Here you have to choose a good volume password. Read carefully the information displayed in the Wizard window about what is considered a good password.<br>
<br>
After you choose a good password, type it in the first input field. Then re-type it in the input field below the first one and click
<strong>Next</strong>.</p>
<p>Note: The button <strong>Next </strong>will be disabled until passwords in both input fields are the same.</p>
Move your mouse as randomly as possible within the Volume Creation Wizard window at least until the randomness indicator becomes green. The longer you move the mouse, the better (moving the mouse for at least 30 seconds is recommended). This significantly increases
the cryptographic strength of the encryption keys (which increases security).<br>
<br>
Click <strong>Format</strong>.<br>
<br>
Volume creation should begin. VeraCrypt will now create a file called <em>MyVolume.hc
</em>in the folder F<em>:\Data\ </em>(as we specified in Step 6). This file will be a VeraCrypt container (it will contain the encrypted VeraCrypt volume). Depending on the size of the volume, the volume creation may take a long time. After it finishes, the
We have just successfully created a VeraCrypt volume (file container). In the VeraCrypt Volume Creation Wizard window, click
<strong>Exit</strong>.<br>
<br>
The Wizard window should disappear.<br>
<br>
In the remaining steps, we will mount the volume we just created. We will return to the main VeraCrypt window (which should still be open, but if it is not, repeat Step 1 to launch VeraCrypt and then continue from Step 13.)</p>
Select the PRF algorithm that was used during the creation of the volume (SHA-512 is the default PRF used by VeraCrypt). If you don’t remember which PRF was used, just leave it set to “autodetection” but the mounting process will take more
time. Click <strong>OK</strong> after entering the password.<br>
<br>
VeraCrypt will now attempt to mount the volume. If the password is incorrect (for example, if you typed it incorrectly), VeraCrypt will notify you and you will need to repeat the previous step (type the password again and click
<strong>OK</strong>). If the password is correct, the volume will be mounted.</p>
We have just successfully mounted the container as a virtual disk M:<br>
<br>
The virtual disk is entirely encrypted (including file names, allocation tables, free space, etc.) and behaves like a real disk. You can save (or copy, move, etc.) files to this virtual disk and they will be encrypted on the fly as they are being written.<br>
<br>
If you open a file stored on a VeraCrypt volume, for example, in media player, the file will be automatically decrypted to RAM (memory) on the fly while it is being read.</p>
<p>Important: Note that when you open a file stored on a VeraCrypt volume (or when you write/copy a file to/from the VeraCrypt volume) you will not be asked to enter the password again. You need to enter the correct password only when mounting the volume.</p>
<p>You can open the mounted volume, for example, by selecting it on the list as shown in the screenshot above (blue selection) and then double-clicking on the selected item.</p>
<p>You can also browse to the mounted volume the way you normally browse to any other types of volumes. For example, by opening the ‘<em>Computer</em>’ (or ‘<em>My Computer</em>’) list and double clicking the corresponding drive letter
You can copy files (or folders) to and from the VeraCrypt volume just as you would copy them to any normal disk (for example, by simple drag-and-drop operations). Files that are being read or copied from the encrypted VeraCrypt volume are automatically decrypted
on the fly in RAM (memory). Similarly, files that are being written or copied to the VeraCrypt volume are automatically encrypted on the fly in RAM (right before they are written to the disk).<br>
<br>
Note that VeraCrypt never saves any decrypted data to a disk – it only stores them temporarily in RAM (memory). Even when the volume is mounted, data stored in the volume is still encrypted. When you restart Windows or turn off your computer, the volume
will be dismounted and all files stored on it will be inaccessible (and encrypted). Even when power supply is suddenly interrupted (without proper system shut down), all files stored on the volume will be inaccessible (and encrypted). To make them accessible
again, you have to mount the volume. To do so, repeat Steps 13-18.</p>
<p>If you want to close the volume and make files stored on it inaccessible, either restart your operating system or dismount the volume. To do so, follow these steps:<br>
Select the volume from the list of mounted volumes in the main VeraCrypt window (marked with a red rectangle in the screenshot above) and then click
<strong>Dismount </strong>(also marked with a red rectangle in the screenshot above). To make files stored on the volume accessible again, you will have to mount the volume. To do so, repeat Steps 13-18.</p>
<h2>How to Create and Use a VeraCrypt-Encrypted Partition/Device</h2>
<p>Instead of creating file containers, you can also encrypt physical partitions or drives (i.e., create VeraCrypt device-hosted volumes). To do so, repeat the steps 1-3 but in the step 3 select the second or third option. Then follow the remaining instructions
in the wizard. When you create a device-hosted VeraCrypt volume within a <em>non-system
</em>partition/drive, you can mount it by clicking <em>Auto-Mount Devices </em>in the main VeraCrypt window. For information pertaining to encrypted
<em>system </em>partition/drives, see the chapter <ahref="System%20Encryption.html">
<em>System Encryption</em></a>.</p>
<p>Important: <em>We strongly recommend that you also read the other chapters of this manual, as they contain important information that has been omitted in this tutorial for simplicity.</em></p>
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
Jointly developed by Mitsubishi Electric and NTT of Japan, Camellia is a 128-bit block cipher that was first published on 2000. It has been approved for use by the ISO/IEC, the European Union's NESSIE project and the Japanese CRYPTREC project.</div>
VeraCrypt uses Camellia with 24 rounds and a 256-bit key operating in <ahref="Modes%20of%20Operation.html"style="text-align:left; color:#0080c0; text-decoration:none.html">
XTS mode</a> (see the section <ahref="Modes%20of%20Operation.html"style="text-align:left; color:#0080c0; text-decoration:none.html">
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
<p>Two ciphers in a cascade [15, 16] operating in XTS mode (see the section <ahref="Modes%20of%20Operation.html">
<em>Modes of Operation</em></a>). Each 128-bit block is first encrypted with Twofish (256-bit key) in XTS mode and then with AES (256-bit key) in XTS mode. Each of the cascaded ciphers uses its own key. All encryption keys are mutually independent (note that
header keys are independent too, even though they are derived from a single password – see
<ahref="Header Key Derivation.html"><em>Header Key Derivation, Salt, and Iteration Count</em></a>). See above for information on the individual cascaded ciphers.</p>
<h2>AES-Twofish-Serpent</h2>
<p>Three ciphers in a cascade [15, 16] operating in XTS mode (see the section <ahref="Modes%20of%20Operation.html">
<em>Modes of Operation</em></a>). Each 128-bit block is first encrypted with Serpent (256-bit key) in XTS mode, then with Twofish (256-bit key) in XTS mode, and finally with AES (256-bit key) in XTS mode. Each of the cascaded ciphers uses its own key. All encryption
keys are mutually independent (note that header keys are independent too, even though they are derived from a single password – see the section
<ahref="Header Key Derivation.html"><em>Header Key Derivation, Salt, and Iteration Count</em></a>). See above for information on the individual cascaded ciphers.</p>
<h2>Camellia-Kuznyechik</h2>
<p>Two ciphers in a cascade [15, 16] operating in XTS mode (see the section <ahref="Modes%20of%20Operation.html">
<em>Modes of Operation</em></a>). Each 128-bit block is first encrypted with Kuznyechik (256-bit key) in XTS mode and then with Camellia (256-bit key) in XTS mode. Each of the cascaded ciphers uses its own key. All encryption keys are mutually independent (note that
header keys are independent too, even though they are derived from a single password – see the section
<ahref="Header Key Derivation.html"><em>Header Key Derivation, Salt, and Iteration Count</em></a>). See above for information on the individual cascaded ciphers.</p>
<h2>Camellia-Serpent</h2>
<p>Two ciphers in a cascade [15, 16] operating in XTS mode (see the section <ahref="Modes%20of%20Operation.html">
<em>Modes of Operation</em></a>). Each 128-bit block is first encrypted with Serpent (256-bit key) in XTS mode and then with Camellia (256-bit key) in XTS mode. Each of the cascaded ciphers uses its own key. All encryption keys are mutually independent (note that
header keys are independent too, even though they are derived from a single password – see the section
<ahref="Header Key Derivation.html"><em>Header Key Derivation, Salt, and Iteration Count</em></a>). See above for information on the individual cascaded ciphers.</p>
<h2>Kuznyechik-AES</h2>
<p>Two ciphers in a cascade [15, 16] operating in XTS mode (see the section <ahref="Modes%20of%20Operation.html">
<em>Modes of Operation</em></a>). Each 128-bit block is first encrypted with AES (256-bit key) in XTS mode and then with Kuznyechik (256-bit key) in XTS mode. Each of the cascaded ciphers uses its own key. All encryption keys are mutually independent (note that
header keys are independent too, even though they are derived from a single password – see the section
<ahref="Header Key Derivation.html"><em>Header Key Derivation, Salt, and Iteration Count</em></a>). See above for information on the individual cascaded ciphers.</p>
<h2>Kuznyechik-Serpent-Camellia</h2>
<p>Three ciphers in a cascade [15, 16] operating in XTS mode (see the section <ahref="Modes%20of%20Operation.html">
<em>Modes of Operation</em></a>). Each 128-bit block is first encrypted with Camellia (256-bit key) in XTS mode, then with Serpent (256- bit key) in XTS mode, and finally with Kuznyechik (256-bit key) in XTS mode. Each of the cascaded ciphers uses its own key. All
encryption keys are mutually independent (note that header keys are independent too, even though they are derived from a single password – see the section
<ahref="Header Key Derivation.html"><em>Header Key Derivation, Salt, and Iteration Count</em></a>). See above for information on the individual cascaded ciphers.</p>
<h2>Kuznyechik-Twofish</h2>
<p>Two ciphers in a cascade [15, 16] operating in XTS mode (see the section <ahref="Modes%20of%20Operation.html">
<em>Modes of Operation</em></a>). Each 128-bit block is first encrypted with Twofish (256-bit key) in XTS mode and then with Kuznyechik (256-bit key) in XTS mode. Each of the cascaded ciphers uses its own key. All encryption keys are mutually independent (note that
header keys are independent too, even though they are derived from a single password – see the section
<ahref="Header Key Derivation.html"><em>Header Key Derivation, Salt, and Iteration Count</em></a>). See above for information on the individual cascaded ciphers.</p>
<h2>Serpent-AES</h2>
<p>Two ciphers in a cascade [15, 16] operating in XTS mode (see the section <ahref="Modes%20of%20Operation.html">
<em>Modes of Operation</em></a>). Each 128-bit block is first encrypted with AES (256-bit key) in XTS mode and then with Serpent (256-bit key) in XTS mode. Each of the cascaded ciphers uses its own key. All encryption keys are mutually independent (note that
header keys are independent too, even though they are derived from a single password – see the section
<ahref="Header Key Derivation.html"><em>Header Key Derivation, Salt, and Iteration Count</em></a>). See above for information on the individual cascaded ciphers.</p>
<h2>Serpent-Twofish-AES</h2>
<p>Three ciphers in a cascade [15, 16] operating in XTS mode (see the section <ahref="Modes%20of%20Operation.html">
<em>Modes of Operation</em></a>). Each 128-bit block is first encrypted with AES (256-bit key) in XTS mode, then with Twofish (256- bit key) in XTS mode, and finally with Serpent (256-bit key) in XTS mode. Each of the cascaded ciphers uses its own key. All
encryption keys are mutually independent (note that header keys are independent too, even though they are derived from a single password – see the section
<ahref="Header Key Derivation.html"><em>Header Key Derivation, Salt, and Iteration Count</em></a>). See above for information on the individual cascaded ciphers.</p>
<h2>Twofish-Serpent</h2>
<p>Two ciphers in a cascade [15, 16] operating in XTS mode (see the section <ahref="Modes%20of%20Operation.html">
<em>Modes of Operation</em></a>). Each 128-bit block is first encrypted with Serpent (256-bit key) in XTS mode and then with Twofish (256-bit key) in XTS mode. Each of the cascaded ciphers uses its own key. All encryption keys are mutually independent (note
that header keys are independent too, even though they are derived from a single password – see the section
<ahref="Header Key Derivation.html"><em>Header Key Derivation, Salt, and Iteration Count</em></a>). See above for information on the individual cascaded ciphers.</p>
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
<ahref="Changing%20Passwords%20and%20Keyfiles.html">Changing Passwords and Keyfiles</a>
</p></div>
<divclass="wikidoc">
<h1>Changing Passwords and Keyfiles</h1>
<p>Note that the volume header (which is encrypted with a header key derived from a password/keyfile) contains the master key (not to be confused with the password) with which the volume is encrypted. If an adversary is allowed to make a copy of your volume
before you change the volume password and/or keyfile(s), he may be able to use his copy or fragment (the old header) of the VeraCrypt volume to mount your volume using a compromised password and/or compromised keyfiles that were necessary to mount the volume
before you changed the volume password and/or keyfile(s).<br>
<br>
If you are not sure whether an adversary knows your password (or has your keyfiles) and whether he has a copy of your volume when you need to change its password and/or keyfiles, it is strongly recommended that you create a new VeraCrypt volume and move files
from the old volume to the new volume (the new volume will have a different master key).<br>
<br>
Also note that if an adversary knows your password (or has your keyfiles) and has access to your volume, he may be able to retrieve and keep its master key. If he does, he may be able to decrypt your volume even after you change its password and/or keyfile(s)
(because the master key does not change when you change the volume password and/or keyfiles). In such a case, create a new VeraCrypt volume and move all files from the old volume to this new one.<br>
<br>
The following sections of this chapter contain additional information pertaining to possible security issues connected with changing passwords and/or keyfiles:</p>
<ul>
<li><ahref="Security%20Requirements%20and%20Precautions.html"><em>Security Requirements and Precautions</em></a>
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
<ahref="Choosing%20Passwords%20and%20Keyfiles.html">Choosing Passwords and Keyfiles</a>
</p></div>
<divclass="wikidoc">
<div>
<h1>Choosing Passwords and Keyfiles</h1>
<p>It is very important that you choose a good password. You must avoid choosing one that contains only a single word that can be found in a dictionary (or a combination of such words). It must not contain any names, dates of birth, account numbers, or any
other items that could be easy to guess. A good password is a random combination of upper and lower case letters, numbers, and special characters, such as @ ^ = $ * + etc. We strongly recommend choosing a password consisting of more than 20 characters (the
longer, the better). Short passwords are easy to crack using brute-force techniques.<br>
<br>
To make brute-force attacks on a keyfile infeasible, the size of the keyfile must be at least 30 bytes. If a volume uses multiple keyfiles, then at least one of the keyfiles must be 30 bytes in size or larger. Note that the 30-byte limit assumes a large amount
of entropy in the keyfile. If the first 1024 kilobytes of a file contain only a small amount of entropy, it must not be used as a keyfile (regardless of the file size). If you are not sure what entropy means, we recommend that you let VeraCrypt generate a
file with random content and that you use it as a keyfile (select <em>Tools -> Keyfile Generator</em>).</p>
<p>When creating a volume, encrypting a system partition/drive, or changing passwords/keyfiles, you must not allow any third party to choose or modify the password/keyfile(s) before/while the volume is created or the password/keyfiles(s) changed. For example,
you must not use any password generators (whether website applications or locally run programs) where you are not sure that they are high-quality and uncontrolled by an attacker, and keyfiles must not be files that you download from the internet or that are
accessible to other users of the computer (whether they are administrators or not).</p>
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
<ahref="Command%20Line%20Usage.html">Command Line Usage</a>
</p></div>
<divclass="wikidoc">
<div>
<h1>Command Line Usage</h1>
<p>Note that this section applies to the Windows version of VeraCrypt. For information on command line usage applying to the
<strong>Linux and Mac OS X versions</strong>, please run: veracrypt –h</p>
<tableborder="1"cellspacing="0"cellpadding="1">
<tbody>
<tr>
<td><em>/help</em> or <em>/?</em></td>
<td>Display command line help.</td>
</tr>
<tr>
<td><em>/truecrypt or /tc</em></td>
<td>Activate TrueCrypt compatibility mode which enables mounting volumes created with TrueCrypt 6.x and 7.x series.</td>
</tr>
<tr>
<td><em>/hash</em></td>
<td>It must be followed by a parameter indicating the PRF hash algorithm to use when mounting the volume. Possible values for /hash parameter are: sha256, sha-256, sha512, sha-512, whirlpool, blake2s and blake2s-256. When /hash is omitted, VeraCrypt will try
all possible PRF algorithms thus lengthening the mount operation time.</td>
</tr>
<tr>
<tdid="volume"><em>/volume</em> or <em>/v</em></td>
<td>
<p>It must be followed by a parameter indicating the file and path name of a VeraCrypt volume to mount (do not use when dismounting) or the Volume ID of the disk/partition to mount.<br>
The syntax of the volume ID is <strong>ID:XXXXXX...XX</strong> where the XX part is a 64 hexadecimal characters string that represent the 32-Bytes ID of the desired volume to mount.<br>
<br>
To mount a partition/device-hosted volume, use, for example, /v \Device\Harddisk1\Partition3 (to determine the path to a partition/device, run VeraCrypt and click
<em>Select Device</em>). You can also mount a partition or dynamic volume using its volume name (for example, /v \\?\Volume{5cceb196-48bf-46ab-ad00-70965512253a}\). To determine the volume name use e.g. mountvol.exe. Also note that device paths are case-sensitive.<br>
<br>
You can also specify the Volume ID of the partition/device-hosted volume to mount, for example: /v ID:53B9A8D59CC84264004DA8728FC8F3E2EE6C130145ABD3835695C29FD601EDCA. The Volume ID value can be retrieved using the volume properties dialog.</p>
</td>
</tr>
<tr>
<td><em>/letter</em> or <em>/l</em></td>
<td>It must be followed by a parameter indicating the driver letter to mount the volume as. When /l is omitted and when /a is used, the first free drive letter is used.</td>
</tr>
<tr>
<td><em>/explore</em> or <em>/e</em></td>
<td>Open an Explorer window after a volume has been mounted.</td>
</tr>
<tr>
<td><em>/beep</em> or <em>/b</em></td>
<td>Beep after a volume has been successfully mounted or dismounted.</td>
</tr>
<tr>
<td><em>/auto</em> or <em>/a</em></td>
<td>If no parameter is specified, automatically mount the volume. If devices is specified as the parameter (e.g., /a devices), auto-mount all currently accessible device/partition-hosted VeraCrypt volumes. If favorites is specified as the parameter, auto-mount
favorite volumes. Note that /auto is implicit if /quit and /volume are specified. If you need to prevent the application window from appearing, use /quit.</td>
</tr>
<tr>
<td><em>/dismount</em> or <em>/d</em></td>
<td>Dismount volume specified by drive letter (e.g., /d x). When no drive letter is specified, dismounts all currently mounted VeraCrypt volumes.</td>
</tr>
<tr>
<td><em>/force</em> or <em>/f</em></td>
<td>Forces dismount (if the volume to be dismounted contains files being used by the system or an application) and forces mounting in shared mode (i.e., without exclusive access).</td>
</tr>
<tr>
<td><em>/keyfile</em> or <em>/k</em></td>
<td>It must be followed by a parameter specifying a keyfile or a keyfile search path. For multiple keyfiles, specify e.g.: /k c:\keyfile1.dat /k d:\KeyfileFolder /k c:\kf2 To specify a keyfile stored on a security token or smart card, use the following syntax:
token://slot/SLOT_NUMBER/file/FILE_NAME</td>
</tr>
<trid="tryemptypass">
<td><em>/tryemptypass </em></td>
<td>ONLY when default keyfile configured or when a keyfile is specified in the command line.<br>
If it is followed by <strong>y</strong> or <strong>yes</strong> or if no parameter is specified: try to mount using an empty password and the keyfile before displaying password prompt.<br>
if it is followed by <strong>n </strong>or<strong> no</strong>: don't try to mount using an empty password and the keyfile, and display password prompt right away.</td>
</tr>
<tr>
<td><em>/nowaitdlg</em></td>
<td>If it is followed by <strong>y</strong> or <strong>yes</strong> or if no parameter is specified: don’t display the waiting dialog while performing operations like mounting volumes.<br>
If it is followed by <strong>n</strong> or <strong>no</strong>: force the display waiting dialog is displayed while performing operations.</td>
</tr>
<tr>
<td><em>/secureDesktop</em></td>
<td>If it is followed by <strong>y</strong> or <strong>yes</strong> or if no parameter is specified: display password dialog and token PIN dialog in a dedicated secure desktop to protect against certain types of attacks.<br>
If it is followed by <strong>n</strong> or <strong>no</strong>: the password dialog and token PIN dialog are displayed in the normal desktop.</td>
</tr>
<tr>
<td><em>/tokenlib</em></td>
<td>It must be followed by a parameter indicating the PKCS #11 library to use for security tokens and smart cards. (e.g.: /tokenlib c:\pkcs11lib.dll)</td>
</tr>
<tr>
<td><em>/tokenpin</em></td>
<td>It must be followed by a parameter indicating the PIN to use in order to authenticate to the security token or smart card (e.g.: /tokenpin 0000). Warning: This method of entering a smart card PIN may be insecure, for example, when an unencrypted command
prompt history log is being saved to unencrypted disk.</td>
</tr>
<tr>
<td><em>/cache</em> or <em>/c</em></td>
<td>If it is followed by <strong>y</strong> or <strong>yes</strong> or if no parameter is specified: enable password cache;
<br>
If it is followed by <strong>p </strong>or<strong> pim</strong>: enable both password and PIM cache (e.g., /c p).<br>
If it is followed by <strong>n </strong>or<strong> no</strong>: disable password cache (e.g., /c n).<br>
If it is followed by <strong>f </strong>or<strong> favorites</strong>: temporary cache password when mounting multiple favorites (e.g., /c f).<br>
Note that turning the password cache off will not clear it (use /w to clear the password cache).</td>
</tr>
<tr>
<td><em>/history</em> or <em>/h</em></td>
<td>If it is followed by <strong>y</strong> or no parameter: enables saving history of mounted volumes; if it is followed by
<strong>n</strong>: disables saving history of mounted volumes (e.g., /h n).</td>
</tr>
<tr>
<td><em>/wipecache</em> or <em>/w</em></td>
<td>Wipes any passwords cached in the driver memory.</td>
</tr>
<tr>
<td><em>/password</em> or <em>/p</em></td>
<td>It must be followed by a parameter indicating the volume password. If the password contains spaces, it must be enclosed in quotation marks (e.g., /p ”My Password”). Use /p ”” to specify an empty password.
<em>Warning: This method of entering a volume password may be insecure, for example, when an unencrypted command prompt history log is being saved to unencrypted disk.</em></td>
</tr>
<tr>
<td><em>/pim</em></td>
<td>It must be followed by a positive integer indicating the PIM (Personal Iterations Multiplier) to use for the volume.</td>
</tr>
<tr>
<td><em>/quit</em> or <em>/q</em></td>
<td>Automatically perform requested actions and exit (main VeraCrypt window will not be displayed). If preferences is specified as the parameter (e.g., /q preferences), then program settings are loaded/saved and they override settings specified on the command
line. /q background launches the VeraCrypt Background Task (tray icon) unless it is disabled in the Preferences.</td>
</tr>
<tr>
<td><em>/silent</em> or <em>/s</em></td>
<td>If /q is specified, suppresses interaction with the user (prompts, error messages, warnings, etc.). If /q is not specified, this option has no effect.</td>
</tr>
<tr>
<td><em>/mountoption</em> or <em>/m</em></td>
<td>
<p>It must be followed by a parameter which can have one of the values indicated below.</p>
<p><strong>ro</strong> or<strong> readonly</strong>: Mount volume as read-only.</p>
<p><strong>rm</strong> or <strong>removable</strong>: Mount volume as removable medium (see section
<ahref="Removable%20Medium%20Volume.html">
<em>Volume Mounted as Removable Medium</em></a>).</p>
<p><strong>ts</strong> or <strong>timestamp</strong>: Do not preserve container modification timestamp.</p>
<p><strong>sm</strong> or <strong>system</strong>: Without pre-boot authentication, mount a partition that is within the key scope of system encryption (for example, a partition located on the encrypted system drive of another operating system that is not running).
Useful e.g. for backup or repair operations. Note: If you supply a password as a parameter of /p, make sure that the password has been typed using the standard US keyboard layout (in contrast, the GUI ensures this automatically). This is required due to the
fact that the password needs to be typed in the pre-boot environment (before Windows starts) where non-US Windows keyboard layouts are not available.</p>
<p><strong>bk</strong> or <strong>headerbak</strong>: Mount volume using embedded backup header. Note: All volumes created by VeraCrypt contain an embedded backup header (located at the end of the volume).</p>
<p><strong>recovery</strong>: Do not verify any checksums stored in the volume header. This option should be used only when the volume header is damaged and the volume cannot be mounted even with the mount option headerbak. Example: /m ro</p>
<p><strong>label=LabelValue</strong>: Use the given string value <strong>LabelValue</strong> as a label of the mounted volume in Windows Explorer. The maximum length for
<strong>LabelValue </strong> is 32 characters for NTFS volumes and 11 characters for FAT volumes. For example,
<em>/m label=MyDrive</em> will set the label of the drive in Explorer to <em>MyDrive</em>.</p>
<p><strong>noattach</strong>: Only create virtual device without actually attaching the mounted volume to the selected drive letter.</p>
<p>Please note that this switch may be present several times in the command line in order to specify multiple mount options (e.g.: /m rm /m ts)</p>
</td>
</tr>
<tr>
<td><em>/DisableDeviceUpdate</em> </td>
<td>Disables periodic internel check on devices connected to the system that is used for handling favorites identified with VolumeID and replace it with on-demande checks.</td>
</tr>
<tr>
<td><em>/protectMemory</em> </td>
<td>Activates a mechanism that protects VeraCrypt process memory from being accessed by other non-admin processes.</td>
</tr>
<tr>
<td><em>/signalExit</em> </td>
<td>It must be followed by a parameter specifying the name of the signal to send to unblock a waiting <ahref="https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/waitfor"target="_blank">WAITFOR.EXE</a> command when VeraCrypt exists.<br>
The name of signal must be the same as the one specified to WAITFOR.EXE command (e.g."veracrypt.exe /q /v test.hc /l Z /signal SigName" followed by "waitfor.exe SigName"<br>
This switch is ignored if /q is not specified</td>
<td>Create a container based volume in command line mode. It must be followed by the file name of the container to be created.</td>
</tr>
<tr>
<td>/size</td>
<td>
<p>(Only with /create)<br>
It must be followed by a parameter indicating the size of the container file that will be created. This parameter is a number indicating the size in Bytes. It can have a suffixe 'K', 'M', 'G' or 'T' to indicate that the value is in Kilobytes, Megabytes, Gigabytes
or Terabytes respectively. For example:</p>
<ul>
<li>/size 5000000: the container size will be 5000000 bytes </li><li>/size 25K: the container size will be 25 KiloBytes. </li><li>/size 100M: the container size will be 100 MegaBytes. </li><li>/size 2G: the container size will be 2 GigaBytes. </li><li>/size 1T: the container size will be 1 TeraBytes. </li></ul>
</td>
</tr>
<tr>
<td> /password</td>
<td> (Only with /create)<br>
It must be followed by a parameter indicating the password of the container that will be created.</td>
</tr>
<tr>
<td> /keyfile or /k</td>
<td> (Only with /create)<br>
It must be followed by a parameter specifying a keyfile or a keyfile search path. For multiple keyfiles, specify e.g.: /k c:\keyfile1.dat /k d:\KeyfileFolder /k c:\kf2 To specify a keyfile stored on a security token or smart card, use the following syntax:
token://slot/SLOT_NUMBER/file/FILE_NAME</td>
</tr>
<tr>
<td><em>/tokenlib</em></td>
<td> (Only with /create)<br>
It must be followed by a parameter indicating the PKCS #11 library to use for security tokens and smart cards. (e.g.: /tokenlib c:\pkcs11lib.dll)</td>
</tr>
<tr>
<td><em>/tokenpin</em></td>
<td> (Only with /create)<br>
It must be followed by a parameter indicating the PIN to use in order to authenticate to the security token or smart card (e.g.: /tokenpin 0000). Warning: This method of entering a smart card PIN may be insecure, for example, when an unencrypted command
prompt history log is being saved to unencrypted disk.</td>
</tr>
<tr>
<td> <em>/hash</em></td>
<td>(Only with /create)<br>
It must be followed by a parameter indicating the PRF hash algorithm to use when creating the volume. It has the same syntax as VeraCrypt.exe.</td>
</tr>
<tr>
<td>/encryption</td>
<td>(Only with /create)<br>
It must be followed by a parameter indicating the encryption algorithm to use. The default is AES if this switch is not specified. The parameter can have the following values (case insensitive):
It must be followed by a parameter indicating the file system to use for the volume. The parameter can have the following values:
<ul>
<li>None: don't use any filesystem </li><li>FAT: format using FAT/FAT32 </li><li>NTFS: format using NTFS. Please note that in this case a UAC prompt will be displayed unless the process is run with full administrative privileges.
</li>
<li>ExFAT: format using ExFAT. This switch is available starting from Windows Vista SP1 </li>
<li>ReFS: format using ReFS. This switch is available starting from Windows 10 </li>
</ul>
</td>
</tr>
<tr>
<td>/dynamic</td>
<td>(Only with /create)<br>
It has no parameters and it indicates that the volume will be created as a dynamic volume.</td>
</tr>
<tr>
<td>/force</td>
<td>(Only with /create)<br>
It has no parameters and it indicates that overwrite will be forced without requiring user confirmation.</td>
</tr>
<tr>
<td>/silent</td>
<td>(Only with /create)<br>
It has no parameters and it indicates that no message box or dialog will be displayed to the user. If there is any error, the operation will fail silently.</td>
</tr>
<tr>
<td><em>/noisocheck</em> or <em>/n</em></td>
<td>Do not verify that VeraCrypt Rescue Disks are correctly burned. <strong>WARNING</strong>: Never attempt to use this option to facilitate the reuse of a previously created VeraCrypt Rescue Disk. Note that every time you encrypt a system partition/drive,
you must create a new VeraCrypt Rescue Disk even if you use the same password. A previously created VeraCrypt Rescue Disk cannot be reused as it was created for a different master key.</td>
</tr>
<tr>
<td>/nosizecheck</td>
<td>Don't check that the given size of the file container is smaller than the available disk free. This applies to both UI and command line.</td>
</tr>
<tr>
<td>/quick</td>
<td>Perform quick formatting of volumes instead of full formatting. This applies to both UI and command line.</td>
</tr>
<tr>
<td>/FastCreateFile</td>
<td>Use a faster but potentially insecure way to create file containers. This applies to both UI and command line.</td>
</tr>
<tr>
<td><em>/protectMemory</em> </td>
<td>Activates a mechanism that protects VeraCrypt Format process memory from being accessed by other non-admin processes.</td>
</tr>
<tr>
<td><em>/secureDesktop</em></td>
<td>If it is followed by <strong>y</strong> or <strong>yes</strong> or if no parameter is specified: display password dialog and token PIN dialog in a dedicated secure desktop to protect against certain types of attacks.<br>
If it is followed by <strong>n</strong> or <strong>no</strong>: the password dialog and token PIN dialog are displayed in the normal desktop.</td>
<p>Note that the order in which options are specified does not matter.</p>
<h4>Examples</h4>
<p>Mount the volume <em>d:\myvolume</em> as the first free drive letter, using the password prompt (the main program window will not be displayed):</p>
<p>veracrypt /q /v d:\myvolume</p>
<p>Dismount a volume mounted as the drive letter <em>X</em> (the main program window will not be displayed):</p>
<p>veracrypt /q /d x</p>
<p>Mount a volume called <em>myvolume.tc</em> using the password <em>MyPassword</em>, as the drive letter
<em>X</em>. VeraCrypt will open an explorer window and beep; mounting will be automatic:</p>
<p>veracrypt /v myvolume.tc /l x /a /p MyPassword /e /b</p>
<p>Create a 10 MB file container using the password <em>test</em> and formatted using FAT:</p>
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
<metaname="description"content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
File diff suppressed because it is too large
Load Diff
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.