Increment version to 1.24-Update3 for Linux and update Release Notes

* Revert "Linux: Fix failure to run VeraCrypt binary built for console mode on headless machines (fix issue https://github.com/veracrypt/VeraCrypt/issues/531)"

The build failure still exists for system wxGTK compiled with '--disable-gui':

```
In file included from TextUserInterface.cpp:27:
TextUserInterface.h: In member function ‘virtual bool VeraCrypt::TextUserInterface::Initialize(int&, wxChar**)’:
TextUserInterface.h:50:63: error: ‘wxAppBase’ has not been declared
   50 |   virtual bool Initialize (int &argc, wxChar **argv) { return wxAppBase::Initialize(argc, argv); }
```

This reverts commit 737e1f126b.

* Revert "Linux: fix compilation error when building console-only version of VeraCrypt that is statically linked to wxWidgets"

The build failure still exists for system wxGTK compiled with '--disable-gui':

```
In file included from TextUserInterface.cpp:27:
TextUserInterface.h: In member function ‘virtual bool VeraCrypt::TextUserInterface::Initialize(int&, wxChar**)’:
TextUserInterface.h:50:63: error: ‘wxAppBase’ has not been declared
   50 |   virtual bool Initialize (int &argc, wxChar **argv) { return wxAppBase::Initialize(argc, argv); }
```

This reverts commit 14bee5e6a2.

* src/Main/Main.make: simplify the WX_CONFIG_LIBS logic

Irrespective of whether we are linking against widgets statically or
dynamically, pull in only 'base' when GUI is disabled, and
'adv,core,base' when GUI is enabled. When GUI is disabled, the C/CXX
flag must include '-DwxUSE_GUI=0' for this to work.

* src/Makefile: pass '-DwxUSE_GUI=0' when NOGUI=1

veracrypt with NOGUI=1 fails to properly link against wxGTK compiled
with '--disable-gui' only using the 'base' library because the wx's
setup.h implicitly defines wxUSE_GUI=1, which then changes the
definition of various structures, requiring symbols from the core
library as well.

For example, wxwidgets include/wx/app.h defines:

  #if wxUSE_GUI

  class WXDLLIMPEXP_CORE wxAppBase : public wxAppConsole
  ...
  [snip]
  ...
  #else // !GUI

  // wxApp is defined in core and we cannot define another one in wxBase,
  // so use the preprocessor to allow using wxApp in console programs too
  #define wxApp wxAppConsole

  #endif // GUI/!GUI

To fix this, pass '-DwxUSE_GUI=0' when compiling veracrypt with
NOGUI=1.

Closes: https://github.com/veracrypt/VeraCrypt/issues/531

README.md

@@ -68,7 +68,7 @@ IDRIX certificate).
 Keep this in mind if you compile VeraCrypt
 and compare your binaries with the official binaries. If your binaries are
 unsigned, the sizes of the official binaries will usually be approximately
-10 KB greater than sizes of your binaries (there may be further differences
+10 KiB greater than sizes of your binaries (there may be further differences
 if you use a different version of the compiler, or if you install a different
 or no service pack for Visual Studio, or different hotfixes for it, or if you
 use different versions of the required SDKs).

Translations/Language.ar.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="ar" name="العربية" en-name="Arabic" version="0.2.0" translators="Ahmad Gharbeia, Khaled Hosny, Ali Khojah" />
     <font lang="ar" class="normal" size="11" face="default" />
     <font lang="ar" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="ar" key="IDT_BENCHMARK">مقايسة الأداء:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="ar" key="LEGACY_PASSWORD_UTF8_TOO_LONG">كلمة السر المدخلة طويلة: تمثيلها بصيغة UTF-8 يزيد عن 128 بايت.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.be.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="be" name="Беларуская" en-name="Belarusian" version="0.1.0" translators="Aleg Azarousky" />
     <font lang="be" class="normal" size="11" face="default" />
     <font lang="be" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="be" key="IDT_BENCHMARK">Тэст хуткасці:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">
@@ -1480,4 +1481,4 @@
       </xs:complexType>
     </xs:element>
   </xs:schema>
-</VeraCrypt>
+</VeraCrypt>

Translations/Language.bg.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="bg" name="Български" en-name="Bulgarian" version="0.1.0" translators="Lachezar Gorchev" />
     <font lang="bg" class="normal" size="11" face="default" />
     <font lang="bg" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="bg" key="IDT_BENCHMARK">Тест:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">
@@ -1480,4 +1481,4 @@
       </xs:complexType>
     </xs:element>
   </xs:schema>
-</VeraCrypt>
+</VeraCrypt>

Translations/Language.ca.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="ca" name="Català" en-name="Catalan" version="0.1.0" translators="CESICAT, Centre de Seguretat de la Informació de Catalunya" />
     <font lang="ca" class="normal" size="11" face="default" />
     <font lang="ca" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="ca" key="IDT_BENCHMARK">Prova de rendiment:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">
@@ -1480,4 +1481,4 @@
       </xs:complexType>
     </xs:element>
   </xs:schema>
-</VeraCrypt>
+</VeraCrypt>

Translations/Language.cs.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="cs" name="Čeština" en-name="Czech" version="1.1.0" translators="Vítek Moser, Lagardere" />
     <font lang="cs" class="normal" size="11" face="default" />
     <font lang="cs" class="bold" size="13" face="Arial" />
@@ -1433,10 +1433,11 @@
     <entry lang="cs" key="CLEAR_KEYS_ON_DEVICE_INSERTION_WARNING">DŮLEŽITÉ UPOZORNĚNÍ:\n - Mějte na paměti, že tato možnost nepřetrvá po vypnutí/restartu systému, proto ji budete muset znovu zapnout po spuštění.\n\n - Je-li tato možnost povolena a bude připojeno nové zařízení, počítač zamrzne a může přejít do BSOD, jelikož Windows nebude mít přístup k zašifrovanému disku, smažete-li klíče z paměti.\n</entry>
     <entry lang="cs" key="STARTING">Spuštění</entry>
     <entry lang="cs" key="IDC_ENABLE_CPU_RNG">Použít náhodné hardwarové generování v CPU jako dodatečný zdroj entropie</entry> 
-    <entry lang="en" key="IDC_USE_LEGACY_MAX_PASSWORD_LENGTH">Use legacy maximum password length (64 characters)</entry>
+    <entry lang="cs" key="IDC_USE_LEGACY_MAX_PASSWORD_LENGTH">Použít starou maximální délku hesla (64 znaků)</entry>
-    <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
+    <entry lang="cs" key="IDC_ENABLE_RAM_ENCRYPTION">Aktivovat šifrování klíčů a hesel uložených v paměti RAM</entry>
     <entry lang="cs" key="IDT_BENCHMARK">Test výkonu:</entry>
-    <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="cs" key="IDC_DISABLE_MOUNT_MANAGER">Vytvořit virtuální zařízení bez připojení na vybrané písmeno jednotky</entry>
+    <entry lang="cs" key="LEGACY_PASSWORD_UTF8_TOO_LONG">Zadané heslo je moc dlouhé: jeho reprezentace v UTF-8 přesahuje 64 bajtů.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.da.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="da" name="Dansk" en-name="Danish" version="0.1.0" translators="Lasse Bond" />
     <font lang="da" class="normal" size="11" face="default" />
     <font lang="da" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="en" key="IDT_BENCHMARK">Benchmark:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">
@@ -1480,4 +1481,4 @@
       </xs:complexType>
     </xs:element>
   </xs:schema>
-</VeraCrypt>
+</VeraCrypt>

Translations/Language.de.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <!-- Sprachen -->
     <language langid="de" name="Deutsch" en-name="German" version="1.1.8" translators="Harry Haller, Alexander Schorg, Simon Frankenberger, David Arndt, H. Sauer, Dulla, Ettore Atalan, Matthias Kolja Miehl, Felix Reichmann" />
     <!-- Schriftarten -->
@@ -1440,6 +1440,7 @@
     <entry lang="de" key="IDC_ENABLE_RAM_ENCRYPTION">Verschlüsselung der im Arbeitsspeicher gespeicherten Schlüssel und Passwörter aktivieren</entry>
     <entry lang="de" key="IDT_BENCHMARK">Benchmark:</entry>
     <entry lang="de" key="IDC_DISABLE_MOUNT_MANAGER">Nur virtuelles Gerät erstellen ohne Einbinden auf dem ausgewählten Laufwerksbuchstaben</entry>
+    <entry lang="de" key="LEGACY_PASSWORD_UTF8_TOO_LONG">Das eingegebene Passwort ist zu lang: Kodiert mit UTF-8 überschreitet es 64 Byte.</entry>
   </localization>
   <!-- XML-Schema -->
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">

Translations/Language.el.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="el" name="Ελληνικά" en-name="Greek" version="0.1.0" translators="Βασίλης Κοσμίδης" />
     <font lang="el" class="normal" size="11" face="default" />
     <font lang="el" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="en" key="IDT_BENCHMARK">Benchmark:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.es.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="es" name="Español" en-name="Spanish" version="1.0.0" translators="Juan Antonio Auñón Ochando" />
     <font lang="es" class="normal" size="11" face="default" />
     <font lang="es" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="es" key="IDT_BENCHMARK">Comparación:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="es" key="LEGACY_PASSWORD_UTF8_TOO_LONG">La contraseña introducida es demasiado larga: su representación en UTF-8 excede de 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.et.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="et" name="Eesti" en-name="Estonian" version="0.1.0" translators="Maiko Mõtsar" />
     <font lang="et" class="normal" size="11" face="vaikimisi" />
     <font lang="et" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="et" key="IDT_BENCHMARK">Jõudlustest:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">
@@ -1480,4 +1481,4 @@
       </xs:complexType>
     </xs:element>
   </xs:schema>
-</VeraCrypt>
+</VeraCrypt>

Translations/Language.eu.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="eu" name="Euskara" en-name="Basque" version="1.0.0" translators="Ander Genua" />
     <font lang="eu" class="normal" size="11" face="default" />
     <font lang="eu" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="eu" key="IDT_BENCHMARK">Proba-Bankua:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.fa.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="fa" name="فارسي" en-name="Persian" version="0.1.0" translators="Ali Bitazar, Rodabeh Sarmadi" />
     <font lang="fa" class="normal" size="11" face="default" />
     <font lang="fa" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="en" key="IDT_BENCHMARK">Benchmark:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">
@@ -1480,4 +1481,4 @@
       </xs:complexType>
     </xs:element>
   </xs:schema>
-</VeraCrypt>
+</VeraCrypt>

Translations/Language.fi.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
-    <language langid="fi" name="Suomi" en-name="Finnish" version="0.2.0" translators="Matti Ruhanen" />
+    <language langid="fi" name="Suomi" en-name="Finnish" version="0.3.0" translators="Matti Ruhanen" />
     <font lang="fi" class="normal" size="11" face="default" />
     <font lang="fi" class="bold" size="13" face="Arial" />
     <font lang="fi" class="fixed" size="12" face="Lucida Console" />
@@ -78,7 +78,7 @@
     <entry lang="fi" key="IDT_DRIVE_LETTER">Aseman kirjain:</entry>
     <entry lang="fi" key="IDT_ENCRYPTION_ALGO">Salausalgoritmi</entry>
     <entry lang="fi" key="IDT_FILESYSTEM">Järjestelmä </entry>
-    <entry lang="fi" key="IDT_FILE_CONTAINER">Luo virtuaalisesti salattulevy tiedoston sisälle. Tämä valinta on suositeltava aloittelijalle.</entry>
+    <entry lang="fi" key="IDT_FILE_CONTAINER">Luo virtuaalisesti salattulevy tiedoston sisään. Tämä valinta on suositeltava aloittelijalle.</entry>
     <entry lang="fi" key="IDT_FORMAT_OPTIONS">Valinnat</entry>
     <entry lang="fi" key="IDT_HASH_ALGO">Hash algoritmi</entry>
     <entry lang="fi" key="IDT_HEADER_KEY">Otsikkoavain: </entry>
@@ -111,7 +111,7 @@
     <entry lang="fi" key="IDC_BROWSE_DIRS">Selaa..</entry>
     <entry lang="fi" key="IDC_BROWSE_FILES">Selaa..</entry>
     <entry lang="fi" key="IDC_CACHE">Välimuisti salasanat ja avaintie&amp;dostot muistissa</entry>
-    <entry lang="fi" key="IDC_CLOSE_BKG_TASK_WHEN_NOVOL">Poistu sitten kun ei ole yhdistettyjä taltioita</entry>
+    <entry lang="fi" key="IDC_CLOSE_BKG_TASK_WHEN_NOVOL">Poistu, kun ei ole yhdistettyjä taltioita</entry>
     <entry lang="fi" key="IDC_CLOSE_TOKEN_SESSION_AFTER_MOUNT">&amp;Sulje näennäinen yhteys (kirjaudu ulos) kun taltio on onnistuneesti yhdistetty</entry>
     <entry lang="fi" key="IDC_COPY_EXPANDER">Sisällytä VeraCrypt Taltion Laajennin</entry>
     <entry lang="fi" key="IDC_COPY_WIZARD">Sisällytä Opastettu VeraCrypt Taltion Luonti</entry>
@@ -155,23 +155,23 @@
     <entry lang="fi" key="IDC_OLD_PIM_HELP">(Tyhjä tai 0 oletus iteraatiolle)</entry>
     <entry lang="fi" key="IDC_PIM_HELP">(Tyhjä tai 0 oletus iteraatiolle)</entry>
     <entry lang="fi" key="IDC_PREF_BKG_TASK_ENABLE">Päällä</entry>
-    <entry lang="fi" key="IDC_PREF_CACHE_PASSWORDS">Salasanat Ohjaimen Välimuistiin</entry>
+    <entry lang="fi" key="IDC_PREF_CACHE_PASSWORDS">Tallenna salasanat aseman muistiin</entry>
-    <entry lang="fi" key="IDC_PREF_DISMOUNT_INACTIVE">Automaattinen yhteyden poisto taltiolle kun dataa ei ole luettu/kirjoitettu sille</entry>
+    <entry lang="fi" key="IDC_PREF_DISMOUNT_INACTIVE">Poista taltion yhdistäminen kun dataa ei ole luettu/kirjoitettu sille</entry>
-    <entry lang="fi" key="IDC_PREF_DISMOUNT_LOGOFF">Käyttäjän ulos kirjautuessa</entry>
+    <entry lang="fi" key="IDC_PREF_DISMOUNT_LOGOFF">Käyttäjän uloskirjautuessa</entry>
-    <entry lang="fi" key="IDC_PREF_DISMOUNT_SESSION_LOCKED">Käyttäjän istunto on lukittu</entry>
+    <entry lang="fi" key="IDC_PREF_DISMOUNT_SESSION_LOCKED">Käyttäjän istunnon lukkiutuessa</entry>
     <entry lang="fi" key="IDC_PREF_DISMOUNT_POWERSAVING">Siirryttäessä Virransäästötilaan</entry>
     <entry lang="fi" key="IDC_PREF_DISMOUNT_SCREENSAVER">Näytönsäästäjän käynnistyessä</entry>
-    <entry lang="fi" key="IDC_PREF_FORCE_AUTO_DISMOUNT">Pakotettu autoyhteyden poisto vaikka taltiolla olisi avoimia tiedostoja tai hakemistoja</entry>
+    <entry lang="fi" key="IDC_PREF_FORCE_AUTO_DISMOUNT">Pakotettu autom. poiskytkentä vaikka taltiolla olisi avoimia tiedostoja tai hakemistoja</entry>
-    <entry lang="fi" key="IDC_PREF_LOGON_MOUNT_DEVICES">Yhdistä kaikki laite ohjatut VeraCrypt-taltiot</entry>
+    <entry lang="fi" key="IDC_PREF_LOGON_MOUNT_DEVICES">Yhdistä kaikki laiteohjatut VeraCrypt-taltiot</entry>
     <entry lang="fi" key="IDC_PREF_LOGON_START">Käynnistä VeraCrypt Taustatehtävä</entry>
-    <entry lang="fi" key="IDC_PREF_MOUNT_READONLY">Yhdistä taltiot vain lukutilaan</entry>
+    <entry lang="fi" key="IDC_PREF_MOUNT_READONLY">Yhdistä taltiot vain luku-tyyppisinä</entry>
-    <entry lang="fi" key="IDC_PREF_MOUNT_REMOVABLE">Yhdistä taltiot liikutettavina välineinä</entry>
+    <entry lang="fi" key="IDC_PREF_MOUNT_REMOVABLE">Yhdistä taltiot kuin liikutettavina välineinä</entry>
-    <entry lang="fi" key="IDC_PREF_OPEN_EXPLORER">Avaa Selaus ikkuna onnistuneesti yhdistetyille taltioille</entry>
+    <entry lang="fi" key="IDC_PREF_OPEN_EXPLORER">Avaa resurssienhallinta onnistuneesti yhdistetyille taltioille</entry>
-    <entry lang="fi" key="IDC_PREF_TEMP_CACHE_ON_MULTIPLE_MOUNT">Väliaikaisesti tallenna salasana välimuistin "Kytke Suosikkitaltiot" -toimintojen ajaksi</entry>
+    <entry lang="fi" key="IDC_PREF_TEMP_CACHE_ON_MULTIPLE_MOUNT">Tallenna salasana väliaikaisesti "Yhdistä Suosikkitaltiot" -toimintojen ajaksi</entry>
-    <entry lang="fi" key="IDC_PREF_USE_DIFF_TRAY_ICON_IF_VOL_MOUNTED">Käytä toista työkalupalkin kuvaketta kun täällä on kytkettyjä taltioita</entry>
+    <entry lang="fi" key="IDC_PREF_USE_DIFF_TRAY_ICON_IF_VOL_MOUNTED">Käytä erilaista työkalupalkin kuvaketta kun on yhdistettyjä taltioita</entry>
-    <entry lang="fi" key="IDC_PREF_WIPE_CACHE_ON_AUTODISMOUNT">Tyhjennä tallennetut välimuisti salasanat taltioilta auto-poiskytketyillä yhteyksillä</entry>
+    <entry lang="fi" key="IDC_PREF_WIPE_CACHE_ON_AUTODISMOUNT">Poista välimuistiin tallennetut salasanat automaattisissa poiskytkennöissä</entry>
-    <entry lang="fi" key="IDC_PREF_WIPE_CACHE_ON_EXIT">Pyyhi välimuisti salasanat poistuttaessa</entry>
+    <entry lang="fi" key="IDC_PREF_WIPE_CACHE_ON_EXIT">Pyyhi välimuistiin tallennetut salasanat poistuttaessa</entry>
-    <entry lang="fi" key="IDC_PRESERVE_TIMESTAMPS">Säilytä tiedostojen aikaleimat</entry>
+    <entry lang="fi" key="IDC_PRESERVE_TIMESTAMPS">Säilytä tiedostosäilöjen muokkausaikaleima</entry>
     <entry lang="fi" key="IDC_RESET_HOTKEYS">Tyhjennä</entry>
     <entry lang="fi" key="IDC_SELECT_DEVICE">&amp;Valitse Laite..</entry>
     <entry lang="fi" key="IDC_SELECT_FILE">Valitse T&amp;iedosto..</entry>
@@ -181,7 +181,7 @@
     <entry lang="fi" key="IDC_TRAVEL_OPEN_EXPLORER">Avaa &amp;Tutkinta Ikkuna Yhdistetyille taltioille</entry>
     <entry lang="fi" key="IDC_TRAV_CACHE_PASSWORDS">&amp;Välimuistisalasana ajurin muistille</entry>
     <entry lang="fi" key="IDC_TRUECRYPT_MODE">TrueCrypt Tila</entry>
-    <entry lang="fi" key="IDC_UNMOUNTALL">P&amp;oista Kaikki Yhteydet</entry>
+    <entry lang="fi" key="IDC_UNMOUNTALL">P&amp;oista Yhdistämiset</entry>
     <entry lang="fi" key="IDC_VOLUME_PROPERTIES">Taltion Ominaisuu&amp;det..</entry>
     <entry lang="fi" key="IDC_VOLUME_TOOLS">Taltio&amp;n Työkalut..</entry>
     <entry lang="fi" key="IDC_WIPE_CACHE">Tyhjennä &amp;Välimuisti</entry>
@@ -209,7 +209,7 @@
     <entry lang="fi" key="IDM_CHANGE_SYS_HEADER_KEY_DERIV_ALGO">Aseta Otsikko Avaimesta Periytyvä algoritmi..</entry>
     <entry lang="fi" key="IDM_CHANGE_SYS_PASSWORD">Muuta Salasana..</entry>
     <entry lang="fi" key="IDM_CLEAR_HISTORY">Tyhjennä Taltion Historia</entry>
-    <entry lang="fi" key="IDM_CLOSE_ALL_TOKEN_SESSIONS">Sulje Kaikki Turvallisuustunniste Istunnot</entry>
+    <entry lang="fi" key="IDM_CLOSE_ALL_TOKEN_SESSIONS">Sulje Kaikki Turvallisuustunnisteiden istunnot</entry>
     <entry lang="fi" key="IDM_CONTACT">Yhteydenotto..</entry>
     <entry lang="fi" key="IDM_CREATE_HIDDEN_OS">Luo Piilotettu Käyttöjärjestelmä..</entry>
     <entry lang="fi" key="IDM_CREATE_RESCUE_DISK">Luo Pelastuslevy..</entry>
@@ -243,7 +243,7 @@
     <entry lang="fi" key="IDM_REFRESH_DRIVE_LETTERS">Päivitä Asemakirjaimet</entry>
     <entry lang="fi" key="IDM_REMOVE_ALL_KEYFILES_FROM_VOL">Poista Kaikki Avaintiedostot Taltiolta..</entry>
     <entry lang="fi" key="IDM_RESTORE_VOL_HEADER">Palauta Taltion Otsikot..</entry>
-    <entry lang="fi" key="IDM_RESUME_INTERRUPTED_PROC">Jatka Keskeytetty Prosessi</entry>
+    <entry lang="fi" key="IDM_RESUME_INTERRUPTED_PROC">Jatka Keskeytynyttä Prosessia</entry>
     <entry lang="fi" key="IDM_SELECT_DEVICE">Valitse Laite..</entry>
     <entry lang="fi" key="IDM_SELECT_FILE">Valitse Tiedosto..</entry>
     <entry lang="fi" key="IDM_SYSENC_RESUME">Jatka Keskeytetty Prosessi</entry>
@@ -269,13 +269,13 @@
     <entry lang="fi" key="IDT_ACCELERATION_OPTIONS">Laitteistokiihdytin</entry>
     <entry lang="fi" key="IDT_ASSIGN_HOTKEY">Pikakuvake</entry>
     <entry lang="fi" key="IDT_AUTORUN">Automaattinen käynnistys kokoonpano (autorun.inf)</entry>
-    <entry lang="fi" key="IDT_AUTO_DISMOUNT">Automaattinen-yhteyden Poisto</entry>
+    <entry lang="fi" key="IDT_AUTO_DISMOUNT">Automaattinen Poiskytkentä</entry>
-    <entry lang="fi" key="IDT_AUTO_DISMOUNT_ON">Poista Yhteydet:</entry>
+    <entry lang="fi" key="IDT_AUTO_DISMOUNT_ON">Poista Yhdistämiset:</entry>
     <entry lang="fi" key="IDT_BOOT_LOADER_SCREEN_OPTIONS">Käynnistys Lataus Näyttö Valinnat</entry>
     <entry lang="fi" key="IDT_CONFIRM_PASSWORD">Vahvista Salasana</entry>
     <entry lang="fi" key="IDT_CURRENT">Nykyinen</entry>
     <entry lang="fi" key="IDT_CUSTOM_BOOT_LOADER_MESSAGE">Näytä tämä käyttäjän sanoma esikäynnistys autentikointi ikkunassa (Maksimi 24 merkkiä):</entry>
-    <entry lang="fi" key="IDT_DEFAULT_MOUNT_OPTIONS">Oletus yhteys valinnat</entry>
+    <entry lang="fi" key="IDT_DEFAULT_MOUNT_OPTIONS">Yhdistämisen oletusasetukset</entry>
     <entry lang="fi" key="IDT_DISMOUNT_ACTION">Pikanäppäinten Valinnat</entry>
     <entry lang="fi" key="IDT_DRIVER_OPTIONS">Aseman Asetukset</entry>
     <entry lang="fi" key="IDC_ENABLE_EXTENDED_IOCTL_SUPPORT">Ota käyttöön laajennettu levyohjauskoodit</entry>
@@ -283,7 +283,7 @@
     <entry lang="fi" key="IDT_FILE_SETTINGS">Tiedosto Asetukset</entry>
     <entry lang="fi" key="IDT_HOTKEY_KEY">Määriteltävä näppäin:</entry>
     <entry lang="fi" key="IDT_HW_AES_SUPPORTED_BY_CPU">Processori (CPU) tietokoneesi tukee AES laitteistokiihdytystä:</entry>
-    <entry lang="fi" key="IDT_LOGON">Toiminta suorittaa kirjautumisen Windowsiin</entry>
+    <entry lang="fi" key="IDT_LOGON">Toiminto suoritetaan kirjautuessa Windowsiin</entry>
     <entry lang="fi" key="IDT_MINUTES">minuuttia</entry>
     <entry lang="fi" key="IDT_MOUNT_LETTER">Yhdistä taltio kirjaimelle:</entry>
     <entry lang="fi" key="IDT_MOUNT_SETTINGS">Yhdistä asetukset</entry>
@@ -293,14 +293,14 @@
     <entry lang="fi" key="IDT_PKCS11_LIB_PATH">PKCS #11 Kirjastopolku</entry>
     <entry lang="fi" key="IDT_PKCS5_PRF">PKCS-5 PRF:</entry>
     <entry lang="fi" key="IDT_NEW_PKCS5_PRF">PKCS-5 PRF:</entry>
-    <entry lang="fi" key="IDT_PW_CACHE_OPTIONS">Salasana Välimuistiin</entry>
+    <entry lang="fi" key="IDT_PW_CACHE_OPTIONS">Salasanan Välimuisti</entry>
     <entry lang="fi" key="IDT_SECURITY_OPTIONS">Salausvalinnat</entry>
     <entry lang="fi" key="IDT_TASKBAR_ICON">VeraCrypt Taustatehtävä</entry>
     <entry lang="fi" key="IDT_TRAVELER_MOUNT">VeraCrypt-taltion yhteys (liittyy siirrettävän levyn juureen):</entry>
     <entry lang="fi" key="IDT_TRAVEL_INSERTION">Siirrettävän levyn sisällyttäminen: </entry>
     <entry lang="fi" key="IDT_TRAVEL_ROOT">Luo siirrettävä levytiedosto (Siirrettävän levyjuuri-hakemistoon):</entry>
     <entry lang="fi" key="IDT_VOLUME">Taltio</entry>
-    <entry lang="fi" key="IDT_WINDOWS_RELATED_SETTING">Ikkuna</entry>
+    <entry lang="fi" key="IDT_WINDOWS_RELATED_SETTING">Windows</entry>
     <entry lang="fi" key="IDC_ADD_KEYFILE_PATH">Lisää P&amp;olku..</entry>
     <entry lang="fi" key="IDC_AUTO">&amp;Auto-testi Kaikille</entry>
     <entry lang="fi" key="IDC_CONTINUE">&amp;Jatka</entry>
@@ -328,7 +328,7 @@
     <entry lang="fi" key="IDC_PROTECT_HIDDEN_VOL">&amp;Suojaa salattu taltio vaurioilta ulkoisten taltioiden kirjoitusta vastaan</entry>
     <entry lang="fi" key="IDC_RESET">&amp;Tyhjennä</entry>
     <entry lang="fi" key="IDC_SHOW_PASSWORD_MO">&amp;Näytä Salasana</entry>
-    <entry lang="fi" key="IDC_TOKEN_FILES_ADD">Lisää &amp;Tunniste Tie..</entry>
+    <entry lang="fi" key="IDC_TOKEN_FILES_ADD">Lisää Tunniste Tie.</entry>
     <entry lang="fi" key="IDC_USE_EMBEDDED_HEADER_BAK">Käytä varmistettua otsikko varustusta &amp;asemalle jos mahdollista</entry>
     <entry lang="fi" key="IDC_XTS_MODE_ENABLED">XTS tila</entry>
     <entry lang="fi" key="IDD_ABOUT_DLG">Tietoa VeraCrypt</entry>
@@ -427,7 +427,7 @@
     <entry lang="fi" key="DEVICE_PARTITIONS_ERR">Valittu laite sisältää osion.\n\nAlustamalla laitteen saattaa aiheutua järjestelmän epävakautta ja/tai tietojen vioittumista. Valitse joko laitteen osio, tai poista kaikki laitteen osiot, jotta VeraCrypt-salausohjelma voi alustaa sen turvallisesti.</entry>
     <entry lang="fi" key="DEVICE_PARTITIONS_ERR_W_INPLACE_ENC_NOTE">Valittu ei-järjestelmäasema sisältää osioita.\n\nSalattu laiteisännöity VeraCrypt-taltio voidaan luoda laitteen sisälle jotka eivät sisällä osioita (sisältäen kiintolevyn ja kiinteän aseman). Laite joka sisältää osion voidaan täysin salata (käyttäen yksinkertaista pääavainta) ainoastaan jos se on laite jonne Windows on asennettuna ja josta se myös käynnistyy.\n\nJos haluat salata valitun ei-järjestelmälaitteen käyttäen yksinkertaista pääavainta, sinun tulee poistaa ensin kaikki osiot laitteelta mahdollistaaksesi VeraCrypt-salausohjelman alustaa se turvallisesti (alustaaksesi laitteen, joka sisältää osioita saattaa johtaa järjestelmän epävakauteen ja/tai tietojen korruptoitumiseen). Vaihtoehtoisesti, voit salata jokaisen osion laitteelta yksilöllisesti (jokainen osio salataan käyttäen erilaista pääavainta).\n\nHuomioi: Jos haluat poistaa kaikki osiot GPT levyltä, sinun saattaa tarvita muuntaa MBR levy (käyttäen esim. Computer Management työkalua) poistaaksesi piilotetun osion.</entry>
     <entry lang="fi" key="WHOLE_NONSYS_DEVICE_ENC_CONFIRM">Varoitus: Jos salaat koko laitteen (sen sijaan, että salaat vain sen osiota), käyttöjärjestelmät pitävät laitetta uutena, tyhjänä ja muotoilemattomana (koska se ei sisällä ositustaulukkoa) ja voi käynnistää laitteen spontaanisti (tai kysyä, haluatko tehdä sen), mikä voi vahingoittaa taltiota. Liäksi ei ole mahdollista jatkuvasti kytkeä taltiota suosikkina (esim. kun aseman numero muuttuu) tai määrittää sille suosikkitaltion otsikon.\n\nVälttääksesi tämän voit haluta keskittyä luomaan osion laitteelle ja salaamaan sen sijaan osion.\n\nOletko varma, että haluat salata koko laitteen?</entry>
-    <entry lang="fi" key="AFTER_FORMAT_DRIVE_LETTER_WARN">TÄRKEÄÄ: Muista että tätä taltiota EI voida kytkeä/käyttää käyttämällä asemakirjainta %c:, mikä sille on nykyisellään määritelty!\n\nKytkeäksesi taltion, paina 'Autoyhdistä Laitteet' VeraCrypt-salausohjelman pääikkunassa (vaihtoehtona, VeraCrypt pääikkunassa, paina 'Valitse Laite', ja sitten valitse osio/laite, ja paina 'Yhdistä Laite'). Taltio kytketään eri kirjaimelle, jonka valitsit VeraCrypt pääikkunan listalta.\n\nAlkuperäinen kirjain %c: tulee käyttää vain siinä tapauksessa, että sinun tarvitsee poistaa salauksen osiolta/laitteelta (esim., jos et tarvitse enää salausta). Siinä tapauksessa, paina hiiren oikealla asemakirjainta %c: 'Tietokone' (tai 'My Computer') listalta ja valitse 'Alusta'. Muutoin, asemakirjainta %c: ei tule koskaan käyttää (paitsi jos poistat sen ja uudelleen määrittelet toiselle kirjaimelle osion/laitteen).</entry>
+    <entry lang="fi" key="AFTER_FORMAT_DRIVE_LETTER_WARN">TÄRKEÄÄ: Muista että tätä taltiota EI voida kytkeä/käyttää käyttämällä asemakirjainta %c:, mikä sille on nykyisellään määritelty!\n\nKytkeäksesi taltion, paina 'Autoyhdistä Laitteet' VeraCrypt-salausohjelman pääikkunassa (vaihtoehtona, VeraCrypt pääikkunassa, paina 'Valitse Laite', ja sitten valitse osio/laite, ja paina 'Yhdistä'). Taltio kytketään eri kirjaimelle, jonka valitsit VeraCrypt pääikkunan listalta.\n\nAlkuperäinen kirjain %c: tulee käyttää vain siinä tapauksessa, että sinun tarvitsee poistaa salauksen osiolta/laitteelta (esim., jos et tarvitse enää salausta). Siinä tapauksessa, paina hiiren oikealla asemakirjainta %c: 'Tietokone' (tai 'My Computer') listalta ja valitse 'Alusta'. Muutoin, asemakirjainta %c: ei tule koskaan käyttää (paitsi jos poistat sen ja uudelleen määrittelet toiselle kirjaimelle osion/laitteen).</entry>
     <entry lang="fi" key="OS_NOT_SUPPORTED_FOR_NONSYS_INPLACE_ENC">Paikallisen ei-järjestelmäaseman salausta ei ole tuettu käyttöjärjestelmässäsi (tuettuna ovat ainoastaan Windows Vista ja myöhemmät Windows versiot).\n\nSyy tähän on se ettei Windows tue tiedostojärjestelmän kutistusta (järjestelmäosio tarvitsee kutistaa tehdäkseen tilaa asemaotsikolle ja varmuustallennukselle).</entry>
     <entry lang="fi" key="ONLY_NTFS_SUPPORTED_FOR_NONSYS_INPLACE_ENC">Valittu osio ei sisällä NTFS tiedostojärjestelmää. Ainoastaan osiot jotka sisältävät NTFS tiedostojärjestelmän voidaan salata paikallaan.\n\nHuomio: Syy tähän on se, että Windows ei tue kutistamista toisentyyppisillä tiedostojärjestelmillä (tiedostojärjestelmä täytyy kutistaa tehdäkseen tilaa taltion otsikoille ja varmuustallentamiseksi).</entry>
     <entry lang="fi" key="ONLY_MOUNTED_VOL_SUPPORTED_FOR_NONSYS_INPLACE_ENC">Valittu osio ei sisällä NTFS tiedostojärjestelmää. Ainoastaan osiot jotka sisältävät NTFS tiedostojärjestelmän voidaan salata paikallaan.\n\nJos haluat luoda salatun VeraCrypt-taltion tälle osiolle, valitse "Luo salattu taltio ja alusta se" (sen sijaan kuin valinta "Salaa osio paikallaan").</entry>
@@ -450,7 +450,7 @@
     <entry lang="fi" key="ERR_CIPHER_INIT_WEAK_KEY">Virhe: Heikko tai mahdollinen heikko avain on havaittu. Avain hylätty. Yritä uudelleen.</entry>
     <entry lang="fi" key="EXCEPTION_REPORT">Kriittinen virhe on tapahtunut ja VeraCrypt täytyy keskeyttää. Jos tämä johtui virheestä VeraCrypt-ohjelmassa, haluaisimme korjata sen. Auttaaksesi meitä, voit lähettää automaattisesti generoidun raportin mikä sisältää seuraavat asiat:\n\n- Ohjelma versio\n- Käyttöjärjestelmäverso\n- CPU tyyppi\n- VeraCrypt-komponentin nimi\n- Tarkistussumma tiedot VeraCrypt-salausohjelmasta\n- Symbolinen dialogi-ikkunan nimi\n- Virhe kategoria\n- Virhe osoite\n- VeraCrypt kutsupino\n\nJos valitsit 'Kyllä', seuraava URL (sisältää virheraportin) avataan oletusselaimessasi.\n\n%hs\n\nHaluatko lähettää meille oheisen virheraportin?</entry>
     <entry lang="fi" key="EXCEPTION_REPORT_EXT">Kriittinen virhe tapahtunut järjestelmässäsi, mikä vaatii VeraCrypt-ohjelman keskeyttämisen.\n\nHuomioi, että tämä virhe ei ole tapahtunut johtuen VeraCrypt-ohjelmasta (siksi VeraCryptin kehittäjät eivät voi sitä korjata). Ole hyvä ja tarkista järjestelmäsi mahdollisten ongelmien johdosta  (esim. järjestelmä asetukset, verkkoyhteys, vioittuneet järjestelmän osat).</entry>
-    <entry lang="fi" key="EXCEPTION_REPORT_EXT_FILESEL"Järjestelmässäsi on tapahtunut kriittinen virhe, mikä edellyttää VeraCryptin lopettamista.\n\nJos tämä ongelma jatkuu, voit yrittää poistaa sen käytöstä tai poistaa järjestelmästä sovelluksia, jotka saattavat aiheuttaa tämän ongelman, kuten virustentorjuntaohjelmiston tai Internet-tietoturvaohjelmiston, järjestelmän "tehostajat", "optimoijat" tai "tweakers" jne. Jos tämä ei auta, voit yrittää asentaa käyttöjärjestelmäsi uudelleen (tämä ongelma saattaa johtua myös haittaohjelmista).</entry>
+    <entry lang="fi" key="EXCEPTION_REPORT_EXT_FILESEL">Järjestelmässäsi on tapahtunut kriittinen virhe, mikä edellyttää VeraCryptin lopettamista.\n\nJos tämä ongelma jatkuu, voit yrittää poistaa sen käytöstä tai poistaa järjestelmästä sovelluksia, jotka saattavat aiheuttaa tämän ongelman, kuten virustentorjuntaohjelmiston tai Internet-tietoturvaohjelmiston, järjestelmän "tehostajat", "optimoijat" tai "tweakers" jne. Jos tämä ei auta, voit yrittää asentaa käyttöjärjestelmäsi uudelleen (tämä ongelma saattaa johtua myös haittaohjelmista).</entry>
     <entry lang="fi" key="EXCEPTION_REPORT_TITLE">VeraCrypt-salausohjelman Kriittinen Virhe</entry>
     <entry lang="fi" key="SYSTEM_CRASHED_ASK_REPORT">VeraCryp havaitsi, että käyttöjärjestelmäsi kaatui äskettäin. On monia syitä, miksi näin on voinut käydä (esim. virheellinen laitteistokomponentti, vika laiteohjaimessa jne.)\n\nHaluatko VeraCrypt:n tarkistavan, mistä tämä vika olisi voinut johtua?</entry>
     <entry lang="fi" key="ASK_KEEP_DETECTING_SYSTEM_CRASH">Haluatko, että VeraCrypt jatkaa havaitsemaan järjestelmän kaatumiset?</entry>
@@ -505,7 +505,7 @@
     <entry lang="fi" key="SYSENC_HIDDEN_VOL_FORMAT_FINISHED_HELP">\n\nPiilotettu VeraCrypt-taltio on luotu onnistuneesti (piilotettu käyttöjärjestelmä sijaitsee tämän Piilotetun VeraCrypt taltion sisällä).\n\nPaina 'Seuraava' jatkaaksesi.</entry>
     <entry lang="fi" key="NONSYS_INPLACE_ENC_FINISHED_TITLE">Taltio Kokonaan Salattu</entry>
     <entry lang="fi" key="NONSYS_INPLACE_DEC_FINISHED_TITLE">Taltio Kokonaan Purettu</entry>
-    <entry lang="fi" key="NONSYS_INPLACE_ENC_FINISHED_INFO">TÄRKEÄÄ: KYTKEÄKSESI TÄMÄN UUDEN LUODUN VERACRYPT TALTION JA PÄÄSY TALLENTAMAAN SILLE, PAINA 'Autoyhdistä Laitteet' VERACRYPT PÄÄIKKUNASSA. Sen jälkeen kun annat oikean salasanan (ja/tai toimitat oikean avaintiedoston), taltio yhdistetään asemakirjaimelle jonka valitsit VeraCrypt-ohjelman pääikkunasta (ja sinun on mahdollista päästä salatuille tiedolle valitun asemakirjaimen kautta).\n\nMUISTA TAI KIRJOITA YLöS ALLA OLEVAT VAIHEET. SINUN TULLE SEURATA NIITÄ AINA KUN HALUAT YHDISTÄÄ TALTION JA PÄÄSTÄ KIINNI TALLENNETTUIHIN TIETOIHIN. Vaihtoehtoisesti, VeraCryptin pääikkunasta, paina 'Valitse Laite', ja sitten valitse osio/taltio, ja paina 'Yhdistä'.\n\nOsio/taltio on onnistuneesti salattu (se sisältää nyt täysin salatun VeraCrypt-taltion) ja on valmis käytettäväksi.</entry>
+    <entry lang="fi" key="NONSYS_INPLACE_ENC_FINISHED_INFO">TÄRKEÄÄ: KYTKEÄKSESI TÄMÄN UUDEN LUODUN VERACRYPT TALTION JA PÄÄSY TALLENTAMAAN SILLE, PAINA 'Autom. yhdistäminen' VERACRYPT PÄÄIKKUNASSA. Sen jälkeen kun annat oikean salasanan (ja/tai toimitat oikean avaintiedoston), taltio yhdistetään asemakirjaimelle jonka valitsit VeraCrypt-ohjelman pääikkunasta (ja sinun on mahdollista päästä salatuille tiedolle valitun asemakirjaimen kautta).\n\nMUISTA TAI KIRJOITA YLöS ALLA OLEVAT VAIHEET. SINUN TULLE SEURATA NIITÄ AINA KUN HALUAT YHDISTÄÄ TALTION JA PÄÄSTÄ KIINNI TALLENNETTUIHIN TIETOIHIN. Vaihtoehtoisesti, VeraCryptin pääikkunasta, paina 'Valitse Laite', ja sitten valitse osio/taltio, ja paina 'Yhdistä'.\n\nOsio/taltio on onnistuneesti salattu (se sisältää nyt täysin salatun VeraCrypt-taltion) ja on valmis käytettäväksi.</entry>
     <entry lang="fi" key="NONSYS_INPLACE_DEC_FINISHED_INFO">VeraCryptin taltio on onnistuneesti purettu.</entry>
     <entry lang="fi" key="NONSYS_INPLACE_DEC_FINISHED_DRIVE_LETTER_SEL_INFO">VeraCryptin taltio on poistettu onnistuneesti.\n\nValitse aseman kirjain, jonka haluat määrittää salauksen purkamiseen, ja valitse sitten Valmis.\n\nHyödyllinen: Ennen kuin salakirjoituskirjaan on merkitty salaustaltioon, et pysty käyttämään taltiolle tallennettuja tietoja.</entry>
     <entry lang="fi" key="NONSYS_INPLACE_DEC_FINISHED_NO_DRIVE_LETTER_AVAILABLE">Varoitus: Jotta voit käyttää salakirjoitettua dataa, salakirjoitetulle taltiolle on määritettävä aseman kirjain.\n\nKäytä aseman kirjainta (esimerkiksi irrottamalla USB-muistitikku tai ulkoinen kiintolevy jne.) ja paina OK.</entry>
@@ -566,7 +566,7 @@
     <entry lang="fi" key="MAX_HIDVOL_SIZE_TB">Suurin mahdollinen piilotettu taltion koko tälle taltiolle on %.2f Tt.</entry>
     <entry lang="fi" key="MOUNTED_NOPWCHANGE">Taltion salasanaa/avaintiedostoa ei voida muuttaa kun taltio on yhdistettynä. Poista yhteys taltiolta.</entry>
     <entry lang="fi" key="MOUNTED_NO_PKCS5_PRF_CHANGE">Otsikkoavaimen periytyvää algoritmia ei voida muuttaa kun taltio on yhdistettynä. Poista yhteys taltiolta.</entry>
-    <entry lang="fi" key="MOUNT_BUTTON">Y&amp;hdistä Laite</entry>
+    <entry lang="fi" key="MOUNT_BUTTON">Y&amp;hdistä</entry>
     <entry lang="fi" key="NEW_VERSION_REQUIRED">Uusi VeraCrypt-ohjelman versio vaaditaan, jotta tämän taltion yhdistäminen on mahdollista.</entry>
     <entry lang="fi" key="VOL_CREATION_WIZARD_NOT_FOUND">Virhe: Taltion Luonnin Ohjattuatoimintoa ei löydetty.\n\nOle hyvä ja varmista, että tiedosto 'VeraCrypt Format.exe' on hakemistossa missä 'VeraCrypt.exe' on perustettu. Jos se ei ole, asenna uudelleen VeraCrypt-ohjelma, tai määritä 'VeraCrypt Format.exe' levylläsi ja aja se.</entry>
     <entry lang="fi" key="VOL_EXPANDER_NOT_FOUND">Virhe: Taltion Laajenninta ei löytynyt.\n\nOle hyvä ja varmista, että tiedosto 'VeraCryptExpander.exe' on samassa hakemistossa 'VeraCrypt.exe' kanssa. Jos se ei ole, ole hyvä ja asenna uudelleen VeraCrypt, tai paikallista 'VeraCryptExpander.exe' levylläsi ja suorita se.</entry>
@@ -1009,9 +1009,9 @@
     <entry lang="fi" key="HK_AUTOMOUNT_DEVICES">Automaattinen yhdistäminen laitteille</entry>
     <entry lang="fi" key="HK_DISMOUNT_ALL">Poista kaikki yhteydet</entry>
     <entry lang="fi" key="HK_WIPE_CACHE">Tyhjennä välimuisti</entry>
-    <entry lang="fi" key="HK_DISMOUNT_ALL_AND_WIPE">Poista Kaikki yhteydet  &amp;  Tyhjennä välimuisti</entry>
+    <entry lang="fi" key="HK_DISMOUNT_ALL_AND_WIPE">Poista Kaikki Yhistämiset &amp; Tyhjennä välimuisti</entry>
-    <entry lang="fi" key="HK_FORCE_DISMOUNT_ALL_AND_WIPE">Pakotettu yhteyden poisto kaikille  &amp;  Tyhjennä välimuisti</entry>
+    <entry lang="fi" key="HK_FORCE_DISMOUNT_ALL_AND_WIPE">Pakotettu yhdistämisen poisto kaikille  &amp;  Tyhjennä välimuisti</entry>
-    <entry lang="fi" key="HK_FORCE_DISMOUNT_ALL_AND_WIPE_AND_EXIT">Pakotettu yhteyden poisto kaikille,  Tyhjennä välimuisti  &amp;  Poistu</entry>
+    <entry lang="fi" key="HK_FORCE_DISMOUNT_ALL_AND_WIPE_AND_EXIT">Pakotettu yhdistämisen poisto kaikille,  Tyhjennä välimuisti  &amp;  Poistu</entry>
     <entry lang="fi" key="HK_MOUNT_FAVORITE_VOLUMES">Yhdistä Suosikkitaltiot</entry>
     <entry lang="fi" key="HK_SHOW_HIDE_MAIN_WINDOW">Näytä/Piilota VeraCrypt pääikkuna</entry>
     <entry lang="fi" key="PRESS_A_KEY_TO_ASSIGN">(Klikkaa tästä ja Paina näppäintä)</entry>
@@ -1029,7 +1029,7 @@
     <entry lang="fi" key="SUCCESSFULLY_DISMOUNTED">Onnistuneesti poiskytketty</entry>
     <entry lang="fi" key="CONFIRM_BACKGROUND_TASK_DISABLED">VAROITUS: Jos VeraCrypt Taustatoiminto on poistettu käytöstä, seuraavat toiminnot poistetaan käytöstä:\n\n1) Pikanäppäimet\n2) Automaattinen poiskytkentä (esim. kun kirjauduttu, tahattoman vastaanottavan laitteen poistaminen, aikakatkaisu jne.)\n3 ) Suosikkitaltion automaattinen kytkentä\n4) Ilmoitukset (esim. kun Piilotetun VeraCrypt taltion vauriot on estetty)\n5) Lokeron kuvake\n\nHuom: voit sulkea Tausta toiminnon milloin tahansa napsauttamalla VeraCrypt-kuvaketta hiiren oikealla kakkospainikkeella ja valitsemalla 'Poistu'.\n\nHaluat varmasti poistaa pysyvästi VeraCrypt-ohjelman Tausta-toiminnon käytöstä?</entry>
     <entry lang="fi" key="CONFIRM_NO_FORCED_AUTODISMOUNT">VAROITUS: Jos tämä valinta poistetaan, taltiot jotka sisältävät avoimia tiedostoja/hakemistoja ei voida automaattisesti poistaa yhteyttä.\n\nOletko varma, että haluat poistaa tämän valinnan?</entry>
-    <entry lang="fi" key="WARN_PREF_AUTO_DISMOUNT">VAROITUS: Taltiot sisältää avattuja tiedostoja/hakemistoja joita EI voida automaattisesti poistaa yhteyttä.\n\nEstääksesi tämän, valitse seuraava vaihtoehto dialogi ikkunasta: 'Pakotettu auto-yhteyden poisto vaikka taltiolla on avoimia tiedostoja/hakemistoja'</entry>
+    <entry lang="fi" key="WARN_PREF_AUTO_DISMOUNT">VAROITUS: Taltiot sisältää avattuja tiedostoja/hakemistoja joita EI voida automaattisesti poistaa yhteyttä.\n\nEstääksesi tämän, valitse seuraava vaihtoehto dialogi ikkunasta: 'Pakotettu autom. yhdistämisen poisto vaikka taltiolla olisi avoimia tiedostoja/hakemistoja'</entry>
     <entry lang="fi" key="WARN_PREF_AUTO_DISMOUNT_ON_POWER">VAROITUS: Kun kannettavan akun virta on alhainen, Windows saattaa jättää lähettämättä tarkoituksenmukaista viestiä suoritettavalta sovellukselta, kun tietokone asettuu virransäästö tilaan. Siksi, VeraCrypt-ohjelma saattaa epäonnistua taltion auto-poiskytkennässä näissä tapauksissa.</entry>
     <entry lang="fi" key="NONSYS_INPLACE_ENC_RESUME_PROMPT">Olet ajastanut salausprosessin osiolle/taltiolle. Prosessi ei ole vielä suoritettu loppuun.\n\nHaluatko aloittaa nyt uudelleen prosessin?</entry>
     <entry lang="fi" key="SYSTEM_ENCRYPTION_RESUME_PROMPT">Olet ajastanut salaus/salauksenpurku järjestelmälevyllä/asemalla. Ajo ei ole vielä valmis.\n\nHaluatko käynnistää (alkaa uudelleen) ajon nyt?</entry>
@@ -1137,7 +1137,7 @@
     <entry lang="fi" key="WIPE_MODE_256">256-läpi</entry>
     <entry lang="fi" key="SYS_MULTI_BOOT_MODE_TITLE">Käyttöjärjestelmän numero</entry>
     <entry lang="fi" key="MULTI_BOOT_FOR_ADVANCED_ONLY">VAROITUS: Aloittelevan käyttäjän ei koskaan pidä yrittää salata Windows monikäynnistys (multi-boot) konfiguraatioita.\n\nJatkatko?</entry>
-    <entry lang="fi" key="HIDDEN_OS_MULTI_BOOT"Piilotettua käyttöjärjestelmää luotaessa/käytettäessä VeraCrypt-ohjelma tukee usean käynnistyksen konfiguraatiota vain, kun seuraavat ehdot täyttyvät:\n\n- Käynnissä oleva käyttöjärjestelmä on asennettava käynnistysasemaan, joka ei saa sisältää muita käyttöjärjestelmiä.\n\n - Muissa asemissa asennettuihin käyttöjärjestelmiin ei saa käyttää käynnistyslatainta, joka sijaitsee asemalla, johon tällä hetkellä käynnissä oleva käyttöjärjestelmä on asennettu.\n\nOnko edellä mainitut edellytykset täyttyneet?</entry>
+    <entry lang="fi" key="HIDDEN_OS_MULTI_BOOT">Piilotettua käyttöjärjestelmää luotaessa/käytettäessä VeraCrypt-ohjelma tukee usean käynnistyksen konfiguraatiota vain, kun seuraavat ehdot täyttyvät:\n\n- Käynnissä oleva käyttöjärjestelmä on asennettava käynnistysasemaan, joka ei saa sisältää muita käyttöjärjestelmiä.\n\n - Muissa asemissa asennettuihin käyttöjärjestelmiin ei saa käyttää käynnistyslatainta, joka sijaitsee asemalla, johon tällä hetkellä käynnissä oleva käyttöjärjestelmä on asennettu.\n\nOnko edellä mainitut edellytykset täyttyneet?</entry>
     <entry lang="fi" key="UNSUPPORTED_HIDDEN_OS_MULTI_BOOT_CFG">VeraCrypt-ohjelma ei tue tätä monikäynnistys (multi-boot) konfiguraatiota piilotetun käyttöjärjestelmän luomisen tai käytön aikana.</entry>
     <entry lang="fi" key="SYSENC_MULTI_BOOT_SYS_EQ_BOOT_TITLE">käynnistysasema</entry>
     <entry lang="fi" key="SYSENC_MULTI_BOOT_SYS_EQ_BOOT_HELP">Onko nykyinen käytössä oleva käyttöjärjestelmä asennettuna käynnistysasemalle?\n\nTiedotus: Joskus Windows ei ole asennettu samalle asemalle kuin käynnistyslataaja (käynnistys osiolle). Tässä tapauksessa valitse 'Ei'.</entry>
@@ -1335,11 +1335,11 @@
     <entry lang="fi" key="VKEY_90">Num Lock</entry>
     <entry lang="fi" key="VKEY_91">Scroll Lock</entry>
     <entry lang="fi" key="VKEY_A6">Selaa Takaisin</entry>
-    <entry lang="fi" key="VKEY_A7">Selaa eteenpäin</entry>
+    <entry lang="fi" key="VKEY_A7">Selaa Eteenpäin</entry>
     <entry lang="fi" key="VKEY_A8">Päivitä selaus</entry>
     <entry lang="fi" key="VKEY_A9">Pysäytä selaus</entry>
     <entry lang="fi" key="VKEY_AA">Selaa Etsi</entry>
-    <entry lang="fi" key="VKEY_AB">Selaa suosikit</entry>
+    <entry lang="fi" key="VKEY_AB">Selaa Suosikit</entry>
     <entry lang="fi" key="VKEY_AC">Selaa Home</entry>
     <entry lang="fi" key="VKEY_AD">Mykistä</entry>
     <entry lang="fi" key="VKEY_AE">Hiljennä</entry>
@@ -1376,8 +1376,8 @@
     <entry lang="fi" key="PB_PER_SEC">Pt/s</entry>
     <entry lang="fi" key="TRIPLE_DOT_GLYPH_ELLIPSIS">…</entry>
     <entry lang="fi" key="IDC_BOOT_LOADER_CACHE_PIM">Sisällytä &amp;PIM-asetusta, kun tallennat esi-käynnistys tunnistus salasanan</entry>
-    <entry lang="fi" key="IDC_PREF_CACHE_PIM">Sisällytä PIM kun tallennat välimuistiin salasanan</entry>
+    <entry lang="fi" key="IDC_PREF_CACHE_PIM">Sisällytä PIM tallennettaessa salasana välimuistiin</entry>
-    <entry lang="fi" key="IDC_SHOW_DISCONNECTED_NETWORK_DRIVES">Tee irrotettavat verkkoasemat mahdollisiksi kytkemiselle</entry>
+    <entry lang="fi" key="IDC_SHOW_DISCONNECTED_NETWORK_DRIVES">Tee irrotetut verkkoajurit mahdollisiksi kytkemiselle</entry>
     <entry lang="fi" key="PASSWORD_UTF8_TOO_LONG">Syötetty salasana on liian pitkä: sen UTF-8-esitys ylittää 128 tavua.</entry>
     <entry lang="fi" key="PASSWORD_UTF8_INVALID">Syötetty salasana sisältää Unicode-merkkejä, joita ei voitu muuntaa UTF-8-esitykseksi.</entry>
     <entry lang="fi" key="INIT_DLL">Virhe: järjestelmän kirjaston lataaminen epäonnistui.</entry>
@@ -1389,11 +1389,11 @@
     <entry lang="fi" key="VOLUME_ID_INVALID">Volume ID -arvo on virheellinen</entry>
     <entry lang="fi" key="VOLUME_ID_NOT_FOUND">Järjestelmässä ei löytynyt taltiota, jossa olisi määritetty tunnus</entry>
     <entry lang="fi" key="IDPM_COPY_VALUE_TO_CLIPBOARD">Kopioi Arvo Leikepöydälle...</entry>
-    <entry lang="fi" key="IDC_DISABLE_BOOT_LOADER_PIM_PROMPT">Älä pyydä PIM: tä esi-käynnistys autentikointi näytöä (PIM-arvo tallennetaan salaamattomana levylle)</entry>
+    <entry lang="fi" key="IDC_DISABLE_BOOT_LOADER_PIM_PROMPT">Älä pyydä PIM:iä esi-käynnistys autentikointinäyttöä (PIM-arvo tallennetaan salaamattomana levylle)</entry>
     <entry lang="fi" key="DISABLE_BOOT_LOADER_PIM_PROMPT">VAROITUS: Muista, että jos otat tämän vaihtoehdon käyttöön, PIM-arvo tallennetaan salaamattomana levylle.\n\nHaluat varmasti ottaa tämän asetuksen käyttöön?</entry>
     <entry lang="fi" key="PIM_TOO_BIG">Personal Iterations Multiplier (PIM) maksimi arvo on 2147468.</entry>
     <entry lang="fi" key="IDC_SKIP_RESCUE_VERIFICATION">Ohita Pelastuslevyn varmistaminen</entry>
-    <entry lang="fi" key="IDC_HIDE_WAITING_DIALOG">Älä näytä odotusviestiasetuksia suoritettaessa toimintoja</entry>
+    <entry lang="fi" key="IDC_HIDE_WAITING_DIALOG">Älä näytä odotusviesti-ikkunaa toimintoja suoritettaessa</entry>
     <entry lang="fi" key="IDC_DISABLE_BOOT_LOADER_HASH_PROMPT">Älä pyydä Hash-algoritmia ennen esi-käynnistyksen autentikointi näyttöä</entry>
     <entry lang="fi" key="KUZNYECHIK_HELP">Kuznyechik on lohkosekvenssi julkaistu ensimmäisen kerran vuonna 2015 ja määritelty Venäjän federaation kansallisessa standardissa GOST R 34.12-2015 ja myös RFC 7801: ssä. 256-bittinen avain, 128-bittinen lohko. Toimintatapa on XTS.</entry>
     <entry lang="fi" key="CAMELLIA_HELP">Mitsubishi Electric ja Japanin NTT ovat yhdessä kehittäneet. Julkaistu ensimmäisen kerran vuonna 2000. 256-bittinen avain, 128-bittinen lohko. Toimintatapa on XTS. Se on hyväksytty käytettäväksi ISO/IEC:n, Euroopan unionin NESSIE-hankkeen ja japanilaisen CRYPTREC-projektin käytössä.</entry>
@@ -1407,7 +1407,7 @@
     <entry lang="fi" key="RESCUE_DISK_EFI_CHECK_FAILED">Varmista, että Pelastuslevy on poistettu oikein.\n\nJos olet purkanut Pelastuslevyn -levykuvan, irrota USB-tikku ja asenna se uudelleen. Yritä uudelleen valitsemalla 'Seuraava'. Jos tämä ei auta, kokeile toista USB-muistitikkua ja/tai muuta ZIP-ohjelmistoa.\n\nJos et ole vielä purkanut Pelastuslevyn -ohjelmaa, valitse se ja valitse sitten 'Seuraava'.\n\nJos yritit tarkistaa VeraCryptin Pelastuslevyn, joka on luotu ennen ohjatun toiminnon aloittamista, huomaa, että tällaista pelastuslevyä ei voida käyttää, koska se on luotu toista pääavainta varten. Sinun täytyy purkaa vasta tehdyn Pelastuslevyn ZIP -levykuva.</entry>
     <entry lang="fi" key="RESCUE_DISK_EFI_NON_WIZARD_CHECK_FAILED">Varmista, että Pelastuslevy on poistettu oikein.\n\nJos olet levittänyt Pelastuslevyn -kuvan USB-muistitikulle, irrota se ja aseta se takaisin paikalleen; yritä uudelleen. Jos tämä ei auta, kokeile muita ZIP-ohjelmistoja ja/tai tietovälineitä.\n\nJos yritit tarkistaa eri pääavain, salasana, suola jne. Varten luotu VeraCryptin Pelastuslevy, huomaa, että tällainen pelastuslevy on aina epäonnistuta tätä tarkistusta. Jos haluat luoda uuden Pelastuslevyn, joka on täysin yhteensopiva nykyisen kokoonpanon kanssa, valitse 'Järjestelmä'> 'Luo Pelastuslevy'.</entry>
     <entry lang="fi" key="RESCUE_DISK_EFI_NON_WIZARD_CREATION">Pelastuslevy -levykuva on luotu ja tallennettu tähän tiedostoon:\n%s\n\nJoten sinun on purettava Pelastuslevy -levykuva USB-muistille, joka on alustettu FAT/FAT32:ksi.\n\nVAROITUS: Huomaa, että zip tiedosto on purettava suoraan USB-tikun juureen. Esimerkiksi jos USB-muistin aseman kirjain on E: purkamalla zip-tiedoston, sen on luotava kansio E:\\EFI USB-muistitikulle.\n\nJos olet luonut Pelastuslevyn, valitse 'Järjestelmä'> 'Vahvista Pelastuslevy' varmistaaksesi, että se on luotu oikein.</entry>
-    <entry lang="fi" key="IDC_SECURE_DESKTOP_PASSWORD_ENTRY">Käytä Secure Desktopia salasanojen syöttämiseen</entry>
+    <entry lang="fi" key="IDC_SECURE_DESKTOP_PASSWORD_ENTRY">Käytä salasanaa suojatulle työpöydälle</entry>
     <entry lang="fi" key="ERR_REFS_INVALID_VOLUME_SIZE">Komentorivin määrittämä tiedostokoko ei ole yhteensopiva valitun ReFS-tiedostojärjestelmän kanssa.</entry>
     <entry lang="fi" key="IDC_EDIT_DCSPROP">Muokkaa käynnistyslataajan kokoonpanoa</entry>
     <entry lang="fi" key="IDC_SHOW_PLATFORMINFO">Näytä EFI Platform -tiedot</entry>
@@ -1424,19 +1424,20 @@
     <entry lang="fi" key="PASSWORD_PASTED_TRUNCATED">Liitetty teksti katkaistaan, koska salasanan enimmäispituus on 128 merkkiä</entry>
     <entry lang="fi" key="PASSWORD_MAXLENGTH_REACHED">Salasanan enimmäispituus on 128 merkkiä.\nErikoismerkkejä ei sallittu.</entry>
     <entry lang="fi" key="IDC_SELECT_LANGUAGE_LABEL">Valitse asentamisen aikana käytettävä kieli:</entry>
-    <entry lang="fi" key="VOLUME_TOO_LARGE_FOR_HOST">VIRHE: Tiedostosäilö koko on suurempi kuin käytettävissä oleva vapaata tilaa levyllä.</entry>
+    <entry lang="fi" key="VOLUME_TOO_LARGE_FOR_HOST">VIRHE: Tiedostosäilön koko on suurempi kuin käytettävissä oleva vapaa levytila.</entry>
     <entry lang="fi" key="IDC_ALLOW_WINDOWS_DEFRAG">Salli Windowsin Levyn Eheytyksen eheyttää ei-järjestelmäosio/asema</entry>    
     <entry lang="fi" key="CONFIRM_ALLOW_WINDOWS_DEFRAG">VAROITUS: Järjestelmällisten osioiden tai aseman eheyttäminen voi vuotaa metatietoja sisällöstä tai aiheuttaa piilotettujen tiedostojen aiheuttamaa ongelmaa.\n\nJatketaan?</entry>
-    <entry lang="en" key="VIRTUAL_DEVICE">Virtual Device</entry>
+    <entry lang="fi" key="VIRTUAL_DEVICE">Virtuaalinen laite</entry>
-    <entry lang="en" key="MOUNTED_VOLUME_NOT_ASSOCIATED">The selected mounted volume is not associated with its drive letter in Windows and so it can not be opened in Windows Explorer.</entry>
+    <entry lang="fi" key="MOUNTED_VOLUME_NOT_ASSOCIATED">Valittu kytketty taltio ei ole yhdistetty Windows asemakirjaimeen ja siksi sitä ei voida avata resurssienhallinnassa.</entry>
-    <entry lang="en" key="IDC_CLEAR_KEYS_ON_NEW_DEVICE_INSERTION">Clear encryption keys from memory if a new device is inserted</entry>
+    <entry lang="fi" key="IDC_CLEAR_KEYS_ON_NEW_DEVICE_INSERTION">Poista (tyhjennä) salausavaimet muistista jos uusi laite on lisätty</entry>
-    <entry lang="en" key="CLEAR_KEYS_ON_DEVICE_INSERTION_WARNING">IMPORTANT NOTES:\n - Please keep in mind that this option will not persist after a shutdown/reboot so you will need to select it again next time the machine is started.\n\n - With this option enabled and after a new device is connected, the machine will freeze and it will eventually crash with a BSOD since Windows can not access the encrypted disk after its keys are cleared from memory.\n</entry>
+    <entry lang="fi" key="CLEAR_KEYS_ON_DEVICE_INSERTION_WARNING">TÄRKEÄÄ:\n - Pidä mielessäsi, että tämä ei ole pysyvä valinta joten joudut valitsemaan sen uudelleen sammutuksen/ uudelleenkäynnistyksen jälkeen.\n\n - Tällä valinnalla ja kun uusi laite on kytketty, tietokone jäätyy ja se kaatuu lopulta BSOD: llä, koska Windows ei pääse salattuun levyyn sen jälkeen, kun sen avaimet on poistettu muistista.\n</entry>
-    <entry lang="en" key="STARTING">Starting</entry>
+    <entry lang="fi" key="STARTING">Käynnistyy</entry>
-    <entry lang="en" key="IDC_ENABLE_CPU_RNG">Use CPU hardware random generator as an additional source of entropy</entry>
+    <entry lang="fi" key="IDC_ENABLE_CPU_RNG">Käytä CPU-laitteiston satunnaista generaattoria ylimääräisenä entropian lähteenä</entry>
-    <entry lang="en" key="IDC_USE_LEGACY_MAX_PASSWORD_LENGTH">Use legacy maximum password length (64 characters)</entry>
+    <entry lang="fi" key="IDC_USE_LEGACY_MAX_PASSWORD_LENGTH">Käytä salasanan enimmäispituutta (64 merkkiä)</entry>
-    <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
+    <entry lang="fi" key="IDC_ENABLE_RAM_ENCRYPTION">Aktivoi RAM-muistiin tallennettujen avainten ja salasanojen salaus</entry>
     <entry lang="fi" key="IDT_BENCHMARK">Nopeustesti:</entry>
-    <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="fi" key="IDC_DISABLE_MOUNT_MANAGER">Luo vain virtuaalinen laite asentamatta sitä valittuun aseman kirjaimeen</entry>
+    <entry lang="fi" key="LEGACY_PASSWORD_UTF8_TOO_LONG">Syötetty salasana on liian pitkä: sen UTF-8-esitys ylittää 64 tavua.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.fr.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="fr" name="Français" en-name="French" version="0.3.0" translators="Stéphane S., Olivier M., Thierry T" />
     <font lang="fr" class="normal" size="11" face="default" />
     <font lang="fr" class="bold" size="13" face="Arial" />
@@ -1111,7 +1111,7 @@
     <entry lang="fr" key="KEYB_LAYOUT_SYS_ENC_EXPLANATION">Note : Le mot de passe devra être saisi dans l’environnement de préamorçage (avant le démarrage de windows) où les dispositions de clavier non-américain ne sont pas disponibles. Aussi, le mot de passe doit toujours être saisi en utilisant la disposition du clavier Américain. Mais il est important de noter qu’il n’est PAS nécessaire de posséder un vrai clavier américain. VeraCrypt assure automatiquement que vous pouvez saisir en toute sécurité votre mot de passe (maintenant et dans l’environnement de préamorçage) même si vous ne possédez pas un vrai clavier américain.</entry>
     <entry lang="fr" key="RESCUE_DISK_INFO">Avant de pouvoir chiffrer la partition/disque, vous devez créer un disque de sauvegarde VeraCrypt (VRD), dont les buts sont :\n\n- Si le chargeur de démarrage de VeraCrypt, la clé principale ou d’autres données critiques sont endommagées, le VRD permet de les restaurer (remarquez que vous devrez toujours entrer le mot de passe correct).\n\n- Si Windows est endommagé et ne peut pas démarrer, VRD vous permet toujours de déchiffrer la partition/disque avant le démarrage de Windows.\n\n- Le VRD contiendra une sauvegarde du contenu actuel de la première plage du disque (qui contient en général un chargeur de système ou le gestionnaire de démarrage) et vous permettra de le restaurer si necessaire.\n\n L’image ISO du disque de récupération VeraCrypt sera créée à l’emplacement spécifié ci-dessous.</entry>
     <entry lang="fr" key="RESCUE_DISK_WIN_ISOBURN_PRELAUNCH_NOTE">Après avoir cliqué sur OK, le logiciel de gravage d’image Microsoft sera lancé. Utilisez-le pour graver l’image ISO du disque de récupération VeraCrypt sur un CD ou un DVD.\n\nAprès cela, revenez à l’assistant de création de volumes VeraCrypt et suivez les instructions.</entry>
-    <entry lang="fr" key="RESCUE_DISK_BURN_INFO">L’image de la disque de secours a été créée et stockée dans le fichier : \n%s\n\nMainteant vous avez besoin de le graver sur un CD ou un DVD.\n\n%lsAprès l’avoir gravé, cliquez sur suivant pour vérifier qu’il a été gravé correctement.</entry>
+    <entry lang="fr" key="RESCUE_DISK_BURN_INFO">L’image de la disque de secours a été créée et stockée dans le fichier : \n%s\n\nMaintenant vous avez besoin de le graver sur un CD ou un DVD.\n\n%lsAprès l’avoir gravé, cliquez sur suivant pour vérifier qu’il a été gravé correctement.</entry>
     <entry lang="fr" key="RESCUE_DISK_BURN_INFO_NO_CHECK">L’image de la disque de secours a été créée et stockée dans le fichier : \n%s\n\nVous devriez maintenant graver l’image sur un CD/DVD ou la déplacer vers un emplacement sécurisé pour une utilisation ultérieure.\n\n%lsCliquez sur "Suivant" pour continuer.</entry>
     <entry lang="fr" key="RESCUE_DISK_BURN_INFO_NONWIN_ISO_BURNER">IMPORTANT : Le fichier doit être écrit sur le CD/DVD sous forme d’image ISO (pas dans un fichier individuel). Pour plus d’informations sur la façon de le faire, veuillez vous reporter à la documentation de votre logiciel de gravure de CD/DVD. Si vous n’avez pas de logiciel de gravure de CD/DVD cliquez sur le lien ci-dessous pour télécharger un logiciel gratuit.\n\n</entry>
     <entry lang="fr" key="LAUNCH_WIN_ISOBURN">Lancez le logiciel de gravure d’image disque de Microsoft</entry>
@@ -1437,6 +1437,7 @@
     <entry lang="fr" key="IDC_ENABLE_RAM_ENCRYPTION">Activer le chiffrement des clefs et des mots de passe stockés en RAM</entry>
     <entry lang="fr" key="IDT_BENCHMARK">Banc de test:</entry>
     <entry lang="fr" key="IDC_DISABLE_MOUNT_MANAGER">Créer seulement le périphérique virtuel sans montage à la lettre de lecteur</entry>
+    <entry lang="fr" key="LEGACY_PASSWORD_UTF8_TOO_LONG">Le mot de passe saisi est trop long: sa representation UTF-8 dépasse 64 octets.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.hu.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="hu" name="Magyar" en-name="Hungarian" version="2018.03.06" translators="Nyul Balazs > Szaki" />
     <font lang="hu" class="normal" size="11" face="default" />
     <font lang="hu" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="hu" key="IDT_BENCHMARK">Sebességteszt:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="hu" key="LEGACY_PASSWORD_UTF8_TOO_LONG">A beütött jelszó túl hosszú. Az UTF-8 kódolása meghaladja a 64 bájtot.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">
@@ -1480,4 +1481,4 @@
       </xs:complexType>
     </xs:element>
   </xs:schema>
-</VeraCrypt>
+</VeraCrypt>

Translations/Language.id.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="id" name="Bahasa Indonesia" en-name="Indonesian" version="0.1.0" translators="Tajuddin N. F." />
     <font lang="id" class="normal" size="11" face="default" />
     <font lang="id" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="id" key="IDT_BENCHMARK">Penguji:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">
@@ -1480,4 +1481,4 @@
       </xs:complexType>
     </xs:element>
   </xs:schema>
-</VeraCrypt>
+</VeraCrypt>

Translations/Language.it.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="it" name="Italiano" en-name="Italian" version="1.0.1" translators="Maurizio Ballo, Consiglio Gaetano" />
     <font lang="it" class="normal" size="11" face="default" />
     <font lang="it" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="it" key="IDT_BENCHMARK">Riferimenti:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="it" key="LEGACY_PASSWORD_UTF8_TOO_LONG">La password inserita è troppo lunga: la sua rappresentazione in UTF-8 supera i 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.ja.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="ja" name="日本語" en-name="Japanese" version="1.0.0" translators="OGOSHI Masayuki" />
     <font lang="ja" class="normal" size="12" face="MS UI Gothic" />
     <font lang="ja" class="bold" size="16" face="MS UI Gothic" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="ja" key="IDT_BENCHMARK">ベンチマーク:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.ka.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="ka" name="ქართული" en-name="Georgian" version="0.1.0" translators="Kakha Lomiashvili" />
     <font lang="ka" class="normal" size="12" face="Arial" />
     <font lang="ka" class="bold" size="12" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="ko" key="IDT_BENCHMARK">სიჩქარის ტესტი:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">
@@ -1480,4 +1481,4 @@
       </xs:complexType>
     </xs:element>
   </xs:schema>
-</VeraCrypt>
+</VeraCrypt>

Translations/Language.ko.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="ko" name="한국어" en-name="Korean" version="0.1.1" translators="Kieaer, Herbert Shin" />
     <font lang="ko" class="normal" size="11" face="돋움" />
     <font lang="ko" class="bold" size="13" face="맑은 고딕" />
@@ -1437,6 +1437,7 @@
     <entry lang="ko" key="IDC_ENABLE_RAM_ENCRYPTION">RAM에 저장된 키 및 암호의 암호화를 활성화합니다.</entry>
     <entry lang="ko" key="IDT_BENCHMARK">벤치마크:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="ko" key="LEGACY_PASSWORD_UTF8_TOO_LONG">입력한 암호가 너무 깁니다. UTF-8 표시가 64바이트를 초과합니다.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.lv.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="lv" name="Latviešu" en-name="Latvian" version="0.1.0" translators="Edmunds Melkers" />
     <font lang="lv" class="normal" size="11" face="default" />
     <font lang="lv" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="lv" key="IDT_BENCHMARK">Etalons:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">
@@ -1480,4 +1481,4 @@
       </xs:complexType>
     </xs:element>
   </xs:schema>
-</VeraCrypt>
+</VeraCrypt>

Translations/Language.my.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="my" name="မြန်မာ" en-name="Burmese" version="1.0.0" translators="Zaw Myo Htet" />
     <font lang="my" class="normal" size="11" face="Myanmar3" />
     <font lang="my" class="bold" size="13" face="Myanmar3" />
@@ -1439,6 +1439,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="en" key="IDT_BENCHMARK">Benchmark:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.nl.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="nl" name="Nederlands" en-name="Dutch" version="0.2.3" translators="Jan van der Wal, Peter Tak" />
 																								   
     <font lang="nl" class="normal" size="11" face="default" />
@@ -1438,6 +1438,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="en" key="IDT_BENCHMARK">Benchmark:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="nl" key="LEGACY_PASSWORD_UTF8_TOO_LONG">Het opgegeven wachtwoord is te lang: de UTF-8 weergave is meer dan 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.nn.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="nn" name="Norsk Nynorsk" en-name="Norwegian (Nynorsk)" version="0.1.0" translators="Kjell Rune Helland" />
     <font lang="nn" class="normal" size="11" face="default" />
     <font lang="nn" class="bold" size="13" face="Arial " />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="nn" key="IDT_BENCHMARK">Ytingsprøve:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.pl.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="pl" name="Polski" en-name="Polish" version="1.0.0" translators="Mirek Druchowicz, Janusz Zamecki, Sobiesław Antolak, Begina Felicysym" />
     <font lang="pl" class="normal" size="11" face="default" />
     <font lang="pl" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="pl" key="IDC_ENABLE_RAM_ENCRYPTION">Aktywuj szyfrowanie kluczy i haseł przechowywanych w RAM</entry>
     <entry lang="pl" key="IDT_BENCHMARK">Testowanie:</entry>
     <entry lang="pl" key="IDC_DISABLE_MOUNT_MANAGER">Utwórz tylko urządzenie wirtualne bez montowania na wybranej literze dysku</entry>
+    <entry lang="pl" key="LEGACY_PASSWORD_UTF8_TOO_LONG">Wpisane hasło jest zbyt długie: jego reprezentacja UTF-8 przekracza 64 bajty.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.pt-br.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="pt-br" name="Português-Brasil" en-name="Portuguese (Brazil)" version="0.1.0" translators="Thiago C. L. Mendes, Lecidio S. Alencar , Lucas C. Ferreira" />
     <font lang="pt-br" class="normal" size="11" face="padrão" />
     <font lang="pt-br" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="en" key="IDT_BENCHMARK">Benchmark:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.ro.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version="1.24">
+  <localization prog-version="1.24-Update2">
     <language langid="ro" name="Română" en-name="Romanian" version="1.0.0" translators="Barna Cosmin Marian" />
     <font lang="ro" class="normal" size="11" face="default" />
     <font lang="ro" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="ro" key="IDC_ENABLE_RAM_ENCRYPTION">Activare criptare chei și parole stocate în RAM</entry>
     <entry lang="ro" key="IDT_BENCHMARK">Evaluare:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="ro" key="LEGACY_PASSWORD_UTF8_TOO_LONG">Parola introdusă este prea lungă: reprezentarea sa în UTF-8 depășește 64 de baiți.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.sk.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="sk" name="Slovenčina" en-name="Slovak" version="0.1.0" translators="Kamil David" />
     <font lang="sk" class="normal" size="11" face="default" />
     <font lang="sk" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="en" key="IDT_BENCHMARK">Benchmark:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">
@@ -1480,4 +1481,4 @@
       </xs:complexType>
     </xs:element>
   </xs:schema>
-</VeraCrypt>
+</VeraCrypt>

Translations/Language.sl.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="sl" name="Slovenščina" en-name="Slovenian" version="0.1.0" translators="Erik David Salam" />
     <font lang="sl" class="normal" size="11" face="default" />
     <font lang="sl" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="en" key="IDT_BENCHMARK">Benchmark:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">
@@ -1480,4 +1481,4 @@
       </xs:complexType>
     </xs:element>
   </xs:schema>
-</VeraCrypt>
+</VeraCrypt>

Translations/Language.sv.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="sv" name="Svenska" en-name="Swedish" version="1.0.0" translators="Peter Runesson" />
     <font lang="sv" class="normal" size="11" face="default" />
     <font lang="sv" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="sv" key="IDT_BENCHMARK">Prestandamätning:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.th.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="th" name="ภาษาไทย" en-name="Thai" version="0.0.0" translators=""/>
     <font lang="th" class="normal" size="11" face="default" />
     <font lang="th" class="bold" size="13" face="Arial" />
@@ -1438,6 +1438,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="en" key="IDT_BENCHMARK">Benchmark:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.tr.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="tr" name="Türkçe" en-name="Turkish" version="0.1.0" translators="Ali İskender Turan, Zeynel Abidin Öztürk" />
     <font lang="tr" class="normal" size="11" face="default" />
     <font lang="tr" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="tr" key="IDT_BENCHMARK">Hız Testi:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">
@@ -1480,4 +1481,4 @@
       </xs:complexType>
     </xs:element>
   </xs:schema>
-</VeraCrypt>
+</VeraCrypt>

Translations/Language.uk.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="uk" name="Українська" en-name="Ukrainian" version="1.0.0" translators="Kravchuk Olexandr, Babchuk Volodymyr" />
     <font lang="uk" class="normal" size="11" face="default" />
     <font lang="uk" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="uk" key="IDT_BENCHMARK">Тест швидкості:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.uz.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="uz" name="Ўзбекча" en-name="Uzbek (Cyrillic)" version="0.1.0" translators="Abdurauf Azizov, Dmitry Yerokhin" />
     <font lang="uz" class="normal" size="11" face="default" />
     <font lang="uz" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="uz" key="IDT_BENCHMARK">Тест скорости:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">
@@ -1480,4 +1481,4 @@
       </xs:complexType>
     </xs:element>
   </xs:schema>
-</VeraCrypt>
+</VeraCrypt>

Translations/Language.vi.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="vi" name="Tiếng Việt" en-name="Vietnamese" version="0.1.0" translators="Nguyễn Kim Huy" />
     <font lang="vi" class="normal" size="11" face="default" />
     <font lang="vi" class="bold" size="13" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="vi" key="IDT_BENCHMARK">Tiêu chuẩn:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">
@@ -1480,4 +1481,4 @@
       </xs:complexType>
     </xs:element>
   </xs:schema>
-</VeraCrypt>
+</VeraCrypt>

Translations/Language.zh-cn.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="zh-cn" name="简体中文" en-name="Chinese (Simplified)" version="1.0.0" translators="Barney Li and Zhangjintao" />
     <font lang="zh-cn" class="normal" size="11" face="Tahoma" />
     <font lang="zh-cn" class="bold" size="14" face="Tahoma" />
@@ -1437,6 +1437,7 @@
     <entry lang="zh-cn" key="IDC_ENABLE_RAM_ENCRYPTION">激活存储在RAM中的密钥和密码加密</entry>
     <entry lang="zh-cn" key="IDT_BENCHMARK">基准测试:</entry>
     <entry lang="zh-cn" key="IDC_DISABLE_MOUNT_MANAGER">仅创建虚拟设备而不加载在选定的盘符上</entry>
+    <entry lang="zh-cn" key="LEGACY_PASSWORD_UTF8_TOO_LONG">键入的密码过长：在UTF-8下已超过64字节。</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.zh-hk.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="zh-hk" name="繁體中文" en-name="Chinese (Hong Kong)" version="0.1.0" translators="PUN Chi Ho" />
     <font lang="zh-hk" class="normal" size="11" face="Arial" />
     <font lang="zh-hk" class="bold" size="14" face="Arial" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="zh-hk" key="IDT_BENCHMARK">基準測試:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.zh-tw.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <VeraCrypt>
-  <localization prog-version= "1.24">
+  <localization prog-version= "1.24-Update2">
     <language langid="zh-tw" name="繁體中文" en-name="Chinese (Taiwan)" version="0.1.0" translators="Barney Li, Simon Ma, ChangMing Hsu" />
     <font lang="zh-tw" class="normal" size="12" face="MingLiU" />
     <font lang="zh-tw" class="bold" size="15" face="MingLiU" />
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="en" key="IDT_BENCHMARK">Benchmark:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

doc/html/Command Line Usage.html

@@ -37,7 +37,7 @@
 <h1>Command Line Usage</h1>
 <p>Note that this section applies to the Windows version of VeraCrypt. For information on command line usage applying to the
 <strong>Linux and Mac OS X versions</strong>, please run: veracrypt &ndash;h</p>
-<table border="1" cellspacing="0" cellpadding="0">
+<table border="1" cellspacing="0" cellpadding="1">
 <tbody>
 <tr>
 <td><em>/help</em> or <em>/?</em></td>
@@ -176,6 +176,10 @@ Note that turning the password cache off will not clear it (use /w to clear the
 <p>Please note that this switch may be present several times in the command line in order to specify multiple mount options (e.g.: /m rm /m ts)</p>
 </td>
 </tr>
+<tr>
+<td><em>/DisableDeviceUpdate</em>&nbsp;</td>
+<td>Disables periodic internel check on devices connected to the system that is used for handling favorites identified with VolumeID and replace it with on-demande checks.</td>
+</tr>
 </tbody>
 </table>
 <h4>VeraCrypt Format.exe (VeraCrypt Volume Creation Wizard):</h4>
@@ -255,13 +259,21 @@ It has no parameters and it indicates that no message box or dialog will be disp
 <td>/nosizecheck</td>
 <td>Don't check that the given size of the file container is smaller than the available disk free. This applies to both UI and command line.</td>
 </tr>
+<tr>
+<td>/quick</td>
+<td>Perform quick formatting of volumes instead of full formatting. This applies to both UI and command line.</td>
+</tr>
+<tr>
+<td>/FastCreateFile</td>
+<td>Use a faster but potentially insecure way to create file containers. This applies to both UI and command line.</td>
+</tr>
 </tbody>
 </table>
 <h4>Syntax</h4>
 <p>VeraCrypt.exe [/tc] [/hash {sha256|sha-256|sha512|sha-512|whirlpool |ripemd160|ripemd-160}][/a [devices|favorites]] [/b] [/c [y|n|f]] [/d [drive letter]] [/e] [/f] [/h [y|n]] [/k keyfile or search path] [tryemptypass [y|n]] [/l drive letter] [/m {bk|rm|recovery|ro|sm|ts|noattach}]
  [/p password] [/pim pimvalue] [/q [background|preferences]] [/s] [/tokenlib path] [/v volume] [/w]</p>
 <p>&quot;VeraCrypt Format.exe&quot; [/n] [/create] [/size number[{K|M|G|T}]] [/p password]&nbsp; [/encryption {AES | Serpent | Twofish | Camellia | Kuznyechik | AES(Twofish) | AES(Twofish(Serpent)) | Serpent(AES) | Serpent(Twofish(AES)) | Twofish(Serpent) | Camellia(Kuznyechik) | Kuznyechik(Twofish) | Camellia(Serpent) | Kuznyechik(AES) | Kuznyechik(Serpent(Camellia))}] [/hash {sha256|sha-256|sha512|sha-512|whirlpool|ripemd160|ripemd-160}]
- [/filesystem {None|FAT|NTFS|ExFAT|ReFS}] [/dynamic] [/force] [/silent]</p>
+ [/filesystem {None|FAT|NTFS|ExFAT|ReFS}] [/dynamic] [/force] [/silent] [/noisocheck] [FastCreateFile] [/quick]</p>
 <p>Note that the order in which options are specified does not matter.</p>
 <h4>Examples</h4>
 <p>Mount the volume <em>d:\myvolume</em> as the first free drive letter, using the password prompt (the main program window will not be displayed):</p>

doc/html/Favorite Volumes.html

@@ -35,7 +35,7 @@
 </p></div>
 
 <div class="wikidoc">
-<h2 style="text-align:left; font-family:Arial,Helvetica,Verdana,sans-serif; font-weight:bold; margin-top:0px; font-size:14px; margin-bottom:17px">
+<h2 style="text-align:left; font-family:Arial,Helvetica,Verdana,sans-serif; font-weight:bold; margin-top:0px; margin-bottom:17px">
 Favorite Volumes</h2>
 <div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
 <p>Favorite volumes are useful, for example, in any the following cases:</p>
@@ -46,6 +46,9 @@ Favorite Volumes</h2>
 </li><li>You have a volume that needs to be <strong>automatically mounted when you log on
 </strong>to the operating system. </li><li>You have a volume that always needs to be <strong>mounted as read-only </strong>
 or removable medium. </li></ul>
+<p>
+<strong>Note: </strong>Please refer to <a href="Issues%20and%20Limitations.html">Known Issues and Limitations</a> section for issues that may affect favorite volumes when Windows "Fast Startup" feature is enabled.
+</p>
 <h3>To configure a VeraCrypt volume as a favorite volume, follow these steps:</h3>
 <ol>
 <li>Mount the volume (to the drive letter to which you want it to be mounted every time).

doc/html/Issues and Limitations.html

@@ -36,7 +36,7 @@
 <h1>Known Issues &amp; Limitations</h1>
 <h3>Known Issues</h3>
 <ul>
-<li>On Windows, it may happen that two drive letters are assigned to a mounted volume instead of a single one. This is caused by an issue with Windows Mount Manager cache and it can be solve by typing the command &quot;<strong>mountvol.exe /r</strong>&quot; in an elevated
+<li>On Windows, it may happen that two drive letters are assigned to a mounted volume instead of a single one. This is caused by an issue with Windows Mount Manager cache and it can be solved by typing the command &quot;<strong>mountvol.exe /r</strong>&quot; in an elevated
  command prompt (run as an administrator) before mounting any volume. If the issue persists after rebooting, the following procedure can be used to solve it:
 <ul>
 <li>Check the registry key &quot;HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices&quot; using regedit. Scroll down and you'll find entries starting with &quot;\DosDevices\&quot; or &quot;\Global??\&quot; which indicate the drive letters that are taken by the system. Before mounting any volume,
@@ -45,7 +45,7 @@
 Also, there are other entries whose name start with &quot;#{&quot; and &quot;\??\Volume{&quot;: double click on each one of them and remove the ones whose data value contains the name &quot;VeraCrypt&quot; and &quot;TrueCrypt&quot;.
 </li></ul>
 </li>
-<li>On some Windows machines, VeraCrypt may hang intermittently when mounting or dismounting a volume. Similar hanging may affect other running applications during veraCrypt mounting or dismounting operations.
+<li>On some Windows machines, VeraCrypt may hang intermittently when mounting or dismounting a volume. Similar hanging may affect other running applications during VeraCrypt mounting or dismounting operations.
 This issue is caused by a conflict between VeraCrypt waiting dialog displayed during mount/dismount operations and other software installed on the machine (e.g. Outpost Firewall Pro).
 In such situations, the issue can be solved by disabling VeraCrypt waiting dialog in the Preferences: use menu "Settings -> Preferences" and check the option "Don't show wait message dialog when performing operations".
 </li>

doc/html/Keyfiles.html

@@ -40,7 +40,7 @@
 <p>VeraCrypt keyfile is a file whose content is combined with a password. The user can use any kind of file as a VeraCrypt keyfile. The user can also generate a keyfile using the built-in keyfile generator, which utilizes the VeraCrypt RNG to generate a file
  with random content (for more information, see the section <a href="Random%20Number%20Generator.html">
 <em>Random Number Generator</em></a>).</p>
-<p>The maximum size of a keyfile is not limited; however, only its first 1,048,576 bytes (1 MB) are processed (all remaining bytes are ignored due to performance issues connected with processing extremely large files). The user can supply one or more keyfiles
+<p>The maximum size of a keyfile is not limited; however, only its first 1,048,576 bytes (1 MiB) are processed (all remaining bytes are ignored due to performance issues connected with processing extremely large files). The user can supply one or more keyfiles
  (the number of keyfiles is not limited).</p>
 <p>Keyfiles can be stored on PKCS-11-compliant [23] security tokens and smart cards protected by multiple PIN codes (which can be entered either using a hardware PIN pad or via the VeraCrypt GUI).</p>
 <p>Keyfiles are processed and applied to a password using the following method:</p>
@@ -78,4 +78,4 @@ Note that if the password was shorter than the keyfile pool, then the password w
 <p>&nbsp;</p>
 <p><a href="Personal%20Iterations%20Multiplier%20%28PIM%29.html" style="text-align:left; color:#0080c0; text-decoration:none; font-weight:bold.html">Next Section &gt;&gt;</a></p>
 </div>
-</div><div class="ClearBoth"></div></body></html>
+</div><div class="ClearBoth"></div></body></html>

doc/html/Release Notes.html

@@ -39,6 +39,114 @@
 <strong>Note to users who created volumes with 1.17 version of VeraCrypt or earlier: </strong><br/>
 <span style="color:#ff0000;">To avoid hinting whether your volumes contain a hidden volume or not, or if you depend on plausible deniability when using hidden volumes/OS, then you must recreate both the outer and hidden volumes including system encryption and hidden OS, discarding existing volumes created prior to 1.18a version of VeraCrypt.</span></li>
 </p>
+
+<p><strong style="text-align:left">1.24-Update3 </strong>(December 21<sup>nd</sup>, 2019):</p>
+<ul>
+<li><strong>Linux:</strong>
+<ul>
+<li>Fix console-only build to remove dependency on GTK that is not wanted on headless servers.</li>
+</ul>
+</li>
+</ul>
+
+<p><strong style="text-align:left">1.24-Update2 </strong>(December 16<sup>th</sup>, 2019):</p>
+<ul>
+<li><strong>All OSes:</strong>
+<ul>
+<li>clear AES key from stack memory when using non-optimized implementation. Doesn't apply to VeraCrypt official build (Reported and fixed by Hanno Böck)</li>
+<li>Update Jitterentropy RNG Library to version 2.2.0</li>
+<li>Start following IEEE 1541 agreed naming of bytes (KiB, MiB, GiB, TiB, PiB).</li>
+<li>Various documentation enhancements.</li>
+</ul>
+</li>
+<li><strong>Windows:</strong>
+<ul>
+<li>Fix possible local privilege escalation vulnerability during execution of VeraCrypt Expander (CVE-2019-19501)</li>
+<li>MBR bootloader:
+<ul>
+<li>workaround for SSD disks that don't allow write operations in BIOS mode with buffers less than 4096 bytes.</li>
+<li>Don't restore MBR to VeraCrypt value if it is coming from a loader different from us or different from Microsoft one.</li>
+</ul>
+</li>
+<li>EFI bootloader:
+<ul>
+<li>Fix "ActionFailed" not working and add "ActionCancelled" to customize handling of user hitting ESC on password prompt</li>
+<li>Fix F5 showing previous password after failed authentication attempt. Ensure that even wrong password value are cleared from memory.</li>
+</ul>
+</li>
+<li>Fix multi-OS boot compatibility by only setting VeraCrypt as first bootloader of the system if the current first bootloader is Windows one.</li>
+<li>Add new registry flags for SystemFavoritesService to control updating of EFI BIOS boot menu on shutdown.</li>
+<li>Allow system encrypted drive to be mounted in WindowsPE even if changing keyboard layout fails (reported and fixed by Sven Strickroth)</li>
+<li>Enhancements to the mechanism preserving file timestamps, especially for keyfiles.</li>
+<li>Fix RDRAND instruction not detected on AMD CPUs.</li>
+<li>Detect cases where RDRAND is flawed (e.g. AMD Ryzen) to avoid using it if enabled by user.</li>
+<li>Don't write extra 0x00 byte at the end of DcsProp file when modifying it through UI</li>
+<li>Reduce memory usage of IOCTL_DISK_VERIFY handler used in disk verification by Windows.</li>
+<li>Add switch /FastCreateFile for VeraCrypt Format.exe to speedup creation of large file container if quick format is selected.</li>
+<li>Fix the checkbox for skipping verification of Rescue Disk not reflecting the value of /noisocheck switch specified in VeraCrypt Format command line.</li>
+<li>check "TrueCrypt Mode" in password dialog when mounting a file container with .tc extension</li>
+<li>Update XML languages files.</li>
+</ul>
+</li>
+<li><strong>Linux:</strong>
+<ul>
+<li>Fix regression causing admin password to be requested too many times in some cases</li>
+<li>Fix off by one buffer overflow in function Process::Execute (Reported and fixed by Hanno Böck)</li>
+<li>Make sure password gets deleted in case of internal error when mounting volume (Reported and fixed by Hanno Böck)</li>
+<li>Fix passwords using Unicode characters not recognized in text mode.</li>
+<li>Fix failure to run VeraCrypt binary built for console mode on headless machines.</li>
+<li>Add switch to force the use of legacy maximum password length (64 UTF8 bytes)</li>
+<li>Add CLI switch (--use-dummy-sudo-password) to force use of old sudo behavior of sending a dummy password</li>
+<li>During uninstall, output error message to STDERR instead of STDOUT for better compatibility with package managers.</li>
+<li>Make sector size mismatch error when mounting disks more verbose.</li>
+<li>Speedup SHA256 in 64-bit mode by using assembly code.</li>
+</ul>
+</li>
+<li><strong>MacOSX:</strong>
+<ul>
+<li>Add switch to force the use of legacy maximum password length (64 UTF8 bytes)</li>
+<li>Fix off by one buffer overflow in function Process::Execute (Reported and fixed by Hanno Böck)</li>
+<li>Fix passwords using Unicode characters not recognized in text mode.</li>
+<li>Make sector size mismatch error when mounting disks more verbose.</li>
+<li>Speedup SHA256 in 64-bit mode by using assembly code.</li>
+<li>Link against latest wxWidgets version 3.1.3</li>
+</ul>
+</li>
+</ul>
+
+
+<p><strong style="text-align:left">1.24-Hotfix1 </strong>(October 27<sup>rd</sup>, 2019):</p>
+<ul>
+<li><strong>Windows:</strong>
+<ul>
+<li>Fix 1.24 regression that caused system favorites not to mount at boot if VeraCrypt freshly installed.</li>
+<li>Fix failure to encrypt system if the current Windows username contains a Unicode non-ASCII character.</li>
+<li>Make VeraCrypt Expander able to resume expansion of volumes whose previous expansion was aborted before it finishes.</li>
+<li>Add "Quick Expand" option to VeraCrypt Expander to accelarate the expansion of large file containers.</li>
+<li>Add several robustness checks and validation in case of system encryption to better handle some corner cases.</li>
+<li>Minor UI and documentation changes.</li>
+</ul>
+</li>
+<li><strong>Linux:</strong>
+<ul>
+<li>Workaround gcc 4.4.7 bug under CentOS 6 that caused VeraCrypt built under CentOS 6 to crash when Whirlpool hash is used.</li>
+<li>Fix "incorrect password attempt" written to /var/log/auth.log when mounting volumes.</li>
+<li>Fix dropping file in UI not showing its correct path , specifically under GTK-3.</li>
+<li>Add missing JitterEntropy implementation/</li>
+</ul>
+</li>
+<li><strong>MacOSX:</strong>
+<ul>
+<li>Fix some devices and partitions not showing in the device selection dialog under OSX 10.13 and newer.</li>
+<li>Fix keyboard tab navigation between password fields in "Volume Password" page of volume creation wizard.</li>
+<li>Add missing JitterEntropy implementation/</li>
+<li>Support APFS filesystem for creation volumes.</li>
+<li>Support Dark Mode.</li>
+</ul>
+</li>
+</ul>
+
+
 <p><strong style="text-align:left">1.24 </strong>(October 6<sup>th</sup>, 2019):</p>
 <ul>
 <li><strong>All OSs:</strong>

doc/html/Supported Operating Systems.html

@@ -44,6 +44,8 @@ Windows Server 2012 </li><li style="text-align:left; margin-top:0px; margin-bott
 Windows Server 2008 R2 (64-bit) </li><li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
 Windows Server 2008 </li><li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
 Windows Server 2003 </li><li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+Mac OS X 10.15 Catalina </li><li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
+Mac OS X 10.14 Mojave </li><li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
 Mac OS X 10.13 High Sierra </li><li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
 Mac OS X 10.12 Sierra </li><li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
 Mac OS X 10.11 El Capitan </li><li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">

doc/html/System Encryption.html

@@ -65,7 +65,8 @@ Because of BIOS requirement, the pre-boot password is typed using <strong>US key
 </strong>During the system encryption process, VeraCrypt automatically and transparently switches the keyboard to US layout in order to ensure that the password value typed will match the one typed in pre-boot mode. Thus, in order to avoid wrong password errors,
  one must type the password using the same keys as when creating the system encryption.</div>
 <p>Note: By default, Windows 7 and later boot from a special small partition. The partition contains files that are required to boot the system. Windows allows only applications that have administrator privileges to write to the partition (when the system is
- running). VeraCrypt encrypts the partition only if you choose to encrypt the whole system drive (as opposed to choosing to encrypt only the partition where Windows is installed).</p>
+ running). In EFI boot mode, which is the default on modern PCs, VeraCrypt can not encrypt this partition since it must remain unencrypted so that the BIOS can load the EFI bootloader from it. This in turn implies that in EFI boot mode, VeraCrypt offers only to encrypt the system partition where Windows is installed (the user can later manualy encrypt other data partitions using VeraCrypt). 
+ In MBR legacy boot mode, VeraCrypt encrypts the partition only if you choose to encrypt the whole system drive (as opposed to choosing to encrypt only the partition where Windows is installed).</p>
 <p>&nbsp;</p>
 <p><a href="Hidden%20Operating%20System.html" style="text-align:left; color:#0080c0; text-decoration:none; font-weight:bold.html">Next Section &gt;&gt;</a></p>
 </div>

doc/html/Unencrypted Data in RAM.html

@@ -48,6 +48,10 @@ Inherently, unencrypted master keys have to be stored in RAM too. When a non-sys
  cleanly restarted), or when the system crashes, <strong style="text-align:left">
 VeraCrypt naturally stops running and therefore cannot </strong>erase any keys or any other sensitive data. Furthermore, as Microsoft does not provide any appropriate API for handling hibernation and shutdown, master keys used for system encryption cannot be
  reliably (and are not) erased from RAM when the computer hibernates, is shut down or restarted.**</div>
+<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
+Starting from version 1.24, VeraCrypt introduces a mechanism to encrypt master keys and cached passwords in RAM. This RAM encryption mechanism must be activated manually in "Performance/Driver Configuration" dialog. RAM encryption comes with a performance overhead (between 5% and 15% depending on the CPU speed) and it disables Windows hibernate. <br>
+Moreover, VeraCrypt 1.24 and above provide an additional security mechanism when system encryption is used that makes VeraCrypt erase master keys from RAM when a new device is connected to the PC. This additional mechanism can be activated using an option in System Settings dialog.<br/>
+Even though both above mechanisms provides strong protection for masterskeys and cached password, users should still take usual precautions related for the safery of sensitive data in RAM.</div>
 <table style="border-collapse:separate; border-spacing:0px; text-align:left; font-size:11px; line-height:13px; font-family:Verdana,Arial,Helvetica,sans-serif">
 <tbody style="text-align:left">
 <tr style="text-align:left">

doc/html/VeraCrypt Rescue Disk.html

@@ -37,24 +37,24 @@
 <div class="wikidoc">
 <h1>VeraCrypt Rescue Disk</h1>
 <div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
-During the process of preparing the encryption of a system partition/drive, VeraCrypt requires that you create a so-called VeraCrypt Rescue Disk (CD/DVD), which serves the following purposes:</div>
+During the process of preparing the encryption of a system partition/drive, VeraCrypt requires that you create a so-called VeraCrypt Rescue Disk (USB disk in EFI boot mode, CD/DVD in MBR legacy boot mode), which serves the following purposes:</div>
 <ul style="text-align:left; margin-top:18px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
 <li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
 If the VeraCrypt Boot Loader screen does not appear after you start your computer (or if Windows does not boot), the
 <strong style="text-align:left">VeraCrypt Boot Loader may be damaged</strong>. The VeraCrypt Rescue Disk allows you restore it and thus to regain access to your encrypted system and data (however, note that you will still have to enter the correct password
- then). In the Rescue Disk screen, select <em style="text-align:left">Repair Options</em> &gt;
+ then). For EFI boot mode, select <em style="text-align:left">Restore VeraCrypt loader binaries to system disk</em> in the Rescue Disk screen. For MBR legacy boot mode, select instead <em style="text-align:left">Repair Options</em> &gt;
-<em style="text-align:left">Restore VeraCrypt Boot Loader</em>. Then press 'Y' to confirm the action, remove the Rescue Disk from your CD/DVD drive and restart your computer.
+<em style="text-align:left">Restore VeraCrypt Boot Loader</em>. Then press 'Y' to confirm the action, remove the Rescue Disk from your USB port or CD/DVD drive and restart your computer.
 </li><li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
 If the <strong style="text-align:left">VeraCrypt Boot Loader is frequently damaged
 </strong>(for example, by inappropriately designed activation software) or if <strong style="text-align:left">
 you do not want the VeraCrypt boot loader </strong><strong style="text-align:left">to reside on the hard drive
 </strong>(for example, if you want to use an alternative boot loader/manager for other operating systems), you can boot directly from the VeraCrypt Rescue Disk (as it contains the VeraCrypt boot loader too) without restoring the boot loader to the hard drive.
- Just insert your Rescue Disk into your CD/DVD drive and then enter your password in the Rescue Disk screen.
+ For EFI boot mode, just insert your Rescue Disk into a USB port, boot your computer on it and then select <em style="text-align:left">Boot VeraCrypt loader from rescue disk</em> on the Rescue Disk screen. For MBR legacy boot mode, you need to insert the Rescue Disk in your CD/DVD drive and then enter your password in the Rescue Disk screen.
 </li><li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
 If you repeatedly enter the correct password but VeraCrypt says that the password is incorrect, it is possible that the
 <strong style="text-align:left">master key or other critical data are damaged</strong>. The VeraCrypt Rescue Disk allows you to restore them and thus to regain access to your encrypted system and data (however, note that you will still have to enter the correct
- password then). In the Rescue Disk screen, select <em style="text-align:left">Repair Options</em> &gt;
+ password then). For EFI boot mode, select <em style="text-align:left">Restore OS header keys</em> in the Rescue Disk screen. For MBR legacy boot mode, select instead <em style="text-align:left">Repair Options</em> &gt;
-<em style="text-align:left">Restore key data</em>. Then enter your password, press 'Y' to confirm the action, remove the Rescue Disk from your CD/DVD drive, and restart your computer.<br style="text-align:left">
+<em style="text-align:left">Restore VeraCrypt Boot Loader</em>. Then enter your password, press 'Y' to confirm the action, remove the Rescue Disk from the USB port or CD/DVD drive, and restart your computer.<br style="text-align:left">
 <br style="text-align:left">
 Note: This feature cannot be used to restore the header of a hidden volume within which a
 <a href="Hidden%20Operating%20System.html" style="text-align:left; color:#0080c0; text-decoration:none.html">
@@ -68,19 +68,19 @@ WARNING: By restoring key data using a VeraCrypt Rescue Disk, you also restore t
  one (select <em style="text-align:left">System</em> -&gt; <em style="text-align:left">
 Create Rescue Disk</em>). Otherwise, if an attacker knows your old password (for example, captured by a keystroke logger) and if he then finds your old VeraCrypt Rescue Disk, he could use it to restore the key data (the master key encrypted with the old password)
  and thus decrypt your system partition/drive </li><li id="WindowsDamaged" style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
-If <strong style="text-align:left">Windows is damaged and cannot start</strong>, the VeraCrypt Rescue Disk allows you to permanently decrypt the partition/drive before Windows starts. In the Rescue Disk screen, select
+If <strong style="text-align:left">Windows is damaged and cannot start</strong> after typing the correct password on VeraCrypt password prompt, the VeraCrypt Rescue Disk allows you to permanently decrypt the partition/drive before Windows starts. For EFI boot, select
-<em style="text-align:left">Repair Options</em> &gt; <em style="text-align:left">
+<em style="text-align:left">Decrypt OS</em> in the Rescue Disk screen. For MBR legacy boot mode, select instead <em style="text-align:left">Repair Options</em> &gt; <em style="text-align:left">
 Permanently decrypt system partition/drive</em>. Enter the correct password and wait until decryption is complete. Then you can e.g. boot your MS Windows setup CD/DVD to repair your Windows installation. Note that this feature cannot be used to decrypt a hidden
  volume within which a <a href="Hidden%20Operating%20System.html" style="text-align:left; color:#0080c0; text-decoration:none.html">
 hidden operating system</a> resides (see the section <a href="Hidden%20Operating%20System.html">
 Hidden Operating System</a>).<br style="text-align:left">
 <br style="text-align:left">
 Note: Alternatively, if Windows is damaged (cannot start) and you need to repair it (or access files on it), you can avoid decrypting the system partition/drive by following these steps:&nbsp;If you have multiple operating systems installed on your computer,
- boot the one that does not require pre-boot authentication. If you do not have multiple operating systems installed on your computer, you can boot a WinPE or BartPE CD/DVD or you can connect your system drive as a secondary or external drive to another computer
+ boot the one that does not require pre-boot authentication. If you do not have multiple operating systems installed on your computer, you can boot a WinPE or BartPE CD/DVD or a Linux Live CD/DVD/USB. You can also connect your system drive as a secondary or external drive to another computer
  and then boot the operating system installed on the computer. After you boot a system, run VeraCrypt, click Select Device, select the affected system partition, click OK , select System &gt; Mount Without Pre-Boot Authentication, enter your pre-boot-authentication
  password and click OK. The partition will be mounted as a regular VeraCrypt volume (data will be on-the-fly decrypted/encrypted in RAM on access, as usual).
 </li><li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
-Your VeraCrypt Rescue Disk contains a <strong style="text-align:left">backup of the original content of the first drive track</strong> (made before the VeraCrypt Boot Loader was written to it) and allows you to restore it if necessary. The first track typically
+In case of MBR legacy boot mode, your VeraCrypt Rescue Disk contains a <strong style="text-align:left">backup of the original content of the first drive track</strong> (made before the VeraCrypt Boot Loader was written to it) and allows you to restore it if necessary. The first track typically
  contains a system loader or boot manager. In the Rescue Disk screen, select Repair Options &gt; Restore original system loader.
 </li></ul>
 <div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
@@ -89,20 +89,20 @@ Your VeraCrypt Rescue Disk contains a <strong style="text-align:left">backup of
 <em style="text-align:left">Note that even if you lose your VeraCrypt Rescue Disk and an attacker finds it, he or she will
 <strong style="text-align:left">not</strong> be able to decrypt the system partition or drive without the correct password.</em></div>
 <div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
-To boot a VeraCrypt Rescue Disk, insert it into your CD/DVD drive and restart your computer. If the VeraCrypt Rescue Disk screen does not appear (or if you do not see the 'Repair Options' item in the 'Keyboard Controls' section of the screen), it is possible
+To boot a VeraCrypt Rescue Disk, insert it into a USB port or your CD/DVD drive depending on its type and restart your computer. If the VeraCrypt Rescue Disk screen does not appear (or in case of MBR legacy boot mode if you do not see the 'Repair Options' item in the 'Keyboard Controls' section of the screen), it is possible
- that your BIOS is configured to attempt to boot from hard drives before CD/DVD drives. If that is the case, restart your computer, press F2 or Delete (as soon as you see a BIOS start-up screen), and wait until a BIOS configuration screen appears. If no BIOS
+ that your BIOS is configured to attempt to boot from hard drives before USB drivers and CD/DVD drives. If that is the case, restart your computer, press F2 or Delete (as soon as you see a BIOS start-up screen), and wait until a BIOS configuration screen appears. If no BIOS
- configuration screen appears, restart (reset) the computer again and start pressing F2 or Delete repeatedly as soon as you restart (reset) the computer. When a BIOS configuration screen appears, configure your BIOS to boot from the CD/DVD drive first (for
+ configuration screen appears, restart (reset) the computer again and start pressing F2 or Delete repeatedly as soon as you restart (reset) the computer. When a BIOS configuration screen appears, configure your BIOS to boot from the USB drive and CD/DVD drive first (for
  information on how to do so, please refer to the documentation for your BIOS/motherboard or contact your computer vendor's technical support team for assistance). Then restart your computer. The VeraCrypt Rescue Disk screen should appear now. Note: In the
- VeraCrypt Rescue Disk screen, you can select 'Repair Options' by pressing F8 on your keyboard.</div>
+ case of MBR legacy boot mode, you can select 'Repair Options' on the VeraCrypt Rescue Disk screen by pressing F8 on your keyboard.</div>
 <p>If your VeraCrypt Rescue Disk is damaged, you can create a new one by selecting
-<em style="text-align:left">System</em> &gt; <em style="text-align:left">Create Rescue Disk</em>. To find out whether your VeraCrypt Rescue Disk is damaged, insert it into your CD/DVD drive and select
+<em style="text-align:left">System</em> &gt; <em style="text-align:left">Create Rescue Disk</em>. To find out whether your VeraCrypt Rescue Disk is damaged, insert it into a USB port (or into your CD/DVD drive in case of MBR legacy boot mode) and select
 <em style="text-align:left">System</em> &gt; <em style="text-align:left">Verify Rescue Disk</em>.</p>
 </div><div class="ClearBoth"></div>
 
 
-<h2>VeraCrypt Rescue Disk on USB Stick</h2>
+<h2>VeraCrypt Rescue Disk for MBR legacy boot mode on USB Stick</h2>
 <div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
-It is also possible to create a VeraCrypt Rescue Disk on a USB drive, in case your machine does not have a CD/DVD drive. <strong style="text-align:left">Please note that you must ensure that the data on the USB stick is not overwritten! If you lose the USB drive or your data is damaged, you will not be able to recover your system in case of a problem!</strong>
+It is also possible to create a VeraCrypt Rescue Disk for MBR legacy boot mode on a USB drive, in case your machine does not have a CD/DVD drive. <strong style="text-align:left">Please note that you must ensure that the data on the USB stick is not overwritten! If you lose the USB drive or your data is damaged, you will not be able to recover your system in case of a problem!</strong>
 </div>
 <div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
 To create a bootable VeraCrypt Rescue USB drive you have to create a bootable USB drive which bootloader runs up the iso image. Solutions like Unetbootin, which try to copy the data inside the iso image to the usb drive do not work yet. On Windows please follow the steps below:

src/Boot/Windows/Bios.h

@@ -24,7 +24,8 @@
 enum
 {
 	BiosResultSuccess = 0x00,
-	BiosResultInvalidFunction = 0x01
+	BiosResultInvalidFunction = 0x01,
+	BiosResultTimeout = 0x80
 };
 
 typedef byte BiosResult;

src/Boot/Windows/BootCommon.h

@@ -17,7 +17,7 @@
 #include "BootDefs.h"
 
 // The user will be advised to upgrade the rescue disk if upgrading from the following or any previous version
-#define TC_RESCUE_DISK_UPGRADE_NOTICE_MAX_VERSION 0x0122
+#define TC_RESCUE_DISK_UPGRADE_NOTICE_MAX_VERSION 0x0123
 
 #define TC_BOOT_LOADER_AREA_SIZE (TC_BOOT_LOADER_AREA_SECTOR_COUNT * TC_SECTOR_SIZE_BIOS)
 

src/Boot/Windows/BootDiskIo.cpp

@@ -105,7 +105,7 @@ void Print (const ChsAddress &chs)
 
 void PrintSectorCountInMB (const uint64 &sectorCount)
 {
-	Print (sectorCount >> (TC_LB_SIZE_BIT_SHIFT_DIVISOR + 2)); Print (" MB ");
+	Print (sectorCount >> (TC_LB_SIZE_BIT_SHIFT_DIVISOR + 2)); Print (" MiB ");
 }
 
 
@@ -237,7 +237,7 @@ static BiosResult ReadWriteSectors (bool write, BiosLbaPacket &dapPacket, byte d
 }
 
 
-static BiosResult ReadWriteSectors (bool write, byte *buffer, byte drive, const uint64 &sector, uint16 sectorCount, bool silent)
+BiosResult ReadWriteSectors (bool write, byte *buffer, byte drive, const uint64 &sector, uint16 sectorCount, bool silent)
 {
 	BiosLbaPacket dapPacket;
 	dapPacket.Buffer = (uint32) buffer;

src/Boot/Windows/BootDiskIo.h

@@ -112,6 +112,7 @@ BiosResult ReadSectors (uint16 bufferSegment, uint16 bufferOffset, byte drive, c
 BiosResult ReadSectors (byte *buffer, byte drive, const uint64 &sector, uint16 sectorCount, bool silent = false);
 BiosResult ReadSectors (byte *buffer, byte drive, const ChsAddress &chs, byte sectorCount, bool silent = false);
 BiosResult ReadWriteSectors (bool write, uint16 bufferSegment, uint16 bufferOffset, byte drive, const uint64 &sector, uint16 sectorCount, bool silent);
+BiosResult ReadWriteSectors (bool write, byte *buffer, byte drive, const uint64 &sector, uint16 sectorCount, bool silent);
 BiosResult WriteSectors (byte *buffer, byte drive, const uint64 &sector, uint16 sectorCount, bool silent = false);
 BiosResult WriteSectors (byte *buffer, byte drive, const ChsAddress &chs, byte sectorCount, bool silent = false);
 

src/Boot/Windows/BootEncryptedIo.cpp

@@ -108,10 +108,22 @@ BiosResult WriteEncryptedSectors (uint16 sourceSegment, uint16 sourceOffset, byt
 			EncryptDataUnits (SectorBuffer, &dataUnitNo, 1, BootCryptoInfo);
 		}
 
-		result = WriteSectors (SectorBuffer, drive, sector + writeOffset, 1);
+		result = ReadWriteSectors (true, SectorBuffer, drive, sector + writeOffset, 1, true);
+		if (BiosResultTimeout == result)
+		{
+			if (BiosResultSuccess == ReadWriteSectors (false, TC_BOOT_LOADER_BUFFER_SEGMENT, 0, drive, sector + writeOffset, 8, false))
+			{
+				CopyMemory (SectorBuffer, TC_BOOT_LOADER_BUFFER_SEGMENT,0, TC_LB_SIZE);
+				result = ReadWriteSectors (true, TC_BOOT_LOADER_BUFFER_SEGMENT, 0, drive, sector + writeOffset, 8, true);
+			}
+		}
 
 		if (result != BiosResultSuccess)
+		{
+			sector += writeOffset;
+			PrintDiskError (result, true, drive, &sector);
 			break;
+		}
 
 		++sector;
 		++dataUnitNo;

src/Build/CMakeLists.txt

@@ -10,6 +10,11 @@ elseif ( NOT DEFINED NOGUI )
 	MESSAGE(FATAL_ERROR "NOGUI variable MUST BE set to TRUE if building 'Console' version, 'FALSE' otherwise")
 endif()
 
+# - Set version of the package
+set( FULL_VERSION 		"1.24-Update3" )
+set( VERSION 			"1.24.11" )
+set( RELEASE 			"1" )
+
 # - Set PROJECT_NAME and CONFLICT_PACKAGE values
 if (NOGUI)
 	set( PROJECT_NAME 		"veracrypt-console" )
@@ -53,21 +58,22 @@ endif( )
 
 # - Detect OSX, CentOS, Debian, Ubuntu or openSUSE platform of the build system
 #   The following variable(s) will be set
-#   	$PLATFORM						Debian		Ubuntu 		CentOS		openSUSE 
+#   	$PLATFORM						Debian		Ubuntu 		CentOS		openSUSE (TODO)
 #   	$PLATFORM_VERSION	
 #										9.x 		16.04		7.X			42.3
 #										10.X		18.04		8.X			15.0
+#										...			...			...			...
 # 		$DISTRO_NAME					${PLATFORM}-${PLATFORM_VERSION}
 if ( UNIX )
 
 	# /etc/debian_version exists for both Debian and Ubuntu
-	if(EXISTS "/etc/debian_version")		
+	if(EXISTS "/etc/debian_version")
 	
 		set ( PLATFORM "Debian" )
 	
 		# Read lsb-release to get flavour name and flavour release version (only supported one for now is Ubuntu)
 		if(EXISTS "/etc/lsb-release")		
-		
+			
 			file(READ "/etc/lsb-release" LSB_RELEASE_ID)
 			string(REGEX MATCH "DISTRIB_ID=([a-zA-Z0-9 /\\.]+)" _ ${LSB_RELEASE_ID})
 			set(FULL_FLAVOUR ${CMAKE_MATCH_1})
@@ -83,22 +89,18 @@ if ( UNIX )
 			else()
 			
 				file(READ "/etc/debian_version" DEBIAN_RELEASE)
-				string(REGEX MATCH "[a-zA-Z0-9 /\\.]+" _ ${DEBIAN_RELEASE})
+				string(REGEX MATCH "([0-9]+\\.[0-9]+)" _ ${DEBIAN_RELEASE})
 				set(PLATFORM_VERSION ${CMAKE_MATCH_1})
 				
-				if( PLATFORM_VERSION STREQUAL "stretch/sid" )
-					set( PLATFORM_VERSION "9" )
-				endif( PLATFORM_VERSION STREQUAL "stretch/sid" )
-				
 			endif()
 			
 		# Get debian release version
 		elseif(EXISTS "/etc/debian_version")
-		
+			
 			file(READ "/etc/debian_version" DEBIAN_RELEASE)
-			string(REGEX MATCH "[a-zA-Z0-9 /\\.]+" _ ${DEBIAN_RELEASE})
+			string(REGEX MATCH "([0-9]+\\.[0-9]+)" _ ${DEBIAN_RELEASE})
 			set(PLATFORM_VERSION ${CMAKE_MATCH_1})
-					
+			
 		endif()
 	
 	# Get centos release version
@@ -158,30 +160,24 @@ if ( PLATFORM STREQUAL "Debian" OR PLATFORM STREQUAL "Ubuntu" )
 		elseif (SUFFIX STREQUAL "64")
 			SET(ARCHITECTURE amd64)
 		endif()
-	else(NOT DPKG_CMD)
+	else( )
 		execute_process(COMMAND dpkg --print-architecture OUTPUT_VARIABLE ARCHITECTURE OUTPUT_STRIP_TRAILING_WHITESPACE)
-	endif(NOT DPKG_CMD)
+	endif( )
 	
 elseif ( ( PLATFORM STREQUAL "CentOS" ) OR ( PLATFORM STREQUAL "openSUSE" ) )
 
 	execute_process(COMMAND arch OUTPUT_VARIABLE ARCHITECTURE OUTPUT_STRIP_TRAILING_WHITESPACE)
 	
-elseif ( PLATFORM STREQUAL "OSX" )
+else ()
 
-	if ( UNIVERSAL )
+	MESSAGE(FATAL_ERROR "Unrecognized / unsupported distribution")
-		set ( ARCHITECTURE "Univesal-Binary" )
-	else ( UNIVERSAL )
-		# arch reports Intel using the i386 label rather than intel
-		# We use uname -m instead
-		execute_process(COMMAND uname -m OUTPUT_VARIABLE ARCHITECTURE OUTPUT_STRIP_TRAILING_WHITESPACE)
-	endif( UNIVERSAL )
 	
 endif ( )
 MESSAGE ( STATUS "Architecture = ${ARCHITECTURE}" )
 
 # - Create installation folder directory at install time
 #	This won't lead to the files being actually installed (in CMAKE_INSTALL_PREFIX)
-#	unless "cmake --build . --target install" is executed, which is not the case here/
+#	unless "cmake --build . --target install" is executed, which is not the case here.
 # 	
 #	Doing things like the following
 #		-	install(DIRECTORY 	${VERACRYPT_BUILD_DIR}/usr DESTINATION /)
@@ -215,21 +211,6 @@ set(CPACK_PACKAGING_INSTALL_PREFIX "/usr")
 
 file(MAKE_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/Packaging)	# creates the Packaging directory under build directory when CMake generates the build system
 
-# - We excute 'grep VERSION_STRING ../../Common/Tcdefs.h | head -n 1' to get the line which include 'VERSION_STRING'
-#	Then we delete all first characters from the beginning of the line until the first '"' to get the version in the format : "X.YYY..."
-#	Then, we remove the leading and trailing '"' characters
-#	Then, we retrieve the 'version' and the 'release'
-#	Finally, we replace '-' in the release if it exists with a '.' because CPack does not like '-' in the release
-execute_process(COMMAND grep VERSION_STRING "$ENV{SOURCEPATH}/Common/Tcdefs.h"
-				COMMAND head -n 1
-				OUTPUT_VARIABLE FULL_VERSION_LINE OUTPUT_STRIP_TRAILING_WHITESPACE)
-string(REGEX REPLACE "^[^\"]+" "" FULL_VERSION ${FULL_VERSION_LINE})
-string(REGEX REPLACE "\"" "" FULL_VERSION ${FULL_VERSION})
-string(REPLACE "." ";" FULL_VERSION_LIST ${FULL_VERSION})
-list(GET FULL_VERSION_LIST 0 VERSION)
-list(GET FULL_VERSION_LIST 1 RELEASE)
-string(REPLACE "-" "." RELEASE ${RELEASE})
-
 set( VENDOR "IDRIX" )
 set( LICENSE "VeraCrypt License" )
 set( CONTACT "VeraCrypt Team <veracrypt@idrix.fr>" )
@@ -261,16 +242,37 @@ if ( ( PLATFORM STREQUAL "Debian" ) OR ( PLATFORM STREQUAL "Ubuntu" ) )
 	set( CPACK_DEBIAN_PACKAGE_RELEASE 		${CPACK_PACKAGE_RELEASE} )
 	set( CPACK_DEBIAN_PACKAGE_ARCHITECTURE 	${ARCHITECTURE} )																	# mandatory
 	
-	set( CPACK_DEBIAN_PACKAGE_DEPENDS 		"libwxgtk3.0-0v5, libfuse2, dmsetup")
+	if (NOGUI)
-		
+		# Link against statically built wxWidgets so that we don't depend on any GTK library
+		set( CPACK_DEBIAN_PACKAGE_DEPENDS 		"libfuse2, dmsetup, sudo" )
+	else ()
+		# Link against gtk3 version of wxWidgets if >= Debian 10 or >= Ubuntu 18.04
+		# Otherwise, link against gtk2 version of wxWidgets
+		if ( ( ( PLATFORM STREQUAL "Debian" ) AND ( PLATFORM_VERSION VERSION_GREATER_EQUAL "10" ) ) 
+			OR ( ( PLATFORM STREQUAL "Ubuntu" ) AND ( PLATFORM_VERSION VERSION_GREATER_EQUAL "18.04" ) ) )
+			
+			set( CPACK_DEBIAN_PACKAGE_DEPENDS 		"libwxgtk3.0-gtk3-0v5, libfuse2, dmsetup, sudo" )										
+			
+		else ()
+			# Link against statically built wxWidgets on Ubuntu 14.04 and older, and Debian 8 and older
+			if ( ( ( PLATFORM STREQUAL "Debian" ) AND ( PLATFORM_VERSION VERSION_LESS_EQUAL "8" ) ) 
+				OR ( ( PLATFORM STREQUAL "Ubuntu" ) AND ( PLATFORM_VERSION VERSION_LESS_EQUAL "14.04" ) ) )
+				set( CPACK_DEBIAN_PACKAGE_DEPENDS 		"libgtk2.0-0, libfuse2, dmsetup, sudo" )
+			else ()
+				set( CPACK_DEBIAN_PACKAGE_DEPENDS 		"libwxgtk3.0-0v5, libfuse2, dmsetup, sudo" )
+			endif ()
+			
+		endif()
+	endif()
+
 	set( CPACK_DEBIAN_PACKAGE_MAINTAINER 	${CONTACT} )																		# mandatory
 	set( CPACK_DEBIAN_PACKAGE_DESCRIPTION 	${CPACK_PACKAGE_DESCRIPTION_SUMMARY} )												# mandatory
 	set( CPACK_DEBIAN_ARCHIVE_TYPE 			"gnutar")																			# mandatory
 	set( CPACK_DEBIAN_COMPRESSION_TYPE 		"gzip")																				# mandatory
 	set( CPACK_DEBIAN_PACKAGE_PRIORITY 		"optional" )																		# mandatory
-	set( CPACK_DEBIAN_PACKAGE_SECTION 		"libs" )		 																	# recommended, to do, Section relative to Debian sections (https://www.debian.org/doc/debian-policy/ch-archive.html#s-subsections)
+	set( CPACK_DEBIAN_PACKAGE_SECTION 		"libs" )		 																	# recommended, Section relative to Debian sections (https://www.debian.org/doc/debian-policy/ch-archive.html#s-subsections)
 	set(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA 	${DEBIAN_PREINST};${DEBIAN_POSTINST};${DEBIAN_PRERM};${DEBIAN_POSTRM})
-	set(CPACK_DEBIAN_PACKAGE_CONFLICTS 		${CONFLICT_PACKAGE})
+	set(CPACK_DEBIAN_PACKAGE_CONFLICTS 		"${CONFLICT_PACKAGE}")
 	
 elseif ( ( PLATFORM STREQUAL "CentOS" ) OR ( PLATFORM STREQUAL "openSUSE" ) )
 	
@@ -292,12 +294,23 @@ elseif ( ( PLATFORM STREQUAL "CentOS" ) OR ( PLATFORM STREQUAL "openSUSE" ) )
 	set( CPACK_RPM_PACKAGE_VENDOR 		${CPACK_PACKAGE_VENDOR} )																# mandatory
 	set( CPACK_RPM_PACKAGE_AUTOREQ 		"no" ) 																					# disable automatic shared libraries dependency detection (most of the time buggy)
 	
-	if ( PLATFORM STREQUAL "CentOS" )
+	if (NOGUI)
-		set( CPACK_RPM_PACKAGE_REQUIRES 	"fuse, device-mapper, gtk3")
+		set( CPACK_RPM_PACKAGE_REQUIRES 	"fuse, device-mapper, sudo" )
-	elseif ( PLATFORM STREQUAL "openSUSE" )
+	else ()
-		#	TODO
+		if ( PLATFORM STREQUAL "CentOS" )
+				
+			if ( DEFINED WITHGTK3 AND WITHGTK3 )
+				set( CPACK_RPM_PACKAGE_REQUIRES 	"fuse, device-mapper, gtk3, sudo" )
+			else ()
+				set( CPACK_RPM_PACKAGE_REQUIRES 	"fuse, device-mapper, gtk2, sudo" )
+			endif()
+			
+		elseif ( PLATFORM STREQUAL "openSUSE" )
+			
+			set( CPACK_RPM_PACKAGE_REQUIRES 	"fuse, device-mapper, gtk2, sudo" )
+		endif()
 	endif()
-	
+
 	set( CPACK_RPM_PRE_UNINSTALL_SCRIPT_FILE 			${RPM_PRERM})															# optional
 	
 	# Prevents CPack from generating file conflicts

src/Build/Include/Makefile.inc

@@ -14,12 +14,16 @@ $(NAME): $(NAME).a
 
 clean:
 	@echo Cleaning $(NAME)
-	rm -f $(APPNAME) $(NAME).a $(OBJS) $(OBJSEX) $(OBJS:.o=.d) *.gch
+	rm -f $(APPNAME) $(NAME).a $(OBJS) $(OBJSEX) $(OBJSNOOPT) $(OBJS:.o=.d) $(OBJSEX:.oo=.d) $(OBJSNOOPT:.o0=.d) *.gch
 
 %.o: %.c
 	@echo Compiling $(<F)
 	$(CC) $(CFLAGS) -c $< -o $@
 
+%.o0: %.c
+	@echo Compiling $(<F)
+	$(CC) $(CFLAGS) -O0 -c $< -o $@
+
 %.o: %.cpp
 	@echo Compiling $(<F)
 	$(CXX) $(CXXFLAGS) -c $< -o $@
@@ -64,10 +68,10 @@ TR_SED_BIN := tr '\n' ' ' | tr -s ' ' ',' | sed -e 's/^,//g' -e 's/,$$/n/' | tr
 
 
 # Dependencies
--include $(OBJS:.o=.d) $(OBJSEX:.oo=.d)
+-include $(OBJS:.o=.d) $(OBJSEX:.oo=.d) $(OBJSNOOPT:.o0=.d)
 
 
-$(NAME).a: $(OBJS) $(OBJSEX)
+$(NAME).a: $(OBJS) $(OBJSEX) $(OBJSNOOPT)
 	@echo Updating library $@
-	$(AR) $(AFLAGS) -rcu $@ $(OBJS) $(OBJSEX)
+	$(AR) $(AFLAGS) -rcu $@ $(OBJS) $(OBJSEX) $(OBJSNOOPT)
 	$(RANLIB) $@

src/Build/Packaging/debian-control/prerm

@@ -2,7 +2,7 @@
 V="$(mount | grep veracrypt_aux_mnt)"
 if [ ! -z "$V" ]
 then
-	echo "Error: All VeraCrypt volumes must be dismounted first." 
+	echo "Error: All VeraCrypt volumes must be dismounted first." >&2
 	exit 1
 else
 	exit 0

src/Build/Packaging/rpm-control/prerm.sh

@@ -2,7 +2,7 @@
 V="$(mount | grep veracrypt_aux_mnt)"
 if [ ! -z "$V" ]
 then
-	echo "Error: All VeraCrypt volumes must be dismounted first." 
+	echo "Error: All VeraCrypt volumes must be dismounted first." >&2
 	exit 1
 else
 	exit 0

src/Build/Resources/MacOSX/Info.plist.legacy.xml

@@ -0,0 +1,106 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist SYSTEM "file://localhost/System/Library/DTDs/PropertyList.dtd">
+<plist version="0.9">
+<dict>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+
+	<key>CFBundleIdentifier</key>
+	<string>org.idrix.VeraCrypt</string>
+	
+ 	<key>UTExportedTypeDeclarations</key>
+    <array>
+    	<dict>
+			<key>UTTypeIdentifier</key>
+			<string>org.idrix.veracrypt.hc</string>
+            
+            <key>UTTypeDescription</key>
+            <string>VeraCrypt Container File</string>
+            
+            <key>UTTypeConformsTo</key>
+            <array>
+            	<string>public.data</string>
+        	</array>
+                
+            <key>UTTypeTagSpecification</key>
+            <dict>
+                <key>public.filename-extension</key>
+                <array>
+                    <string>hc</string>
+                    <string>tc</string>
+                </array>
+                    
+                <key>public.mime-type</key>
+                <string>application/veracrypt</string>
+            </dict>
+            </dict>
+        </array>
+
+	<key>CFBundleDocumentTypes</key>
+	<array>
+    	<dict>
+     	   <key>CFBundleTypeIconFile</key>
+     	   <string>VeraCrypt_Volume.icns</string>
+    	    <key>CFBundleTypeName</key>
+        	<string>VeraCrypt Container File</string>
+	        <key>CFBundleTypeRole</key>
+    	    <string>Viewer</string>
+        	<key>LSHandlerRank</key>
+        	<string>Owner</string>
+        	<key>LSItemContentTypes</key>
+        	<array>
+            	<!-- my app supports files with my custom extension (see UTExportedTypeDeclarations) -->
+            	<string>org.idrix.veracrypt.hc</string>
+        	</array>
+    	</dict>
+	</array>
+
+	<key>CFBundleDevelopmentRegion</key>
+	<string>English</string>
+
+	<key>CFBundleExecutable</key>
+	<string>VeraCrypt</string>
+
+	<key>CFBundleIconFile</key>
+	<string>VeraCrypt.icns</string>
+
+	<key>CFBundleName</key>
+	<string>VeraCrypt</string>
+
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+
+	<key>CFBundleSignature</key>
+	<string>TRUE</string>
+
+	<key>CFBundleVersion</key>
+	<string>1.24.10</string>
+
+	<key>CFBundleShortVersionString</key>
+	<string>_VERSION_</string>
+
+	<key>CFBundleLongVersionString</key>
+	<string>VeraCrypt _VERSION_</string>
+
+	<key>LSArchitecturePriority</key>
+	<array>
+		<string>x86_64</string>
+		<string>i386</string>
+	</array>
+
+	<key>LSMinimumSystemVersion</key>
+	<string>10.7.0</string>
+
+	<key>LSRequiresCarbon</key>
+	<false/>
+
+	<key>CSResourcesFileMapped</key>
+	<true/>
+
+    <key>NSHighResolutionCapable</key>
+    <true/>
+
+    <key>NSPrincipalClass</key>
+    <string>NSApplication</string>
+</dict>
+</plist>

src/Build/Resources/MacOSX/Info.plist.xml

@@ -74,7 +74,7 @@
 	<string>TRUE</string>
 
 	<key>CFBundleVersion</key>
-	<string>1.24.6</string>
+	<string>1.24.10</string>
 
 	<key>CFBundleShortVersionString</key>
 	<string>_VERSION_</string>
@@ -82,14 +82,8 @@
 	<key>CFBundleLongVersionString</key>
 	<string>VeraCrypt _VERSION_</string>
 
-	<key>LSArchitecturePriority</key>
-	<array>
-		<string>x86_64</string>
-		<string>i386</string>
-	</array>
-
 	<key>LSMinimumSystemVersion</key>
-	<string>10.7.0</string>
+	<string>10.9.0</string>
 
 	<key>LSRequiresCarbon</key>
 	<false/>

src/Build/build_cmake_deb.sh

@@ -12,30 +12,58 @@ export SOURCEPATH=$(readlink -f "$SCRIPTPATH/..")
 # Directory where the VeraCrypt has been checked out
 export PARENTDIR=$(readlink -f "$SCRIPTPATH/../../..")
 
+# The sources of wxWidgets 3.0.4 must be extracted to the parent directory
+export WX_ROOT=$PARENTDIR/wxWidgets-3.0.4
+echo "Using wxWidgets sources in $WX_ROOT"
+
 cd $SOURCEPATH
 
+if [ "$#" = "1" ] && [ "$1" = "WXSTATIC" ]
+then
+echo "Building GUI version of VeraCrypt for DEB using wxWidgets static libraries"
+
+# This will be the temporary wxWidgets directory
+export WX_BUILD_DIR=$PARENTDIR/wxBuildGUI
+
+# To build wxWidgets without GUI
+make WXSTATIC=1 wxbuild 	|| exit 1
+make WXSTATIC=1 clean 		|| exit 1
+make WXSTATIC=1  			|| exit 1
+make WXSTATIC=1 install DESTDIR="$PARENTDIR/VeraCrypt_Setup/GUI"	|| exit 1
+
+else
+
 echo "Building GUI version of VeraCrypt for DEB using system wxWidgets"
 make clean 	|| exit 1
 make 		|| exit 1
 make install DESTDIR="$PARENTDIR/VeraCrypt_Setup/GUI"	|| exit 1
 
-echo "Building console version of VeraCrypt for DEB using system wxWidgets"
+fi
+
+echo "Building console version of VeraCrypt for DEB using wxWidgets static libraries"
+
 # This is to avoid " Error: Unable to initialize GTK+, is DISPLAY set properly?" 
 # when building over SSH without X11 Forwarding
 # export DISPLAY=:0.0
 
-make NOGUI=1 clean 	|| exit 1
+# This will be the temporary wxWidgets directory
-make NOGUI=1 		|| exit 1
+export WX_BUILD_DIR=$PARENTDIR/wxBuildConsole
-make NOGUI=1 install DESTDIR="$PARENTDIR/VeraCrypt_Setup/Console"	|| exit 1
+
+# To build wxWidgets without GUI
+make WXSTATIC=1 NOGUI=1 wxbuild 	|| exit 1
+make WXSTATIC=1 NOGUI=1 clean 		|| exit 1
+make WXSTATIC=1 NOGUI=1 			|| exit 1
+make WXSTATIC=1 NOGUI=1 install DESTDIR="$PARENTDIR/VeraCrypt_Setup/Console"	|| exit 1
 
 echo "Creating VeraCrypt DEB packages"
+
 # -DCPACK_RPM_PACKAGE_DEBUG=TRUE for debugging cpack DEB
 # -DCPACK_RPM_PACKAGE_DEBUG=TRUE for debugging cpack DEB
 
-mkdir $PARENTDIR/VeraCrypt_Packaging
+mkdir -p $PARENTDIR/VeraCrypt_Packaging/GUI
+mkdir -p $PARENTDIR/VeraCrypt_Packaging/Console
 
-cmake -H$SCRIPTPATH -B$PARENTDIR/VeraCrypt_Packaging -DVERACRYPT_BUILD_DIR="$PARENTDIR/VeraCrypt_Setup/GUI" -DNOGUI=FALSE || exit 1
+cmake -H$SCRIPTPATH -B$PARENTDIR/VeraCrypt_Packaging/GUI -DVERACRYPT_BUILD_DIR="$PARENTDIR/VeraCrypt_Setup/GUI" -DNOGUI=FALSE || exit 1
-cpack --config $PARENTDIR/VeraCrypt_Packaging/CPackConfig.cmake || exit 1
+cpack --config $PARENTDIR/VeraCrypt_Packaging/GUI/CPackConfig.cmake || exit 1
-
+cmake -H$SCRIPTPATH -B$PARENTDIR/VeraCrypt_Packaging/Console -DVERACRYPT_BUILD_DIR="$PARENTDIR/VeraCrypt_Setup/Console" -DNOGUI=TRUE || exit 1
-cmake -H$SCRIPTPATH -B$PARENTDIR/VeraCrypt_Packaging -DVERACRYPT_BUILD_DIR="$PARENTDIR/VeraCrypt_Setup/Console" -DNOGUI=TRUE || exit 1
+cpack --config $PARENTDIR/VeraCrypt_Packaging/Console/CPackConfig.cmake	|| exit 1
-cpack --config $PARENTDIR/VeraCrypt_Packaging/CPackConfig.cmake	|| exit 1

src/Build/build_cmake_opensuse.sh

@@ -0,0 +1,71 @@
+#!/bin/sh
+
+# Errors should cause script to exit
+set -e
+
+# Absolute path to this script
+export SCRIPT=$(readlink -f "$0")
+# Absolute path this script is in
+export SCRIPTPATH=$(dirname "$SCRIPT")
+# Source directory which contains the Makefile
+export SOURCEPATH=$(readlink -f "$SCRIPTPATH/..")
+# Directory where the VeraCrypt has been checked out
+export PARENTDIR=$(readlink -f "$SCRIPTPATH/../../..")
+
+# The sources of wxWidgets 3.0.4 must be extracted to the parent directory
+export WX_ROOT=$PARENTDIR/wxWidgets-3.0.4
+echo "Using wxWidgets sources in $WX_ROOT"
+
+cd $SOURCEPATH
+
+echo "Building GUI version of VeraCrypt for RPM using wxWidgets static libraries"
+
+# This will be the temporary wxWidgets directory
+export WX_BUILD_DIR=$PARENTDIR/wxBuildGui
+
+# To build wxWidgets using GTK-2
+make WXSTATIC=1 wxbuild 	|| exit 1
+ln -s $WX_BUILD_DIR/lib  $WX_BUILD_DIR/lib64
+make WXSTATIC=1 clean 				|| exit 1
+make WXSTATIC=1 					|| exit 1
+make WXSTATIC=1 install DESTDIR="$PARENTDIR/VeraCrypt_Setup/GUI"	|| exit 1
+
+# Uncomment below and comment lines above to reuse existing wxWidgets build
+# make WXSTATIC=1 clean || exit 1
+# make WXSTATIC=1		|| exit 1
+# make WXSTATIC=1 install DESTDIR="$PARENTDIR/VeraCrypt_Setup/GUI"	|| exit 1
+
+echo "Building console version of VeraCrypt for RPM using wxWidgets static libraries"
+
+# This is to avoid " Error: Unable to initialize GTK+, is DISPLAY set properly?" 
+# when building over SSH without X11 Forwarding
+# export DISPLAY=:0.0
+
+# This will be the temporary wxWidgets directory
+export WX_BUILD_DIR=$PARENTDIR/wxBuildConsole
+
+# To build wxWidgets using GTK-2
+make WXSTATIC=1 NOGUI=1 wxbuild 	|| exit 1
+ln -s $WX_BUILD_DIR/lib  $WX_BUILD_DIR/lib64
+make WXSTATIC=1 NOGUI=1 clean 				|| exit 1
+make WXSTATIC=1 NOGUI=1 					|| exit 1
+make WXSTATIC=1 NOGUI=1 install DESTDIR="$PARENTDIR/VeraCrypt_Setup/Console"	|| exit 1
+
+# Uncomment below and comment lines above to reuse existing wxWidgets build
+# make WXSTATIC=1 NOGUI=1 clean || exit 1
+# make WXSTATIC=1 NOGUI=1		|| exit 1
+# make WXSTATIC=1 NOGUI=1 install DESTDIR="$PARENTDIR/VeraCrypt_Setup/Console"	|| exit 1
+
+echo "Creating VeraCrypt RPM packages "
+
+# -DCPACK_RPM_PACKAGE_DEBUG=TRUE for debugging cpack RPM
+# -DCPACK_RPM_PACKAGE_DEBUG=TRUE for debugging cpack RPM
+
+mkdir -p $PARENTDIR/VeraCrypt_Packaging/GUI
+mkdir -p $PARENTDIR/VeraCrypt_Packaging/Console
+
+# wxWidgets was built using GTK-2
+cmake -H$SCRIPTPATH -B$PARENTDIR/VeraCrypt_Packaging/GUI -DVERACRYPT_BUILD_DIR="$PARENTDIR/VeraCrypt_Setup/GUI" -DWITHGTK3=TRUE -DNOGUI=FALSE || exit 1		
+cpack --config $PARENTDIR/VeraCrypt_Packaging/GUI/CPackConfig.cmake || exit 1
+cmake -H$SCRIPTPATH -B$PARENTDIR/VeraCrypt_Packaging/Console -DVERACRYPT_BUILD_DIR="$PARENTDIR/VeraCrypt_Setup/Console" -DWITHGTK3=TRUE -DNOGUI=TRUE || exit 1
+cpack --config $PARENTDIR/VeraCrypt_Packaging/Console/CPackConfig.cmake|| exit 1

src/Build/build_cmake_rpm_gtk2.sh

@@ -23,12 +23,13 @@ echo "Building GUI version of VeraCrypt for RPM using wxWidgets static libraries
 # This will be the temporary wxWidgets directory
 export WX_BUILD_DIR=$PARENTDIR/wxBuildGui
 
-make WXSTATIC=1 WITHGTK3=1 wxbuild || exit 1
+# To build wxWidgets using GTK-2
-make WXSTATIC=1 clean 	|| exit 1
+make WXSTATIC=1 wxbuild 			|| exit 1
-make WXSTATIC=1 		|| exit 1
+make WXSTATIC=1 clean 				|| exit 1
+make WXSTATIC=1 					|| exit 1
 make WXSTATIC=1 install DESTDIR="$PARENTDIR/VeraCrypt_Setup/GUI"	|| exit 1
 
-# Uncomment below and comment line above to reuse existing wxWidgets build
+# Uncomment below and comment lines above to reuse existing wxWidgets build
 # make WXSTATIC=1 clean || exit 1
 # make WXSTATIC=1		|| exit 1
 # make WXSTATIC=1 install DESTDIR="$PARENTDIR/VeraCrypt_Setup/GUI"	|| exit 1
@@ -42,9 +43,10 @@ echo "Building console version of VeraCrypt for RPM using wxWidgets static libra
 # This will be the temporary wxWidgets directory
 export WX_BUILD_DIR=$PARENTDIR/wxBuildConsole
 
-make WXSTATIC=1 WITHGTK3=1 NOGUI=1 wxbuild || exit 1
+# To build wxWidgets using GTK-2
-make WXSTATIC=1 NOGUI=1 clean 	|| exit 1
+make WXSTATIC=1 NOGUI=1 wxbuild 			|| exit 1
-make WXSTATIC=1 NOGUI=1 		|| exit 1
+make WXSTATIC=1 NOGUI=1 clean 				|| exit 1
+make WXSTATIC=1 NOGUI=1 					|| exit 1
 make WXSTATIC=1 NOGUI=1 install DESTDIR="$PARENTDIR/VeraCrypt_Setup/Console"	|| exit 1
 
 # Uncomment below and comment lines above to reuse existing wxWidgets build
@@ -53,13 +55,15 @@ make WXSTATIC=1 NOGUI=1 install DESTDIR="$PARENTDIR/VeraCrypt_Setup/Console"	||
 # make WXSTATIC=1 NOGUI=1 install DESTDIR="$PARENTDIR/VeraCrypt_Setup/Console"	|| exit 1
 
 echo "Creating VeraCrypt RPM packages "
+
 # -DCPACK_RPM_PACKAGE_DEBUG=TRUE for debugging cpack RPM
 # -DCPACK_RPM_PACKAGE_DEBUG=TRUE for debugging cpack RPM
 
-mkdir $PARENTDIR/VeraCrypt_Packaging
+mkdir -p $PARENTDIR/VeraCrypt_Packaging/GUI
+mkdir -p $PARENTDIR/VeraCrypt_Packaging/Console
 
-cmake -H$SCRIPTPATH -B$PARENTDIR/VeraCrypt_Packaging -DVERACRYPT_BUILD_DIR="$PARENTDIR/VeraCrypt_Setup/GUI" -DNOGUI=FALSE || exit 1		
+# wxWidgets was built using GTK-2
-cpack --config $PARENTDIR/VeraCrypt_Packaging/CPackConfig.cmake || exit 1
+cmake -H$SCRIPTPATH -B$PARENTDIR/VeraCrypt_Packaging/GUI -DVERACRYPT_BUILD_DIR="$PARENTDIR/VeraCrypt_Setup/GUI" -DWITHGTK3=FALSE -DNOGUI=FALSE || exit 1
-
+cpack --config $PARENTDIR/VeraCrypt_Packaging/GUI/CPackConfig.cmake || exit 1
-cmake -H$SCRIPTPATH -B$PARENTDIR/VeraCrypt_Packaging -DVERACRYPT_BUILD_DIR="$PARENTDIR/VeraCrypt_Setup/Console" -DNOGUI=TRUE || exit 1
+cmake -H$SCRIPTPATH -B$PARENTDIR/VeraCrypt_Packaging/Console -DVERACRYPT_BUILD_DIR="$PARENTDIR/VeraCrypt_Setup/Console" -DWITHGTK3=FALSE -DNOGUI=TRUE || exit 1
-cpack --config $PARENTDIR/VeraCrypt_Packaging/CPackConfig.cmake|| exit 1
+cpack --config $PARENTDIR/VeraCrypt_Packaging/Console/CPackConfig.cmake || exit 1

src/Build/build_cmake_rpm_gtk3.sh

@@ -0,0 +1,69 @@
+#!/bin/sh
+
+# Errors should cause script to exit
+set -e
+
+# Absolute path to this script
+export SCRIPT=$(readlink -f "$0")
+# Absolute path this script is in
+export SCRIPTPATH=$(dirname "$SCRIPT")
+# Source directory which contains the Makefile
+export SOURCEPATH=$(readlink -f "$SCRIPTPATH/..")
+# Directory where the VeraCrypt has been checked out
+export PARENTDIR=$(readlink -f "$SCRIPTPATH/../../..")
+
+# The sources of wxWidgets 3.0.4 must be extracted to the parent directory
+export WX_ROOT=$PARENTDIR/wxWidgets-3.0.4
+echo "Using wxWidgets sources in $WX_ROOT"
+
+cd $SOURCEPATH
+
+echo "Building GUI version of VeraCrypt for RPM using wxWidgets static libraries"
+
+# This will be the temporary wxWidgets directory
+export WX_BUILD_DIR=$PARENTDIR/wxBuildGui
+
+# To build wxWidgets using GTK-3
+make WXSTATIC=1 WITHGTK3=1 wxbuild 	|| exit 1
+make WXSTATIC=1 clean 				|| exit 1
+make WXSTATIC=1 					|| exit 1
+make WXSTATIC=1 install DESTDIR="$PARENTDIR/VeraCrypt_Setup/GUI"	|| exit 1
+
+# Uncomment below and comment lines above to reuse existing wxWidgets build
+# make WXSTATIC=1 clean || exit 1
+# make WXSTATIC=1		|| exit 1
+# make WXSTATIC=1 install DESTDIR="$PARENTDIR/VeraCrypt_Setup/GUI"	|| exit 1
+
+echo "Building console version of VeraCrypt for RPM using wxWidgets static libraries"
+
+# This is to avoid " Error: Unable to initialize GTK+, is DISPLAY set properly?" 
+# when building over SSH without X11 Forwarding
+# export DISPLAY=:0.0
+
+# This will be the temporary wxWidgets directory
+export WX_BUILD_DIR=$PARENTDIR/wxBuildConsole
+
+# To build wxWidgets using GTK-3
+make WXSTATIC=1 WITHGTK3=1 NOGUI=1 wxbuild 	|| exit 1
+make WXSTATIC=1 NOGUI=1 clean 				|| exit 1
+make WXSTATIC=1 NOGUI=1 					|| exit 1
+make WXSTATIC=1 NOGUI=1 install DESTDIR="$PARENTDIR/VeraCrypt_Setup/Console"	|| exit 1
+
+# Uncomment below and comment lines above to reuse existing wxWidgets build
+# make WXSTATIC=1 NOGUI=1 clean || exit 1
+# make WXSTATIC=1 NOGUI=1		|| exit 1
+# make WXSTATIC=1 NOGUI=1 install DESTDIR="$PARENTDIR/VeraCrypt_Setup/Console"	|| exit 1
+
+echo "Creating VeraCrypt RPM packages "
+
+# -DCPACK_RPM_PACKAGE_DEBUG=TRUE for debugging cpack RPM
+# -DCPACK_RPM_PACKAGE_DEBUG=TRUE for debugging cpack RPM
+
+mkdir -p $PARENTDIR/VeraCrypt_Packaging/GUI
+mkdir -p $PARENTDIR/VeraCrypt_Packaging/Console
+
+# wxWidgets was built using GTK-3
+cmake -H$SCRIPTPATH -B$PARENTDIR/VeraCrypt_Packaging/GUI -DVERACRYPT_BUILD_DIR="$PARENTDIR/VeraCrypt_Setup/GUI" -DWITHGTK3=TRUE -DNOGUI=FALSE || exit 1		
+cpack --config $PARENTDIR/VeraCrypt_Packaging/GUI/CPackConfig.cmake || exit 1
+cmake -H$SCRIPTPATH -B$PARENTDIR/VeraCrypt_Packaging/Console -DVERACRYPT_BUILD_DIR="$PARENTDIR/VeraCrypt_Setup/Console" -DWITHGTK3=TRUE -DNOGUI=TRUE || exit 1
+cpack --config $PARENTDIR/VeraCrypt_Packaging/Console/CPackConfig.cmake|| exit 1

src/Build/build_veracrypt_macosx.sh

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2013-2017 IDRIX
+# Copyright (c) 2013-2019 IDRIX
 # Governed by the Apache License 2.0 the full text of which is contained
 # in the file License.txt included in VeraCrypt binary and source
 # code distribution packages.
@@ -12,22 +12,22 @@ SOURCEPATH=$(cd "$(dirname "$SCRIPTPATH/../.")"; pwd)
 # directory where the VeraCrypt project has been checked out
 PARENTDIR=$(cd "$(dirname "$SCRIPTPATH/../../../.")"; pwd)
 
-# the sources of wxWidgets 3.0.3 must be extracted to the parent directory
+# the sources of wxWidgets 3.1.2 must be extracted to the parent directory (for night mode)
-export WX_ROOT=$PARENTDIR/wxWidgets-3.0.4
+export WX_ROOT=$PARENTDIR/wxWidgets-3.1.2
 echo "Using wxWidgets sources in $WX_ROOT"
 
 # this will be the temporary wxWidgets directory
-export WX_BUILD_DIR=$PARENTDIR/wxBuild
+export WX_BUILD_DIR=$PARENTDIR/wxBuild-3.1.2
-
-# define the SDK version to use. We use 10.7 by default
-export VC_OSX_TARGET=10.7
-echo "Using MacOSX SDK $VC_OSX_TARGET"
 
+# define the SDK version to use and OSX minimum target. We target 10.9 by default
+export VC_OSX_TARGET=10.9
+export VC_OSX_SDK=10.14
+echo "Using MacOSX SDK $VC_OSX_SDK with target set to $VC_OSX_TARGET"
 
 cd $SOURCEPATH
 
 echo "Building VeraCrypt"
-make WXSTATIC=1 wxbuild && make WXSTATIC=1 clean && make WXSTATIC=1 && make WXSTATIC=1 package
+make WXSTATIC=FULL wxbuild && make WXSTATIC=FULL clean && make WXSTATIC=FULL && make WXSTATIC=FULL package
 
 # Uncomment below and comment line above to reuse existing wxWidgets build
-# make WXSTATIC=1 clean && make WXSTATIC=1 && make WXSTATIC=1 package
+# make WXSTATIC=FULL clean && make WXSTATIC=FULL && make WXSTATIC=FULL package

src/Build/build_veracrypt_macosx_legacy.sh

@@ -0,0 +1,33 @@
+#
+# Copyright (c) 2013-2017 IDRIX
+# Governed by the Apache License 2.0 the full text of which is contained
+# in the file License.txt included in VeraCrypt binary and source
+# code distribution packages.
+#
+
+# Absolute path this script is in
+SCRIPTPATH=$(cd "$(dirname "$0")"; pwd)
+# source directory which contains the Makefile
+SOURCEPATH=$(cd "$(dirname "$SCRIPTPATH/../.")"; pwd)
+# directory where the VeraCrypt project has been checked out
+PARENTDIR=$(cd "$(dirname "$SCRIPTPATH/../../../.")"; pwd)
+
+# the sources of wxWidgets 3.1.2 must be extracted to the parent directory
+export WX_ROOT=$PARENTDIR/wxWidgets-3.1.2
+echo "Using wxWidgets sources in $WX_ROOT"
+# this will be the temporary wxWidgets directory
+export WX_BUILD_DIR=$PARENTDIR/wxBuild
+
+# define the SDK version to use. We use 10.7 by default
+export VC_OSX_TARGET=10.7
+export VC_OSX_SDK=10.9
+echo "Using MacOSX SDK $VC_OSX_TARGET"
+
+
+cd $SOURCEPATH
+
+echo "Building VeraCrypt"
+make WXSTATIC=FULL wxbuild && make WXSTATIC=FULL clean && make WXSTATIC=FULL && make WXSTATIC=FULL package
+
+# Uncomment below and comment line above to reuse existing wxWidgets build
+# make WXSTATIC=FULL clean && make WXSTATIC=FULL && make WXSTATIC=FULL package

src/Common/BootEncryption.h

@@ -29,6 +29,10 @@ typedef NTSTATUS (WINAPI *NtQuerySystemInformationFn)(
 		PULONG                   ReturnLength
 );
 
+typedef ULONG (WINAPI *RtlNtStatusToDosErrorFn)(
+  NTSTATUS Status
+);
+
 using namespace std;
 
 namespace VeraCrypt
@@ -189,9 +193,11 @@ namespace VeraCrypt
 		BOOL Load (const wchar_t* fileName);
 		void Load (char* configContent);
 		BOOL Save (const wchar_t* fileName, HWND hwnd);
+		static BOOL IsPostExecFileField (const string& szFieldValue, string& filePath);
+		static BOOL IsPostExecFileField (const string& szFieldValue, wstring& filePath);
 	};
 
-	void GetVolumeESP(wstring& path);
+	void GetVolumeESP(wstring& path, wstring& bootVolumePath);
 	std::string ReadESPFile (LPCWSTR szFilePath, bool bSkipUTF8BOM);
 	void WriteESPFile (LPCWSTR szFilePath, LPBYTE pbData, DWORD dwDataLen, bool bAddUTF8BOM);
 
@@ -199,16 +205,18 @@ namespace VeraCrypt
 	public:
 		EfiBoot();
 
-		void PrepareBootPartition();
+		void PrepareBootPartition(bool bDisableException = false);
 		bool IsEfiBoot();
 
 		void DeleteStartExec(uint16 statrtOrderNum = 0xDC5B, wchar_t* type = NULL);
-		void SetStartExec(wstring description, wstring execPath, uint16 statrtOrderNum = 0xDC5B, wchar_t* type = NULL, uint32 attr = 1);
+		void SetStartExec(wstring description, wstring execPath, bool setBootEntry = true, bool forceFirstBootEntry = true, bool setBootNext = true, uint16 statrtOrderNum = 0xDC5B, wchar_t* type = NULL, uint32 attr = 1);
 		void SaveFile(const wchar_t* name, byte* data, DWORD size);
 		void GetFileSize(const wchar_t* name, unsigned __int64& size);
 		void ReadFile(const wchar_t* name, byte* data, DWORD size);
 		void CopyFile(const wchar_t* name, const wchar_t* targetName);
 		bool FileExists(const wchar_t* name);
+		static bool CompareFiles (const wchar_t* fileName1, const wchar_t* fileName2);
+		static bool CompareFileData (const wchar_t* fileName, const byte* data, DWORD size);
 
 		BOOL RenameFile(const wchar_t* name, const wchar_t* nameNew, BOOL bForce);
 		BOOL DelFile(const wchar_t* name);
@@ -217,23 +225,22 @@ namespace VeraCrypt
 		BOOL UpdateConfig (const wchar_t* name, int pim, int hashAlgo, HWND hwndDlg);
 		BOOL WriteConfig (const wchar_t* name, bool preserveUserConfig, int pim, int hashAlgo, const char* passPromptMsg, HWND hwndDlg);
 		BOOL DelDir(const wchar_t* name);
-		void SelectBootVolumeESP();
+		PSTORAGE_DEVICE_NUMBER GetStorageDeviceNumber () { if (bDeviceInfoValid) return &sdn; else { SetLastError (ERROR_INVALID_DRIVE); throw SystemException(SRC_POS);}}
-		PSTORAGE_DEVICE_NUMBER GetStorageDeviceNumber () { return &sdn;}
 
 	protected:
 		bool m_bMounted;
 		std::wstring	EfiBootPartPath;
 		STORAGE_DEVICE_NUMBER sdn;
 		PARTITION_INFORMATION_EX partInfo;
+		bool bDeviceInfoValid;
 		WCHAR     tempBuf[1024];
-		bool  bBootVolumePathSelected;
 		std::wstring BootVolumePath;
 	};
 
 	class BootEncryption
 	{
 	public:
-		BootEncryption (HWND parent, bool postOOBE = false);
+		BootEncryption (HWND parent, bool postOOBE = false, bool setBootEntry = true, bool forceFirstBootEntry = true, bool setBootNext = false);
 		~BootEncryption ();
 
 		enum FilterType
@@ -285,6 +292,7 @@ namespace VeraCrypt
 		void RegisterFilterDriver (bool registerDriver, FilterType filterType);
 		void RegisterSystemFavoritesService (BOOL registerService);
 		void RegisterSystemFavoritesService (BOOL registerService, BOOL noFileHandling);
+		bool IsSystemFavoritesServiceRunning ();
 		void UpdateSystemFavoritesService ();
 		void RenameDeprecatedSystemLoaderBackup ();
 		bool RestartComputer (BOOL bShutdown = FALSE);
@@ -344,6 +352,9 @@ namespace VeraCrypt
 		bool RescueVolumeHeaderValid;
 		bool VolumeHeaderValid;
 		bool PostOOBEMode;
+		bool SetBootNext;
+		bool SetBootEntry;
+		bool ForceFirstBootEntry;
 	};
 }
 
@@ -361,6 +372,9 @@ namespace VeraCrypt
 #define VC_SYSTEM_FAVORITES_SERVICE_ARG_SKIP_MOUNT		L"/SkipMount"
 
 #define VC_SYSTEM_FAVORITES_SERVICE_CONFIG_DONT_UPDATE_LOADER			0x1
+#define VC_SYSTEM_FAVORITES_SERVICE_CONFIG_FORCE_SET_BOOTNEXT			0x2
+#define VC_SYSTEM_FAVORITES_SERVICE_CONFIG_DONT_SET_BOOTENTRY			0x4
+#define VC_SYSTEM_FAVORITES_SERVICE_CONFIG_DONT_FORCE_FIRST_BOOTENTRY	0x8
 
 #define VC_WINDOWS_UPGRADE_POSTOOBE_CMDLINE_OPTION		L"/PostOOBE"
 

src/Common/Crypto.c

@@ -252,7 +252,7 @@ void EncipherBlocks (int cipher, void *dataPtr, void *ks, size_t blockCount)
 #endif
 	}
 #endif
-#if CRYPTOPP_BOOL_X64
+#if CRYPTOPP_BOOL_X64 && !defined(CRYPTOPP_DISABLE_ASM)
    else if (cipher == TWOFISH)	{
 			twofish_encrypt_blocks(ks, data, data, (uint32) blockCount);
 	}
@@ -369,7 +369,7 @@ void DecipherBlocks (int cipher, void *dataPtr, void *ks, size_t blockCount)
 #endif
 	}
 #endif
-#if CRYPTOPP_BOOL_X64
+#if CRYPTOPP_BOOL_X64 && !defined(CRYPTOPP_DISABLE_ASM)
    else if (cipher == TWOFISH)	{
 			twofish_decrypt_blocks(ks, data, data, (uint32) blockCount);
 	}
@@ -464,7 +464,7 @@ BOOL CipherSupportsIntraDataUnitParallelization (int cipher)
 		|| (cipher == SERPENT && HasSSE2())
 		|| (cipher == KUZNYECHIK && HasSSE2())
 #endif
-#if CRYPTOPP_BOOL_X64
+#if CRYPTOPP_BOOL_X64 && !defined(CRYPTOPP_DISABLE_ASM)
 		|| (cipher == TWOFISH)
 		|| (cipher == CAMELLIA)
 #endif

src/Common/Dlgcode.c

@@ -300,6 +300,7 @@ HMODULE hntmartadll = NULL;
 HMODULE hwinscarddll = NULL;
 HMODULE hmsvcrtdll = NULL;
 HMODULE hWinTrustLib = NULL;
+HMODULE hAdvapi32Dll = NULL;
 
 #define FREE_DLL(h)	if (h) { FreeLibrary (h); h = NULL;}
 
@@ -336,6 +337,18 @@ typedef HRESULT (STDAPICALLTYPE *SHStrDupWPtr)(LPCWSTR psz, LPWSTR *ppwsz);
 // ChangeWindowMessageFilter
 typedef BOOL (WINAPI *ChangeWindowMessageFilterPtr) (UINT, DWORD);
 
+typedef BOOL (WINAPI *CreateProcessWithTokenWFn)(
+    __in        HANDLE hToken,
+    __in        DWORD dwLogonFlags,
+    __in_opt    LPCWSTR lpApplicationName,
+    __inout_opt LPWSTR lpCommandLine,
+    __in        DWORD dwCreationFlags,
+    __in_opt    LPVOID lpEnvironment,
+    __in_opt    LPCWSTR lpCurrentDirectory,
+    __in        LPSTARTUPINFOW lpStartupInfo,
+    __out       LPPROCESS_INFORMATION lpProcessInformation
+      );
+
 SetDllDirectoryPtr SetDllDirectoryFn = NULL;
 SetSearchPathModePtr SetSearchPathModeFn = NULL;
 SetDefaultDllDirectoriesPtr SetDefaultDllDirectoriesFn = NULL;
@@ -350,6 +363,7 @@ SetupOpenInfFileWPtr SetupOpenInfFileWFn = NULL;
 SHDeleteKeyWPtr SHDeleteKeyWFn = NULL;
 SHStrDupWPtr SHStrDupWFn = NULL;
 ChangeWindowMessageFilterPtr ChangeWindowMessageFilterFn = NULL;
+CreateProcessWithTokenWFn CreateProcessWithTokenWPtr = NULL;
 
 typedef LONG (WINAPI *WINVERIFYTRUST)(HWND hwnd, GUID *pgActionID, LPVOID pWVTData);
 typedef CRYPT_PROVIDER_DATA* (WINAPI *WTHELPERPROVDATAFROMSTATEDATA)(HANDLE hStateData);
@@ -758,6 +772,7 @@ void AbortProcessDirect (wchar_t *abortMsg)
 	FREE_DLL (hntmartadll);
 	FREE_DLL (hwinscarddll);
 	FREE_DLL (hmsvcrtdll);
+	FREE_DLL (hAdvapi32Dll);
 
 	exit (1);
 }
@@ -808,6 +823,7 @@ void AbortProcessSilent (void)
 	FREE_DLL (hntmartadll);
 	FREE_DLL (hwinscarddll);
 	FREE_DLL (hmsvcrtdll);
+	FREE_DLL (hAdvapi32Dll);
 
 	// Note that this function also causes localcleanup() to be called (see atexit())
 	exit (1);
@@ -3014,6 +3030,7 @@ void InitApp (HINSTANCE hInstance, wchar_t *lpszCommandLine)
 		AbortProcess ("INIT_DLL");
 
 	LoadSystemDll (L"Riched20.dll", &hRichEditDll, FALSE, SRC_POS);
+	LoadSystemDll (L"Advapi32.dll", &hAdvapi32Dll, FALSE, SRC_POS);
 
 #if !defined(SETUP)
 	if (!VerifyModuleSignature (modPath))
@@ -3047,6 +3064,9 @@ void InitApp (HINSTANCE hInstance, wchar_t *lpszCommandLine)
 #endif
 	}
 
+	// Get CreateProcessWithTokenW function pointer
+	CreateProcessWithTokenWPtr = (CreateProcessWithTokenWFn) GetProcAddress(hAdvapi32Dll, "CreateProcessWithTokenW");
+
 	/* Save the instance handle for later */
 	hInst = hInstance;
 
@@ -3271,6 +3291,7 @@ void InitApp (HINSTANCE hInstance, wchar_t *lpszCommandLine)
 		FREE_DLL (hntmartadll);
 		FREE_DLL (hwinscarddll);
 		FREE_DLL (hmsvcrtdll);
+		FREE_DLL (hAdvapi32Dll);
 		exit (1);
 	}
 #endif
@@ -3316,6 +3337,7 @@ void FinalizeApp (void)
 	FREE_DLL (hntmartadll);
 	FREE_DLL (hwinscarddll);
 	FREE_DLL (hmsvcrtdll);
+	FREE_DLL (hAdvapi32Dll);
 }
 
 void InitHelpFileName (void)
@@ -5101,7 +5123,7 @@ void OpenVolumeExplorerWindow (int driveNo)
 	// Force explorer to discover the drive
 	SHGetFileInfo (dosName, 0, &fInfo, sizeof (fInfo), 0);
 
-	ShellExecute (NULL, L"open", dosName, NULL, NULL, SW_SHOWNORMAL);
+	SafeOpenURL (dosName);
 }
 
 static BOOL explorerCloseSent;
@@ -7370,6 +7392,15 @@ BOOL CheckFileExtension (wchar_t *fileName)
 	return FALSE;
 }
 
+BOOL IsTrueCryptFileExtension (wchar_t *fileName)
+{
+	wchar_t *ext = wcsrchr (fileName, L'.');
+	if (ext && !_wcsicmp (ext, L".tc"))
+		return TRUE;
+	else
+		return FALSE;
+}
+
 void CorrectFileName (wchar_t* fileName)
 {
 	/* replace '/' by '\' */
@@ -10499,25 +10530,37 @@ void ConfigReadCompareString (char *configKey, char *defaultValue, char *str, in
 
 void OpenPageHelp (HWND hwndDlg, int nPage)
 {
-	int r = (int)ShellExecuteW (NULL, L"open", szHelpFile, NULL, NULL, SW_SHOWNORMAL);
+	if (IsAdmin ())
-
-	if (r == ERROR_FILE_NOT_FOUND)
 	{
-		// Try the secondary help file
+		if (FileExists (szHelpFile))
-		r = (int)ShellExecuteW (NULL, L"open", szHelpFile2, NULL, NULL, SW_SHOWNORMAL);
+			SafeOpenURL (szHelpFile);
+		else if (FileExists (szHelpFile2))
+			SafeOpenURL (szHelpFile2);
+		else
+			Applink ("help");
+	}
+	else
+	{
+		int r = (int)ShellExecuteW (NULL, L"open", szHelpFile, NULL, NULL, SW_SHOWNORMAL);
 
 		if (r == ERROR_FILE_NOT_FOUND)
 		{
-			// Open local HTML help. It will fallback to online help if not found.
+			// Try the secondary help file
-			Applink ("help");
+			r = (int)ShellExecuteW (NULL, L"open", szHelpFile2, NULL, NULL, SW_SHOWNORMAL);
-			return;
-		}
-	}
 
-	if (r == SE_ERR_NOASSOC)
+			if (r == ERROR_FILE_NOT_FOUND)
-	{
+			{
-		if (AskYesNo ("HELP_READER_ERROR", MainDlg) == IDYES)
+				// Open local HTML help. It will fallback to online help if not found.
-			OpenOnlineHelp ();
+				Applink ("help");
+				return;
+			}
+		}
+
+		if (r == SE_ERR_NOASSOC)
+		{
+			if (AskYesNo ("HELP_READER_ERROR", MainDlg) == IDYES)
+				OpenOnlineHelp ();
+		}
 	}
 }
 
@@ -11021,14 +11064,30 @@ void Applink (const char *dest)
 		CorrectURL (url);
 	}
 
-	r = (int) ShellExecuteW (NULL, L"open", url, NULL, NULL, SW_SHOWNORMAL);
+	if (IsAdmin ())
-
-	if (((r == ERROR_FILE_NOT_FOUND) || (r == ERROR_PATH_NOT_FOUND)) && buildUrl)
 	{
-		// fallbacl to online resources
+		if (buildUrl && !FileExists (url))
-		StringCbPrintfW (url, sizeof (url), L"https://www.veracrypt.fr/en/%s", page);
+		{
-		ShellExecuteW (NULL, L"open", url, NULL, NULL, SW_SHOWNORMAL);
+			// fallbacl to online resources
-	}			
+			StringCbPrintfW (url, sizeof (url), L"https://www.veracrypt.fr/en/%s", page);
+			SafeOpenURL (url);
+		}
+		else
+		{
+			SafeOpenURL (url);
+		}
+	}
+	else
+	{
+		r = (int) ShellExecuteW (NULL, L"open", url, NULL, NULL, SW_SHOWNORMAL);
+
+		if (((r == ERROR_FILE_NOT_FOUND) || (r == ERROR_PATH_NOT_FOUND)) && buildUrl)
+		{
+			// fallbacl to online resources
+			StringCbPrintfW (url, sizeof (url), L"https://www.veracrypt.fr/en/%s", page);
+			ShellExecuteW (NULL, L"open", url, NULL, NULL, SW_SHOWNORMAL);
+		}			
+	}
 
 	Sleep (200);
 	NormalCursor ();
@@ -11142,7 +11201,7 @@ void InconsistencyResolved (char *techInfo)
 }
 
 
-void ReportUnexpectedState (char *techInfo)
+void ReportUnexpectedState (const char *techInfo)
 {
 	wchar_t finalMsg[8024];
 
@@ -11188,10 +11247,8 @@ int OpenVolume (OpenVolumeContext *context, const wchar_t *volumePath, Password
 	else
 		StringCbCopyW (szCFDevice, sizeof(szCFDevice), szDiskFile);
 
-	if (preserveTimestamps)
-		write = TRUE;
 
-	context->HostFileHandle = CreateFile (szCFDevice, GENERIC_READ | (write ? GENERIC_WRITE : 0), FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
+	context->HostFileHandle = CreateFile (szCFDevice, GENERIC_READ | (write ? GENERIC_WRITE : (!context->IsDevice && preserveTimestamps? FILE_WRITE_ATTRIBUTES : 0)), FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
 
 	if (context->HostFileHandle == INVALID_HANDLE_VALUE)
 	{
@@ -11213,6 +11270,13 @@ int OpenVolume (OpenVolumeContext *context, const wchar_t *volumePath, Password
 	// Remember the container modification/creation date and time
 	if (!context->IsDevice && preserveTimestamps)
 	{
+		// ensure that Last Access and Last Write timestamps are not modified
+		FILETIME ftLastAccessTime;
+		ftLastAccessTime.dwHighDateTime = 0xFFFFFFFF;
+		ftLastAccessTime.dwLowDateTime = 0xFFFFFFFF;
+
+		SetFileTime (context->HostFileHandle, NULL, &ftLastAccessTime, NULL);
+
 		if (GetFileTime (context->HostFileHandle, &context->CreationTime, &context->LastAccessTime, &context->LastWriteTime) == 0)
 			context->TimestampsValid = FALSE;
 		else
@@ -12685,19 +12749,16 @@ void CheckFilesystem (HWND hwndDlg, int driveNo, BOOL fixErrors)
 	ShellExecuteW (NULL, (!IsAdmin() && IsUacSupported()) ? L"runas" : L"open", cmdPath, param, NULL, SW_SHOW);
 }
 
-
+BOOL BufferContainsPattern (const byte *buffer, size_t bufferSize, const byte *pattern, size_t patternSize)
-BOOL BufferContainsString (const byte *buffer, size_t bufferSize, const char *str)
 {
-	size_t strLen = strlen (str);
+	if (bufferSize < patternSize)
-
-	if (bufferSize < strLen)
 		return FALSE;
 
-	bufferSize -= strLen;
+	bufferSize -= patternSize;
 
 	for (size_t i = 0; i < bufferSize; ++i)
 	{
-		if (memcmp (buffer + i, str, strLen) == 0)
+		if (memcmp (buffer + i, pattern, patternSize) == 0)
 			return TRUE;
 	}
 
@@ -12705,6 +12766,17 @@ BOOL BufferContainsString (const byte *buffer, size_t bufferSize, const char *st
 }
 
 
+BOOL BufferContainsString (const byte *buffer, size_t bufferSize, const char *str)
+{
+	return BufferContainsPattern (buffer, bufferSize, (const byte*) str, strlen (str));
+}
+
+BOOL BufferContainsWideString (const byte *buffer, size_t bufferSize, const wchar_t *str)
+{
+	return BufferContainsPattern (buffer, bufferSize, (const byte*) str, 2 * wcslen (str));
+}
+
+
 #ifndef SETUP
 
 int AskNonSysInPlaceEncryptionResume (HWND hwndDlg, BOOL *pbDecrypt)
@@ -13104,7 +13176,7 @@ BOOL GetPassword (HWND hwndDlg, UINT ctrlID, char* passValue, int bufSize, BOOL
 		{
 			SetFocus (GetDlgItem(hwndDlg, ctrlID));
 			if (GetLastError () == ERROR_INSUFFICIENT_BUFFER)
-				Error ("PASSWORD_UTF8_TOO_LONG", hwndDlg);
+				Error ((bufSize == (MAX_LEGACY_PASSWORD + 1))? "LEGACY_PASSWORD_UTF8_TOO_LONG": "PASSWORD_UTF8_TOO_LONG", hwndDlg);
 			else
 				Error ("PASSWORD_UTF8_INVALID", hwndDlg);
 		}
@@ -13959,6 +14031,17 @@ BOOL EnableProcessProtection()
     PACL pACL = NULL;
     DWORD cbACL = 0;
 
+	// Acces mask
+	DWORD dwAccessMask = SYNCHRONIZE | PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_TERMINATE; // same as protected process
+	
+	if (IsAdmin ())
+	{
+		// if we are running elevated, we allow CreateProcessXXX calls alongside PROCESS_DUP_HANDLE and PROCESS_QUERY_INFORMATION in order to be able 
+		// to implement secure way to open URLs (cf RunAsDesktopUser)
+		// we are still protecting against memory access from non-admon processes
+		dwAccessMask |= PROCESS_CREATE_PROCESS | PROCESS_DUP_HANDLE | PROCESS_QUERY_INFORMATION;
+	}
+
     // Open the access token associated with the calling process
     if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken)) {
         goto Cleanup;
@@ -13997,7 +14080,7 @@ BOOL EnableProcessProtection()
     if (!AddAccessAllowedAce(
             pACL,
             ACL_REVISION,
-            SYNCHRONIZE | PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_TERMINATE, // same as protected process
+            dwAccessMask,
             pTokenUser->User.Sid // pointer to the trustee's SID
             )) {
         goto Cleanup;
@@ -14028,6 +14111,169 @@ Cleanup:
     return bSuccess;
 }
 
+// Based on sample code from: 
+//    https://blogs.msdn.microsoft.com/aaron_margosis/2009/06/06/faq-how-do-i-start-a-program-as-the-desktop-user-from-an-elevated-app/
+// start a program non-elevated as the desktop user from an elevated app
+
+static bool RunAsDesktopUser(
+  __in    const wchar_t *       szApp,
+  __in    wchar_t *             szCmdLine)
+{
+	HANDLE hThreadToken = NULL, hShellProcess = NULL, hShellProcessToken = NULL, hPrimaryToken = NULL;
+	HWND hwnd = NULL;
+	DWORD dwPID = 0;
+	BOOL ret;
+	DWORD dwLastErr;
+	STARTUPINFOW si;
+	PROCESS_INFORMATION pi;
+	bool retval = false;
+	SecureZeroMemory(&si, sizeof(si));
+	SecureZeroMemory(&pi, sizeof(pi));
+	si.cb = sizeof(si);
+
+	// locate CreateProcessWithTokenW in Advapi32.dll
+	if (!CreateProcessWithTokenWPtr)
+	{
+		return false;
+	}
+
+	if (!ImpersonateSelf (SecurityImpersonation))
+	{
+		return false;
+	}
+
+	if (!OpenThreadToken (GetCurrentThread(),  TOKEN_ADJUST_PRIVILEGES, TRUE, &hThreadToken))
+	{
+		return false;
+	}
+	else
+	{
+		TOKEN_PRIVILEGES tkp;
+		tkp.PrivilegeCount = 1;
+		LookupPrivilegeValueW(NULL, SE_INCREASE_QUOTA_NAME, &tkp.Privileges[0].Luid);
+		tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
+
+		SetThreadToken (NULL, NULL);
+
+		AdjustTokenPrivileges(hThreadToken, FALSE, &tkp, 0, NULL, NULL);
+		dwLastErr = GetLastError();
+		if (ERROR_SUCCESS != dwLastErr)
+		{
+			goto cleanup;
+		}
+	}
+
+	// From this point down, we have handles to close, so make sure to clean up.
+
+	// Get an HWND representing the desktop shell.
+	// CAVEATS:  This will fail if the shell is not running (crashed or terminated), or the default shell has been
+	// replaced with a custom shell.  This also won't return what you probably want if Explorer has been terminated and
+	// restarted elevated.
+	hwnd = GetShellWindow();
+	if (NULL == hwnd)
+	{
+		dwLastErr = GetLastError();
+		goto cleanup;
+	}
+
+	// Get the PID of the desktop shell process.
+	GetWindowThreadProcessId(hwnd, &dwPID);
+	if (0 == dwPID)
+	{
+		dwLastErr = GetLastError();
+		goto cleanup;
+	}
+
+	// Open the desktop shell process in order to query it (get the token)
+	hShellProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, dwPID);
+	if (!hShellProcess)
+	{
+		dwLastErr = GetLastError();
+		goto cleanup;
+	}
+
+	// Get the process token of the desktop shell.
+	ret = OpenProcessToken(hShellProcess, TOKEN_DUPLICATE, &hShellProcessToken);
+	if (!ret)
+	{
+		dwLastErr = GetLastError();
+		goto cleanup;
+	}
+
+	// Duplicate the shell's process token to get a primary token.
+	// Based on experimentation, this is the minimal set of rights required for CreateProcessWithTokenW (contrary to current documentation).
+	const DWORD dwTokenRights = TOKEN_QUERY | TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_ADJUST_DEFAULT | TOKEN_ADJUST_SESSIONID;
+	ret = DuplicateTokenEx(hShellProcessToken, dwTokenRights, NULL, SecurityImpersonation, TokenPrimary, &hPrimaryToken);
+	if (!ret)
+	{
+		dwLastErr = GetLastError();
+		goto cleanup;
+	}
+
+	// Start the target process with the new token.
+	ret = CreateProcessWithTokenWPtr(
+		hPrimaryToken,
+		0,
+		szApp,
+		szCmdLine,
+		0,
+		NULL,
+		NULL,
+		&si,
+		&pi);
+	if (!ret)
+	{
+		dwLastErr = GetLastError();
+		goto cleanup;
+	}
+
+	// Make sure to close HANDLEs return in the PROCESS_INFORMATION.
+	CloseHandle(pi.hProcess);
+	CloseHandle(pi.hThread);
+
+	retval = true;
+
+cleanup:
+	// Clean up resources
+	if (hShellProcessToken) CloseHandle(hShellProcessToken);
+	if (hPrimaryToken) CloseHandle(hPrimaryToken);
+	if (hShellProcess) CloseHandle(hShellProcess);
+	if (hThreadToken) CloseHandle(hThreadToken);
+	RevertToSelf ();
+	if (!retval)
+		SetLastError (dwLastErr);
+	return retval;
+}
+
+// This function always loads a URL in a non-privileged mode
+// If current process has admin privileges, we execute the command "rundll32 url.dll,FileProtocolHandler URL" as non-elevated
+// Use this security mechanism only starting from Windows Vista
+void SafeOpenURL (LPCWSTR szUrl)
+{
+	if (IsAdmin () && IsOSAtLeast (WIN_VISTA))
+	{
+		WCHAR szRunDllPath[TC_MAX_PATH];
+		WCHAR szUrlDllPath[TC_MAX_PATH];
+		WCHAR szSystemPath[TC_MAX_PATH];
+		LPWSTR szCommandLine = new WCHAR[1024];
+
+		if (!GetSystemDirectory(szSystemPath, MAX_PATH))
+			StringCbCopyW(szSystemPath, sizeof(szSystemPath), L"C:\\Windows\\System32");
+
+		StringCbPrintfW(szRunDllPath, sizeof(szRunDllPath), L"%s\\%s", szSystemPath, L"rundll32.exe");
+		StringCbPrintfW(szUrlDllPath, sizeof(szUrlDllPath), L"%s\\%s", szSystemPath, L"url.dll");
+		StringCchPrintfW(szCommandLine, 1024, L"%s %s,FileProtocolHandler %s", szRunDllPath, szUrlDllPath, szUrl);
+
+		RunAsDesktopUser (NULL, szCommandLine);
+
+		delete [] szCommandLine;
+	}
+	else
+	{
+		ShellExecuteW (NULL, L"open", szUrl, NULL, NULL, SW_SHOWNORMAL);
+	}
+}
+
 #if !defined(SETUP) && defined(_WIN64)
 
 #define RtlGenRandom SystemFunction036

src/Common/Dlgcode.h

@@ -351,6 +351,7 @@ BOOL CloseVolumeExplorerWindows (HWND hwnd, int driveNo);
 BOOL UpdateDriveCustomLabel (int driveNo, wchar_t* effectiveLabel, BOOL bSetValue);
 BOOL CheckCapsLock (HWND hwnd, BOOL quiet);
 BOOL CheckFileExtension (wchar_t *fileName);
+BOOL IsTrueCryptFileExtension (wchar_t *fileName);
 void CorrectFileName (wchar_t* fileName);
 void CorrectURL (wchar_t* fileName);
 void IncreaseWrongPwdRetryCount (int count);
@@ -473,7 +474,7 @@ BOOL CALLBACK CloseTCWindowsEnum( HWND hwnd, LPARAM lParam);
 BOOL CALLBACK FindTCWindowEnum (HWND hwnd, LPARAM lParam);
 BYTE *MapResource (wchar_t *resourceType, int resourceId, PDWORD size);
 void InconsistencyResolved (char *msg);
-void ReportUnexpectedState (char *techInfo);
+void ReportUnexpectedState (const char *techInfo);
 BOOL SelectMultipleFiles (HWND hwndDlg, const char *stringId, wchar_t *lpszFileName, size_t cbFileName, BOOL keepHistory);
 BOOL SelectMultipleFilesNext (wchar_t *lpszFileName, size_t cbFileName);
 void OpenOnlineHelp ();
@@ -509,7 +510,9 @@ BOOL InitSecurityTokenLibrary (HWND hwndDlg);
 BOOL FileHasReadOnlyAttribute (const wchar_t *path);
 BOOL IsFileOnReadOnlyFilesystem (const wchar_t *path);
 void CheckFilesystem (HWND hwndDlg, int driveNo, BOOL fixErrors);
+BOOL BufferContainsPattern (const byte *buffer, size_t bufferSize, const byte *pattern, size_t patternSize);
 BOOL BufferContainsString (const byte *buffer, size_t bufferSize, const char *str);
+BOOL BufferContainsWideString (const byte *buffer, size_t bufferSize, const wchar_t *str);
 int AskNonSysInPlaceEncryptionResume (HWND hwndDlg, BOOL* pbDecrypt);
 BOOL RemoveDeviceWriteProtection (HWND hwndDlg, wchar_t *devicePath);
 void EnableElevatedCursorChange (HWND parent);
@@ -543,6 +546,7 @@ void GetInstallationPath (HWND hwndDlg, wchar_t* szInstallPath, DWORD cchSize, B
 BOOL GetSetupconfigLocation (wchar_t* path, DWORD cchSize);
 BOOL BufferHasPattern (const unsigned char* buffer, size_t bufferLen, const void* pattern, size_t patternLen);
 BOOL EnableProcessProtection();
+void SafeOpenURL (LPCWSTR szUrl);
 #ifdef _WIN64
 void GetAppRandomSeed (unsigned char* pbRandSeed, size_t cbRandSeed);
 #endif

src/Common/Format.c

@@ -350,14 +350,32 @@ begin_format:
 			nStatus = ERR_OS_ERROR;
 			goto error;
 		}
+		else if (volParams->hiddenVol && bPreserveTimestamp)
+		{
+			// ensure that Last Access and Last Write timestamps are not modified
+			ftLastAccessTime.dwHighDateTime = 0xFFFFFFFF;
+			ftLastAccessTime.dwLowDateTime = 0xFFFFFFFF;
+
+			SetFileTime (dev, NULL, &ftLastAccessTime, NULL);
+
+			if (GetFileTime ((HANDLE) dev, &ftCreationTime, &ftLastAccessTime, &ftLastWriteTime) == 0)
+				bTimeStampValid = FALSE;
+			else
+				bTimeStampValid = TRUE;
+		}
 
 		DisableFileCompression (dev);
 
 		if (!volParams->hiddenVol && !bInstantRetryOtherFilesys)
 		{
 			LARGE_INTEGER volumeSize;
+			BOOL speedupFileCreation = FALSE;
 			volumeSize.QuadPart = dataAreaSize + TC_VOLUME_HEADER_GROUP_SIZE;
 
+			// speedup for file creation only makes sens when using quick format
+			if (volParams->quickFormat && volParams->fastCreateFile)
+				speedupFileCreation = TRUE;
+
 			if (volParams->sparseFileSwitch && volParams->quickFormat)
 			{
 				// Create as sparse file container
@@ -371,21 +389,29 @@ begin_format:
 
 			// Preallocate the file
 			if (!SetFilePointerEx (dev, volumeSize, NULL, FILE_BEGIN)
-				|| !SetEndOfFile (dev)
+				|| !SetEndOfFile (dev))
-				|| SetFilePointer (dev, 0, NULL, FILE_BEGIN) != 0)
 			{
 				nStatus = ERR_OS_ERROR;
 				goto error;
 			}
-		}
-	}
 
-	if (volParams->hiddenVol && !volParams->bDevice && bPreserveTimestamp)
+			if (speedupFileCreation)
-	{
+			{
-		if (GetFileTime ((HANDLE) dev, &ftCreationTime, &ftLastAccessTime, &ftLastWriteTime) == 0)
+				// accelerate file creation by telling Windows not to fill all file content with zeros
-			bTimeStampValid = FALSE;
+				// this has security issues since it will put existing disk content into file container
-		else
+				// We use this mechanism only when switch /fastCreateFile specific and when quick format
-			bTimeStampValid = TRUE;
+				// also specified and which is documented to have security issues.
+				// we don't check returned status because failure is not issue for us
+				SetFileValidData (dev, volumeSize.QuadPart);
+			}
+
+			if (SetFilePointer (dev, 0, NULL, FILE_BEGIN) != 0)
+			{
+				nStatus = ERR_OS_ERROR;
+				goto error;
+			}
+
+		}
 	}
 
 	if (volParams->hwndDlg && volParams->bGuiMode) KillTimer (volParams->hwndDlg, TIMER_ID_RANDVIEW);

src/Common/Format.h

@@ -38,6 +38,7 @@ typedef struct
 	unsigned int clusterSize;
 	BOOL sparseFileSwitch;
 	BOOL quickFormat;
+	BOOL fastCreateFile;
 	DWORD sectorSize;
 	int *realClusterSize;
 	Password *password;

src/Common/Keyfiles.c

@@ -149,50 +149,41 @@ void KeyFileCloneAll (KeyFile *firstKeyFile, KeyFile **outputKeyFile)
 
 static BOOL KeyFileProcess (unsigned __int8 *keyPool, unsigned __int32 keyPoolSize, KeyFile *keyFile)
 {
-	FILE *f;
 	unsigned __int8 buffer[64 * 1024];
 	unsigned __int32 crc = 0xffffffff;
 	unsigned __int32 writePos = 0;
-	size_t bytesRead, totalRead = 0;
+	DWORD bytesRead, totalRead = 0;
 	int status = TRUE;
-
 	HANDLE src;
-	FILETIME ftCreationTime;
+	BOOL bReadStatus = FALSE;
-	FILETIME ftLastWriteTime;
-	FILETIME ftLastAccessTime;
 
-	BOOL bTimeStampValid = FALSE;
-
-	/* Remember the last access time of the keyfile. It will be preserved in order to prevent
-	an adversary from determining which file may have been used as keyfile. */
 	src = CreateFile (keyFile->FileName,
-		GENERIC_READ | GENERIC_WRITE,
+		GENERIC_READ | FILE_WRITE_ATTRIBUTES,
 		FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
 
 	if (src != INVALID_HANDLE_VALUE)
 	{
-		if (GetFileTime ((HANDLE) src, &ftCreationTime, &ftLastAccessTime, &ftLastWriteTime))
+		/* We tell Windows not to update the Last Access timestamp in order to prevent
-			bTimeStampValid = TRUE;
+		an adversary from determining which file may have been used as keyfile. */
+		FILETIME ftLastAccessTime;
+		ftLastAccessTime.dwHighDateTime = 0xFFFFFFFF;
+		ftLastAccessTime.dwLowDateTime = 0xFFFFFFFF;
+
+		SetFileTime (src, NULL, &ftLastAccessTime, NULL);
+	}
+	else
+	{
+		/* try to open without FILE_WRITE_ATTRIBUTES in case we are in a ReadOnly filesystem (e.g. CD)                                                                                                                                                                                                                                         */
+		src = CreateFile (keyFile->FileName,
+			GENERIC_READ,
+			FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
+		if (src == INVALID_HANDLE_VALUE)
+			return FALSE;
 	}
 
-	finally_do_arg (HANDLE, src,
+	while ((bReadStatus = ReadFile (src, buffer, sizeof (buffer), &bytesRead, NULL)) && (bytesRead > 0))
 	{
-		if (finally_arg != INVALID_HANDLE_VALUE)
+		DWORD i;
-			CloseHandle (finally_arg);
-	});
-
-	f = _wfopen (keyFile->FileName, L"rb");
-	if (f == NULL) return FALSE;
-
-	while ((bytesRead = fread (buffer, 1, sizeof (buffer), f)) > 0)
-	{
-		size_t i;
-
-		if (ferror (f))
-		{
-			status = FALSE;
-			goto close;
-		}
 
 		for (i = 0; i < bytesRead; i++)
 		{
@@ -211,7 +202,7 @@ static BOOL KeyFileProcess (unsigned __int8 *keyPool, unsigned __int32 keyPoolSi
 		}
 	}
 
-	if (ferror (f))
+	if (!bReadStatus)
 	{
 		status = FALSE;
 	}
@@ -223,13 +214,9 @@ static BOOL KeyFileProcess (unsigned __int8 *keyPool, unsigned __int32 keyPoolSi
 
 close:
 	DWORD err = GetLastError();
-	fclose (f);
 
-	if (bTimeStampValid && !IsFileOnReadOnlyFilesystem (keyFile->FileName))
+	CloseHandle (src);
-	{
+	burn (buffer, sizeof (buffer));
-		// Restore the keyfile timestamp
-		SetFileTime (src, &ftCreationTime, &ftLastAccessTime, &ftLastWriteTime);
-	}
 
 	SetLastError (err);
 	return status;

src/Common/Language.xml

@@ -33,14 +33,14 @@
     <entry lang="en" key="IDC_DISPLAY_POOL_CONTENTS">Display pool content</entry>
     <entry lang="en" key="IDC_DOWNLOAD_CD_BURN_SOFTWARE">Download CD/DVD recording software</entry>
     <entry lang="en" key="IDC_FILE_CONTAINER">Create an encrypted file container</entry>
-    <entry lang="en" key="IDC_GB">&amp;GB</entry>
+    <entry lang="en" key="IDC_GB">&amp;GiB</entry>
-    <entry lang="en" key="IDC_TB">&amp;TB</entry>
+    <entry lang="en" key="IDC_TB">&amp;TiB</entry>
     <entry lang="en" key="IDC_HIDDEN_SYSENC_INFO_LINK">More information</entry>
     <entry lang="en" key="IDC_HIDDEN_VOL">Hi&amp;dden VeraCrypt volume </entry>
     <entry lang="en" key="IDC_HIDDEN_VOL_HELP">More information about hidden volumes</entry>
     <entry lang="en" key="IDC_HIDVOL_WIZ_MODE_DIRECT">Direct mode</entry>
     <entry lang="en" key="IDC_HIDVOL_WIZ_MODE_FULL">Normal mode</entry>
-    <entry lang="en" key="IDC_KB">&amp;KB</entry>
+    <entry lang="en" key="IDC_KB">&amp;KiB</entry>
     <entry lang="en" key="IDC_KEYFILES_ENABLE">U&amp;se keyfiles</entry>
     <entry lang="en" key="IDC_KEYFILES_TRY_EMPTY_PASSWORD">Try first to mount with an empty password</entry>
     <entry lang="en" key="IDC_KEYFILES_RANDOM_SIZE">Random size ( 64 &lt;-&gt; 1048576 )</entry>
@@ -48,7 +48,7 @@
     <entry lang="en" key="IDC_LINK_HASH_INFO">Information on hash algorithms</entry>
     <entry lang="en" key="IDC_LINK_MORE_INFO_ABOUT_CIPHER">More information</entry>
     <entry lang="en" key="IDC_LINK_PIM_INFO">Information on PIM</entry>
-    <entry lang="en" key="IDC_MB">&amp;MB</entry>
+    <entry lang="en" key="IDC_MB">&amp;MiB</entry>
     <entry lang="en" key="IDC_MORE_INFO_ON_CONTAINERS">More information</entry>
     <entry lang="en" key="IDC_MORE_INFO_ON_SYS_ENCRYPTION">More information about system encryption</entry>
     <entry lang="en" key="IDC_MORE_INFO_SYS_ENCRYPTION">More information</entry>
@@ -414,11 +414,11 @@
     <entry lang="en" key="COMPRESSION_NOT_SUPPORTED">Error: The container has been compressed at the filesystem level. VeraCrypt does not support compressed containers (note that compression of encrypted data is ineffective and redundant).\n\nPlease disable compression for the container by following these steps:\n1) Right-click the container in Windows Explorer (not in VeraCrypt).\n2) Select 'Properties'.\n3) In the 'Properties' dialog box, click 'Advanced'.\n4) In the 'Advanced Attributes' dialog box, disable the option 'Compress contents to save disk space' and click 'OK'.\n5) In the 'Properties' dialog box, click 'OK'.</entry>
     <entry lang="en" key="CREATE_FAILED">Failed to create volume %s</entry>
     <entry lang="en" key="DEVICE_FREE_BYTES">Size of %s is %.2f bytes</entry>
-    <entry lang="en" key="DEVICE_FREE_KB">Size of %s is %.2f KB</entry>
+    <entry lang="en" key="DEVICE_FREE_KB">Size of %s is %.2f KiB</entry>
-    <entry lang="en" key="DEVICE_FREE_MB">Size of %s is %.2f MB</entry>
+    <entry lang="en" key="DEVICE_FREE_MB">Size of %s is %.2f MiB</entry>
-    <entry lang="en" key="DEVICE_FREE_GB">Size of %s is %.2f GB</entry>
+    <entry lang="en" key="DEVICE_FREE_GB">Size of %s is %.2f GiB</entry>
-    <entry lang="en" key="DEVICE_FREE_TB">Size of %s is %.2f TB</entry>
+    <entry lang="en" key="DEVICE_FREE_TB">Size of %s is %.2f TiB</entry>
-    <entry lang="en" key="DEVICE_FREE_PB">Size of %s is %.2f PB</entry>
+    <entry lang="en" key="DEVICE_FREE_PB">Size of %s is %.2f PiB</entry>
     <entry lang="en" key="DEVICE_IN_USE_FORMAT">WARNING: The device/partition is in use by the operating system or applications. Formatting the device/partition might cause data corruption and system instability.\n\nContinue?</entry>
     <entry lang="en" key="DEVICE_IN_USE_INPLACE_ENC">Warning: The partition is in use by the operating system or applications. You should close any applications that might be using the partition (including antivirus software).\n\nContinue?</entry>
     <entry lang="en" key="FORMAT_CANT_DISMOUNT_FILESYS">Error: The device/partition contains a file system that could not be dismounted. The file system may be in use by the operating system. Formatting the device/partition would very likely cause data corruption and system instability.\n\nTo solve this issue, we recommend that you first delete the partition and then recreate it without formatting. To do so, follow these steps:\n1) Right-click the 'Computer' (or 'My Computer') icon in the 'Start Menu' and select 'Manage'. The 'Computer Management' window should appear.\n2) In the 'Computer Management' window, select 'Storage' > 'Disk Management'.\n3) Right-click the partition you want to encrypt and select either 'Delete Partition', or 'Delete Volume', or 'Delete Logical Drive'.\n4) Click 'Yes'. If Windows asks you to restart the computer, do so. Then repeat the steps 1 and 2 and continue from the step 5.\n5) Right-click the unallocated/free space area and select either 'New Partition', or 'New Simple Volume', or 'New Logical Drive'.\n6) The 'New Partition Wizard' or 'New Simple Volume Wizard' window should appear now; follow its instructions. On the wizard page entitled 'Format Partition', select either 'Do not format this partition' or 'Do not format this volume'. In the same wizard, click 'Next' and then 'Finish'.\n7) Note that the device path you have selected in VeraCrypt may be wrong now. Therefore, exit the VeraCrypt Volume Creation Wizard (if it is still running) and then start it again.\n8) Try encrypting the device/partition again.\n\nIf VeraCrypt repeatedly fails to encrypt the device/partition, you may want to consider creating a file container instead.</entry>
@@ -436,13 +436,13 @@
     <entry lang="en" key="RAW_DEV_NOT_SUPPORTED_FOR_INPLACE_ENC">VeraCrypt can in-place encrypt only a partition, a dynamic volume, or an entire system drive.\n\nIf you want to create an encrypted VeraCrypt volume within the selected non-system device, choose the option "Create encrypted volume and format it" (instead of the option "Encrypt partition in place").</entry>
     <entry lang="en" key="INPLACE_ENC_INVALID_PATH">Error: VeraCrypt can in-place encrypt only a partition, a dynamic volume, or an entire system drive. Please make sure the specified path is valid.</entry>
     <entry lang="en" key="CANNOT_RESIZE_FILESYS">Error: Cannot shrink the filesystem (the filesystem needs to be shrunk to make space for the volume header and backup header).\n\nPossible causes and solutions:\n\n- Not enough free space on the volume. Please make sure no other application is writing to the filesystem.\n\n- Corrupted file system. Try to check it and fix any errors (right-click the corresponding drive letter in the 'Computer' list, then select Properties > Tools > 'Check Now', make sure the option 'Automatically fix file system errors' is enabled and click Start).\n\nIf the above steps do not help, please follow the below steps.</entry>
-    <entry lang="en" key="NOT_ENOUGH_FREE_FILESYS_SPACE_FOR_SHRINK">Error: There is not enough free space on the volume and so the filesystem cannot be shrunk (the filesystem needs to be shrunk to make space for the volume header and backup header).\n\nPlease delete any redundant files and empty the Recycle Bin so as to free at least 256 KB of space and then try again. Note that due to a Windows issue, the amount of free space reported by the Windows Explorer may be incorrect until the operating system is restarted. If restarting the system does not help, the file system may be corrupted. Try to check it and fix any errors (right-click the corresponding drive letter in the 'Computer' list, then select Properties > Tools > 'Check Now', make sure the option 'Automatically fix file system errors' is enabled and click Start).\n\nIf the above steps do not help, please follow the below steps.</entry>
+    <entry lang="en" key="NOT_ENOUGH_FREE_FILESYS_SPACE_FOR_SHRINK">Error: There is not enough free space on the volume and so the filesystem cannot be shrunk (the filesystem needs to be shrunk to make space for the volume header and backup header).\n\nPlease delete any redundant files and empty the Recycle Bin so as to free at least 256 KiB of space and then try again. Note that due to a Windows issue, the amount of free space reported by the Windows Explorer may be incorrect until the operating system is restarted. If restarting the system does not help, the file system may be corrupted. Try to check it and fix any errors (right-click the corresponding drive letter in the 'Computer' list, then select Properties > Tools > 'Check Now', make sure the option 'Automatically fix file system errors' is enabled and click Start).\n\nIf the above steps do not help, please follow the below steps.</entry>
     <entry lang="en" key="DISK_FREE_BYTES">Free space on drive %s is %.2f bytes.</entry>
-    <entry lang="en" key="DISK_FREE_KB">Free space on drive %s is %.2f KB</entry>
+    <entry lang="en" key="DISK_FREE_KB">Free space on drive %s is %.2f KiB</entry>
-    <entry lang="en" key="DISK_FREE_MB">Free space on drive %s is %.2f MB</entry>
+    <entry lang="en" key="DISK_FREE_MB">Free space on drive %s is %.2f MiB</entry>
-    <entry lang="en" key="DISK_FREE_GB">Free space on drive %s is %.2f GB</entry>
+    <entry lang="en" key="DISK_FREE_GB">Free space on drive %s is %.2f GiB</entry>
-    <entry lang="en" key="DISK_FREE_TB">Free space on drive %s is %.2f TB</entry>
+    <entry lang="en" key="DISK_FREE_TB">Free space on drive %s is %.2f TiB</entry>
-    <entry lang="en" key="DISK_FREE_PB">Free space on drive %s is %.2f PB</entry>
+    <entry lang="en" key="DISK_FREE_PB">Free space on drive %s is %.2f PiB</entry>
     <entry lang="en" key="DRIVELETTERS">Could not get available drive letters.</entry>
     <entry lang="en" key="DRIVER_NOT_FOUND">Error: VeraCrypt driver not found.\n\nPlease copy the files 'veracrypt.sys' and 'veracrypt-x64.sys' to the directory where the main VeraCrypt application (VeraCrypt.exe) is located.</entry>
     <entry lang="en" key="DRIVER_VERSION">Error: An incompatible version of the VeraCrypt driver is currently running.\n\nIf you are trying to run VeraCrypt in portable mode (i.e. without installing it) and a different version of VeraCrypt is already installed, you must uninstall it first (or upgrade it using the VeraCrypt installer). To uninstall it, follow these steps: On Windows Vista or later, select 'Start Menu' > Computer > 'Uninstall or change a program' > VeraCrypt > Uninstall; on Windows XP, select 'Start Menu' > Settings > 'Control Panel' > 'Add Or Remove Programs' > VeraCrypt > Remove.\n\nSimilarly, if you are trying to run VeraCrypt in portable mode (i.e. without installing it) and a different version of VeraCrypt is already running in portable mode, you must restart the system first and then run only this new version.</entry>
@@ -456,7 +456,7 @@
     <entry lang="en" key="ASK_KEEP_DETECTING_SYSTEM_CRASH">Do you want VeraCrypt to continue detecting system crashes?</entry>
     <entry lang="en" key="NO_MINIDUMP_FOUND">VeraCrypt found no system crash minidump file.</entry>
     <entry lang="en" key="ASK_DELETE_KERNEL_CRASH_DUMP">Do you want to delete the Windows crash dump file to free up disk space?</entry>
-    <entry lang="en" key="ASK_DEBUGGER_INSTALL">In order to analyze the system crash, VeraCrypt needs to install Microsoft Debugging Tools for Windows first.\n\nAfter you click OK, the Windows installer will download the Microsoft Debugging Tools installation package (16 MB) from a Microsoft server and install it (the Windows installer will be forwarded to the Microsoft server URL from the veracrypt.org server, which ensures that this feature works even if Microsoft changes the location of the installation package).</entry>
+    <entry lang="en" key="ASK_DEBUGGER_INSTALL">In order to analyze the system crash, VeraCrypt needs to install Microsoft Debugging Tools for Windows first.\n\nAfter you click OK, the Windows installer will download the Microsoft Debugging Tools installation package (16 MiB) from a Microsoft server and install it (the Windows installer will be forwarded to the Microsoft server URL from the veracrypt.org server, which ensures that this feature works even if Microsoft changes the location of the installation package).</entry>
     <entry lang="en" key="SYSTEM_CRASH_ANALYSIS_INFO">After you click OK, VeraCrypt will analyze the system crash. This may take up to several minutes.</entry>
     <entry lang="en" key="DEBUGGER_NOT_FOUND">Please make sure the environment variable 'PATH' includes the path to 'kd.exe' (Kernel Debugger).</entry>
     <entry lang="en" key="SYSTEM_CRASH_NO_VERACRYPT">It appears that VeraCrypt most likely did not cause the system crash. There are many potential reasons why the system could have crashed (for example, a failing hardware component, a bug in a device driver, etc.)</entry>
@@ -479,9 +479,9 @@
     <entry lang="en" key="FILE_OPEN_FAILED">The file could not be opened.</entry>
     <entry lang="en" key="FILE_TITLE">Volume Location</entry>
     <entry lang="en" key="FILESYS_PAGE_TITLE">Large Files</entry>
-    <entry lang="en" key="FILESYS_PAGE_HELP_QUESTION">Do you intend to store files larger than 4 GB in this VeraCrypt volume?</entry>
+    <entry lang="en" key="FILESYS_PAGE_HELP_QUESTION">Do you intend to store files larger than 4 GiB in this VeraCrypt volume?</entry>
     <entry lang="en" key="FILESYS_PAGE_HELP_EXPLANATION">Depending on your choice above, VeraCrypt will choose a suitable default file system for the VeraCrypt volume (you will be able to select a file system in the next step).</entry>
-    <entry lang="en" key="FILESYS_PAGE_HELP_EXPLANATION_HIDVOL">As you are creating an outer volume, you should consider choosing 'No'. If you choose 'Yes', the default filesystem will be NTFS, which is not as suitable for outer volumes as FAT/exFAT (for example, the maximum possible size of the hidden volume will be significantly greater if the outer volume is formatted as FAT/exFAT). Normally, FAT is the default for both hidden and normal volumes (so FAT volumes are not suspicious). However, if the user indicates intent to store files larger than 4 GB (which the FAT file system does not allow), then FAT is not the default.</entry>
+    <entry lang="en" key="FILESYS_PAGE_HELP_EXPLANATION_HIDVOL">As you are creating an outer volume, you should consider choosing 'No'. If you choose 'Yes', the default filesystem will be NTFS, which is not as suitable for outer volumes as FAT/exFAT (for example, the maximum possible size of the hidden volume will be significantly greater if the outer volume is formatted as FAT/exFAT). Normally, FAT is the default for both hidden and normal volumes (so FAT volumes are not suspicious). However, if the user indicates intent to store files larger than 4 GiB (which the FAT file system does not allow), then FAT is not the default.</entry>
     <entry lang="en" key="FILESYS_PAGE_HELP_EXPLANATION_HIDVOL_CONFIRM">Are you sure you want to choose 'Yes'?</entry>
     <entry lang="en" key="DEVICE_TRANSFORM_MODE_PAGE_TITLE">Volume Creation Mode</entry>
     <entry lang="en" key="DEVICE_TRANSFORM_MODE_PAGE_FORMAT_HELP">This is the fastest way to create a partition-hosted or device-hosted VeraCrypt volume (in-place encryption, which is the other option, is slower because content of each sector has to be first read, encrypted, and then written). Any data currently stored on the selected partition/device will be lost (the data will NOT be encrypted; it will be overwritten with random data). If you want to encrypt existing data on a partition, choose the other option.</entry>
@@ -536,7 +536,7 @@
     <entry lang="en" key="HIDVOL_PROT_WARN_AFTER_MOUNT">The hidden volume is now protected against damage until the outer volume is dismounted.\n\nWARNING: If any data is attempted to be saved to the hidden volume area, VeraCrypt will start write-protecting the entire volume (both the outer and the hidden part) until it is dismounted. This may cause filesystem corruption on the outer volume, which (if repeated) might adversely affect plausible deniability of the hidden volume. Therefore, you should make every effort to avoid writing to the hidden volume area. Any data being saved to the hidden volume area will not be saved and will be lost. Windows may report this as a write error ("Delayed Write Failed" or "The parameter is incorrect").</entry>
     <entry lang="en" key="HIDVOL_PROT_WARN_AFTER_MOUNT_PLURAL">Each of the hidden volumes within the newly mounted volumes is now protected against damage until dismounted.\n\nWARNING: If any data is attempted to be saved to protected hidden volume area of any of these volumes, VeraCrypt will start write-protecting the entire volume (both the outer and the hidden part) until it is dismounted. This may cause filesystem corruption on the outer volume, which (if repeated) might adversely affect plausible deniability of the hidden volume. Therefore, you should make every effort to avoid writing to the hidden volume area. Any data being saved to protected hidden volume areas will not be saved and will be lost. Windows may report this as a write error ("Delayed Write Failed" or "The parameter is incorrect").</entry>
     <entry lang="en" key="DAMAGE_TO_HIDDEN_VOLUME_PREVENTED">WARNING: Data were attempted to be saved to the hidden volume area of the volume mounted as %c:! VeraCrypt prevented these data from being saved in order to protect the hidden volume. This may have caused filesystem corruption on the outer volume and Windows may have reported a write error ("Delayed Write Failed" or "The parameter is incorrect"). The entire volume (both the outer and the hidden part) will be write-protected until it is dismounted. If this is not the first time VeraCrypt has prevented data from being saved to the hidden volume area of this volume, plausible deniability of this hidden volume might be adversely affected (due to possible unusual correlated inconsistencies within the outer volume file system). Therefore, you should consider creating a new VeraCrypt volume (with Quick Format disabled) and moving files from this volume to the new volume; this volume should be securely erased (both the outer and the hidden part). We strongly recommend that you restart the operating system now.</entry>
-    <entry lang="en" key="CANNOT_SATISFY_OVER_4G_FILE_SIZE_REQ">You have indicated intent to store files larger than 4 GB on the volume. This requires the volume to be formatted as NTFS/exFAT/ReFS, which, however, will not be possible.</entry>
+    <entry lang="en" key="CANNOT_SATISFY_OVER_4G_FILE_SIZE_REQ">You have indicated intent to store files larger than 4 GiB on the volume. This requires the volume to be formatted as NTFS/exFAT/ReFS, which, however, will not be possible.</entry>
     <entry lang="en" key="CANNOT_CREATE_NON_HIDDEN_NTFS_VOLUMES_UNDER_HIDDEN_OS">Please note that when a hidden operating system is running, non-hidden VeraCrypt volumes cannot be formatted as NTFS/exFAT/ReFS. The reason is that the volume would need to be temporarily mounted without write protection in order to allow the operating system to format it as NTFS (whereas formatting as FAT is performed by VeraCrypt, not by the operating system, and without mounting the volume). For further technical details, see below. You can create a non-hidden NTFS/exFAT/ReFS volume from within the decoy operating system.</entry>
     <entry lang="en" key="HIDDEN_VOL_CREATION_UNDER_HIDDEN_OS_HOWTO">For security reasons, when a hidden operating system is running, hidden volumes can be created only in the 'direct' mode (because outer volumes must always be mounted as read-only). To create a hidden volume securely, follow these steps:\n\n1) Boot the decoy system.\n\n2) Create a normal VeraCrypt volume and, to this volume, copy some sensitive-looking files that you actually do NOT want to hide (the volume will become the outer volume).\n\n3) Boot the hidden system and start the VeraCrypt Volume Creation Wizard. If the volume is file-hosted, move it to the system partition or to another hidden volume (otherwise, the newly created hidden volume would be mounted as read-only and could not be formatted). Follow the instructions in the wizard so as to select the 'direct' hidden volume creation mode.\n\n4) In the wizard, select the volume you created in step 2 and then follow the instructions to create a hidden volume within it.</entry>
     <entry lang="en" key="HIDDEN_OS_WRITE_PROTECTION_BRIEF_INFO">For security reasons, when a hidden operating system is running, local unencrypted filesystems and non-hidden VeraCrypt volumes are mounted as read-only (no data can be written to such filesystems or VeraCrypt volumes).\n\nData is allowed to be written to any filesystem that resides within a hidden VeraCrypt volume (provided that the hidden volume is not located in a container stored on an unencrypted filesystem or on any other read-only filesystem).</entry>
@@ -560,10 +560,10 @@
     <entry lang="en" key="INIT_RICHEDIT">Error: Failed to load the Rich Edit system library.</entry>
     <entry lang="en" key="INTRO_TITLE">VeraCrypt Volume Creation Wizard</entry>
     <entry lang="en" key="MAX_HIDVOL_SIZE_BYTES">Maximum possible hidden volume size for this volume is %.2f bytes.</entry>
-    <entry lang="en" key="MAX_HIDVOL_SIZE_KB">Maximum possible hidden volume size for this volume is %.2f KB.</entry>
+    <entry lang="en" key="MAX_HIDVOL_SIZE_KB">Maximum possible hidden volume size for this volume is %.2f KiB.</entry>
-    <entry lang="en" key="MAX_HIDVOL_SIZE_MB">Maximum possible hidden volume size for this volume is %.2f MB.</entry>
+    <entry lang="en" key="MAX_HIDVOL_SIZE_MB">Maximum possible hidden volume size for this volume is %.2f MiB.</entry>
-    <entry lang="en" key="MAX_HIDVOL_SIZE_GB">Maximum possible hidden volume size for this volume is %.2f GB.</entry>
+    <entry lang="en" key="MAX_HIDVOL_SIZE_GB">Maximum possible hidden volume size for this volume is %.2f GiB.</entry>
-    <entry lang="en" key="MAX_HIDVOL_SIZE_TB">Maximum possible hidden volume size for this volume is %.2f TB.</entry>
+    <entry lang="en" key="MAX_HIDVOL_SIZE_TB">Maximum possible hidden volume size for this volume is %.2f TiB.</entry>
     <entry lang="en" key="MOUNTED_NOPWCHANGE">Volume password/keyfiles cannot be changed while the volume is mounted. Please dismount the volume first.</entry>
     <entry lang="en" key="MOUNTED_NO_PKCS5_PRF_CHANGE">The header key derivation algorithm cannot be changed while the volume is mounted. Please dismount the volume first.</entry>
     <entry lang="en" key="MOUNT_BUTTON">&amp;Mount</entry>
@@ -666,14 +666,14 @@
     <entry lang="en" key="SELECT_KEYFILE_GENERATION_DIRECTORY">Select a directory where to store the keyfiles.</entry>
     <entry lang="en" key="SELECTED_KEYFILE_IS_CONTAINER_FILE">The current container file was selected as a keyfile. It will be skipped.</entry>
     <entry lang="en" key="SERPENT_HELP">Designed by Ross Anderson, Eli Biham, and Lars Knudsen. Published in 1998. 256-bit key, 128-bit block. Mode of operation is XTS. Serpent was one of the AES finalists.</entry>
-    <entry lang="en" key="SIZE_HELP">Please specify the size of the container you want to create.\n\nIf you create a dynamic (sparse-file) container, this parameter will specify its maximum possible size.\n\nNote that the minimum possible size of a FAT volume is 292 KB. The minimum possible size of an exFAT volume is 424 KB. The minimum possible size of an NTFS volume is 3792 KB. The minimum possible size of an ReFS volume is 642 MB.</entry>
+    <entry lang="en" key="SIZE_HELP">Please specify the size of the container you want to create.\n\nIf you create a dynamic (sparse-file) container, this parameter will specify its maximum possible size.\n\nNote that the minimum possible size of a FAT volume is 292 KiB. The minimum possible size of an exFAT volume is 424 KiB. The minimum possible size of an NTFS volume is 3792 KiB. The minimum possible size of an ReFS volume is 642 MiB.</entry>
-    <entry lang="en" key="SIZE_HELP_HIDDEN_HOST_VOL">Please specify the size of the outer volume to be created (you will first create the outer volume and then a hidden volume within it). The minimum possible size of a volume within which a hidden volume is intended to be created is 340 KB.</entry>
+    <entry lang="en" key="SIZE_HELP_HIDDEN_HOST_VOL">Please specify the size of the outer volume to be created (you will first create the outer volume and then a hidden volume within it). The minimum possible size of a volume within which a hidden volume is intended to be created is 340 KiB.</entry>
-    <entry lang="en" key="SIZE_HELP_HIDDEN_VOL">Please specify the size of the hidden volume to create. The minimum possible size of a hidden volume is 40 KB (or 3664 KB if it is formatted as NTFS). The maximum possible size you can specify for the hidden volume is displayed above.</entry>
+    <entry lang="en" key="SIZE_HELP_HIDDEN_VOL">Please specify the size of the hidden volume to create. The minimum possible size of a hidden volume is 40 KiB (or 3664 KiB if it is formatted as NTFS). The maximum possible size you can specify for the hidden volume is displayed above.</entry>
     <entry lang="en" key="SIZE_HIDVOL_HOST_TITLE">Outer Volume Size</entry>
     <entry lang="en" key="SIZE_HIDVOL_TITLE">Hidden Volume Size</entry>
     <entry lang="en" key="SIZE_PARTITION_HELP">Please verify that the size of the selected device/partition shown above is correct and click Next.</entry>
     <entry lang="en" key="SIZE_PARTITION_HIDDEN_SYSENC_HELP">The outer volume and the hidden volume (containing the hidden operating system) will reside within the above partition. It should be the first partition behind the system partition.\n\nPlease verify that the size of the partition and its number shown above are correct, and if they are, click Next.</entry>
-    <entry lang="en" key="SIZE_PARTITION_HIDDEN_VOL_HELP">\n\nNote that the minimum possible size of a volume within which a hidden volume is intended to be created is 340 KB.</entry>
+    <entry lang="en" key="SIZE_PARTITION_HIDDEN_VOL_HELP">\n\nNote that the minimum possible size of a volume within which a hidden volume is intended to be created is 340 KiB.</entry>
     <entry lang="en" key="SIZE_TITLE">Volume Size</entry>
     <entry lang="en" key="SPARSE_FILE">Dynamic</entry>
     <entry lang="en" key="TESTS_FAILED">CAUTION: SELF-TEST FAILED!</entry>
@@ -748,7 +748,7 @@
     <entry lang="en" key="HIDDEN_VOL_HOST_NTFS">Note: The FAT/exFAT file system is more suitable for outer volumes than the NTFS file system (for example, the maximum possible size of the hidden volume would very likely have been significantly greater if the outer volume had been formatted as FAT/exFAT).</entry>
     <entry lang="en" key="HIDDEN_VOL_HOST_NTFS_ASK">Note that the FAT/exFAT file system is more suitable for outer volumes than the NTFS file system. For example, the maximum possible size of the hidden volume will very likely be significantly greater if the outer volume is formatted as FAT/exFAT (the reason is that the NTFS file system always stores internal data exactly in the middle of the volume and, therefore, the hidden volume can reside only in the second half of the outer volume).\n\nAre you sure you want to format the outer volume as NTFS?</entry>
     <entry lang="en" key="OFFER_FAT_FORMAT_ALTERNATIVE">Do you want to format the volume as FAT instead?</entry>
-    <entry lang="en" key="FAT_NOT_AVAILABLE_FOR_SO_LARGE_VOLUME">Note: This volume cannot be formatted as FAT, because it exceeds the maximum volume size supported by the FAT32 filesystem for the applicable sector size (2 TB for 512-byte sectors and 16 TB for 4096-byte sectors).</entry>
+    <entry lang="en" key="FAT_NOT_AVAILABLE_FOR_SO_LARGE_VOLUME">Note: This volume cannot be formatted as FAT, because it exceeds the maximum volume size supported by the FAT32 filesystem for the applicable sector size (2 TiB for 512-byte sectors and 16 TiB for 4096-byte sectors).</entry>
     <entry lang="en" key="PARTITION_TOO_SMALL_FOR_HIDDEN_OS">Error: The partition for the hidden operating system (i.e. the first partition behind the system partition) must be at least 5% larger than the system partition (the system partition is the one where the currently running operating system is installed).</entry>
     <entry lang="en" key="PARTITION_TOO_SMALL_FOR_HIDDEN_OS_NTFS">Error: The partition for the hidden operating system (i.e. the first partition behind the system partition) must be at least 110% (2.1 times) larger than the system partition (the system partition is the one where the currently running operating system is installed). The reason is that the NTFS file system always stores internal data exactly in the middle of the volume and, therefore, the hidden volume (which is to contain a clone of the system partition) can reside only in the second half of the partition.</entry>
     <entry lang="en" key="OUTER_VOLUME_TOO_SMALL_FOR_HIDDEN_OS_NTFS">Error: If the outer volume is formatted as NTFS, it must be at least 110% (2.1 times) larger than the system partition. The reason is that the NTFS file system always stores internal data exactly in the middle of the volume and, therefore, the hidden volume (which is to contain a clone of the system partition) can reside only in the second half of the outer volume.\n\nNote: The outer volume needs to reside within the same partition as the hidden operating system (i.e. within the first partition behind the system partition).</entry>
@@ -756,7 +756,7 @@
     <entry lang="en" key="TWO_SYSTEMS_IN_ONE_PARTITION_REMARK">Remark: It is not practical (and therefore is not supported) to install operating systems in two VeraCrypt volumes that are embedded within a single partition, because using the outer operating system would often require data to be written to the area of the hidden operating system (and if such write operations were prevented using the hidden volume protection feature, it would inherently cause system crashes, i.e. 'Blue Screen' errors).</entry>
     <entry lang="en" key="FOR_MORE_INFO_ON_PARTITIONS">For information on how to create and manage partitions, please refer to the documentation supplied with your operating system or contact your computer vendor's technical support team for assistance.</entry>
     <entry lang="en" key="SYSTEM_PARTITION_NOT_ACTIVE">Error: The currently running operating system is not installed on the boot partition (first Active partition). This is not supported.</entry>
-    <entry lang="en" key="CONFIRM_FAT_FOR_FILES_OVER_4GB">You indicated that you intend to store files larger than 4 GB in this VeraCrypt volume. However, you chose the FAT file system, on which files larger than 4 GB cannot be stored.\n\nAre you sure you want to format the volume as FAT?</entry>
+    <entry lang="en" key="CONFIRM_FAT_FOR_FILES_OVER_4GB">You indicated that you intend to store files larger than 4 GiB in this VeraCrypt volume. However, you chose the FAT file system, on which files larger than 4 GiB cannot be stored.\n\nAre you sure you want to format the volume as FAT?</entry>
     <entry lang="en" key="NONSYS_INPLACE_DECRYPTION_BAD_VOL_FORMAT">Error: VeraCrypt does not support in-place decryption of legacy non-system volumes created by VeraCrypt 1.0b or earlier.\n\nNote: You can still decrypt files stored on the volume by copying/moving them to any unencrypted volume.</entry>
     <entry lang="en" key="NONSYS_INPLACE_DECRYPTION_CANT_DECRYPT_HID_VOL">Error: VeraCrypt cannot in-place decrypt a hidden VeraCrypt volume.\n\nNote: You can still decrypt files stored on the volume by copying/moving them to any unencrypted volume.</entry>
     <entry lang="en" key="CONFIRM_VOL_CONTAINS_NO_HIDDEN_VOL">Warning: Note that VeraCrypt cannot in-place decrypt a volume that contains a hidden VeraCrypt volume (the hidden volume would be overwritten with pseudorandom data).\n\nPlease confirm that the volume you are about to decrypt contains no hidden volume.\n\nNote: If the volume contains a hidden volume but you do not mind losing the hidden volume, you can select Proceed (the outer volume will be safely decrypted).</entry>
@@ -997,11 +997,11 @@
     <entry lang="en" key="EXE_FILE_EXTENSION_CONFIRM">WARNING: We strongly recommend that you avoid file extensions that are used for executable files (such as .exe, .sys, or .dll) and other similarly problematic file extensions. Using such file extensions causes Windows and antivirus software to interfere with the container, which adversely affects the performance of the volume and may also cause other serious problems.\n\nWe strongly recommend that you remove the file extension or change it (e.g., to '.hc').\n\nAre you sure you want to use the problematic file extension?</entry>
     <entry lang="en" key="EXE_FILE_EXTENSION_MOUNT_WARNING">WARNING: This container has a file extension that is used for executable files (such as .exe, .sys, or .dll) or some other file extension that is similarly problematic. It will very likely cause Windows and antivirus software to interfere with the container, which will adversely affect the performance of the volume and may also cause other serious problems.\n\nWe strongly recommend that you remove the file extension of the container or change it (e.g., to '.hc') after you dismount the volume.</entry>
     <entry lang="en" key="HOMEPAGE">Homepage</entry>
-    <entry lang="en" key="LARGE_IDE_WARNING_XP">WARNING: It appears that you have not applied any Service Pack to your Windows installation. You should not write to IDE disks larger than 128 GB under Windows XP to which you did not apply Service Pack 1 or later! If you do, data on the disk (no matter if it is a VeraCrypt volume or not) may get corrupted. Note that this is a limitation of Windows, not a bug in VeraCrypt.</entry>
+    <entry lang="en" key="LARGE_IDE_WARNING_XP">WARNING: It appears that you have not applied any Service Pack to your Windows installation. You should not write to IDE disks larger than 128 GiB under Windows XP to which you did not apply Service Pack 1 or later! If you do, data on the disk (no matter if it is a VeraCrypt volume or not) may get corrupted. Note that this is a limitation of Windows, not a bug in VeraCrypt.</entry>
-    <entry lang="en" key="LARGE_IDE_WARNING_2K">WARNING: It appears that you have not applied Service Pack 3 or later to your Windows installation. You should not write to IDE disks larger than 128 GB under Windows 2000 to which you did not apply Service Pack 3 or later! If you do, data on the disk (no matter if it is a VeraCrypt volume or not) may get corrupted. Note that this is a limitation of Windows, not a bug in VeraCrypt.\n\nNote: You may also need to enable the 48-bit LBA support in the registry; for more information, see http://support.microsoft.com/kb/305098/EN-US</entry>
+    <entry lang="en" key="LARGE_IDE_WARNING_2K">WARNING: It appears that you have not applied Service Pack 3 or later to your Windows installation. You should not write to IDE disks larger than 128 GiB under Windows 2000 to which you did not apply Service Pack 3 or later! If you do, data on the disk (no matter if it is a VeraCrypt volume or not) may get corrupted. Note that this is a limitation of Windows, not a bug in VeraCrypt.\n\nNote: You may also need to enable the 48-bit LBA support in the registry; for more information, see http://support.microsoft.com/kb/305098/EN-US</entry>
-    <entry lang="en" key="LARGE_IDE_WARNING_2K_REGISTRY">WARNING: 48-bit LBA ATAPI support is disabled on your system. Therefore, you should not write to IDE disks larger than 128 GB! If you do, data on the disk (no matter if it is a VeraCrypt volume or not) may get corrupted. Note that this is a limitation of Windows, not a limitation of VeraCrypt.\n\nTo enable the 48-bit LBA support, add the 'EnableBigLba' registry value in the registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\atapi\\Parameters and set it to 1.\n\nFor more information, see http://support.microsoft.com/kb/305098</entry>
+    <entry lang="en" key="LARGE_IDE_WARNING_2K_REGISTRY">WARNING: 48-bit LBA ATAPI support is disabled on your system. Therefore, you should not write to IDE disks larger than 128 GiB! If you do, data on the disk (no matter if it is a VeraCrypt volume or not) may get corrupted. Note that this is a limitation of Windows, not a limitation of VeraCrypt.\n\nTo enable the 48-bit LBA support, add the 'EnableBigLba' registry value in the registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\atapi\\Parameters and set it to 1.\n\nFor more information, see http://support.microsoft.com/kb/305098</entry>
-    <entry lang="en" key="VOLUME_TOO_LARGE_FOR_FAT32">Error: Files larger than 4 GB cannot be stored on a FAT32 file system. Therefore, file-hosted VeraCrypt volumes (containers) stored on a FAT32 file system cannot be larger than 4 GB.\n\nIf you need a larger volume, create it on an NTFS file system (or, if you use Windows Vista SP1 or later, on an exFAT file system) or, instead of creating a file-hosted volume, encrypt an entire partition or device.</entry>
+    <entry lang="en" key="VOLUME_TOO_LARGE_FOR_FAT32">Error: Files larger than 4 GiB cannot be stored on a FAT32 file system. Therefore, file-hosted VeraCrypt volumes (containers) stored on a FAT32 file system cannot be larger than 4 GiB.\n\nIf you need a larger volume, create it on an NTFS file system (or, if you use Windows Vista SP1 or later, on an exFAT file system) or, instead of creating a file-hosted volume, encrypt an entire partition or device.</entry>
-    <entry lang="en" key="VOLUME_TOO_LARGE_FOR_WINXP">Warning: Windows XP does not support files larger than 2048 GB (it will report that "Not enough storage is available"). Therefore, you cannot create a file-hosted VeraCrypt volume (container) larger than 2048 GB under Windows XP.\n\nNote that it is still possible to encrypt the entire drive or create a partition-hosted VeraCrypt volume larger than 2048 GB under Windows XP.</entry>
+    <entry lang="en" key="VOLUME_TOO_LARGE_FOR_WINXP">Warning: Windows XP does not support files larger than 2048 GiB (it will report that "Not enough storage is available"). Therefore, you cannot create a file-hosted VeraCrypt volume (container) larger than 2048 GiB under Windows XP.\n\nNote that it is still possible to encrypt the entire drive or create a partition-hosted VeraCrypt volume larger than 2048 GiB under Windows XP.</entry>
     <entry lang="en" key="FREE_SPACE_FOR_WRITING_TO_OUTER_VOLUME">WARNING: If you want to be able to add more data/files to the outer volume in future, you should consider choosing a smaller size for the hidden volume.\n\nAre you sure you want to continue with the size you specified?</entry>
     <entry lang="en" key="NO_VOLUME_SELECTED">No volume selected.\n\nClick 'Select Device' or 'Select File' to select a VeraCrypt volume.</entry>
     <entry lang="en" key="NO_SYSENC_PARTITION_SELECTED">No partition selected.\n\nClick 'Select Device' to select a dismounted partition that normally requires pre-boot authentication (for example, a partition located on the encrypted system drive of another operating system, which is not running, or the encrypted system partition of another operating system).\n\nNote: The selected partition will be mounted as a regular VeraCrypt volume without pre-boot authentication. This is useful e.g. for backup or repair operations.</entry>
@@ -1066,7 +1066,7 @@
     <entry lang="en" key="ERR_ACCESS_DENIED">Access was denied by the operating system.\n\nPossible cause: The operating system requires that you have read/write permission (or administrator privileges) for certain folders, files, and devices, in order for you to be allowed to read and write data to/from them. Normally, a user without administrator privileges is allowed to create, read and modify files in his or her Documents folder.</entry>
     <entry lang="en" key="SECTOR_SIZE_UNSUPPORTED">Error: The drive uses an unsupported sector size.\n\nIt is currently not possible to create partition/device-hosted volumes on drives that use sectors larger than 4096 bytes. However, note that you can create file-hosted volumes (containers) on such drives.</entry>
     <entry lang="en" key="SYSENC_UNSUPPORTED_SECTOR_SIZE_BIOS">It is currently not possible to encrypt a system installed on a disk that uses a sector size other than 512 bytes.</entry>
-    <entry lang="en" key="NO_SPACE_FOR_BOOT_LOADER">The VeraCrypt Boot Loader requires at least 32 KBytes of free space at the beginning of the system drive (the VeraCrypt Boot Loader needs to be stored in that area). Unfortunately, your drive does not meet this condition.\n\nPlease do NOT report this as a bug/problem in VeraCrypt. To solve this problem, you will need to repartition your disk and leave the first 32 KBytes of the disk free (in most cases, you will need to delete and recreate the first partition). We recommend that you use the Microsoft partition manager that is available e.g. when you are installing Windows.</entry>
+    <entry lang="en" key="NO_SPACE_FOR_BOOT_LOADER">The VeraCrypt Boot Loader requires at least 32 KibiBytes of free space at the beginning of the system drive (the VeraCrypt Boot Loader needs to be stored in that area). Unfortunately, your drive does not meet this condition.\n\nPlease do NOT report this as a bug/problem in VeraCrypt. To solve this problem, you will need to repartition your disk and leave the first 32 KibiBytes of the disk free (in most cases, you will need to delete and recreate the first partition). We recommend that you use the Microsoft partition manager that is available e.g. when you are installing Windows.</entry>
     <entry lang="en" key="FEATURE_UNSUPPORTED_ON_CURRENT_OS">The feature is not supported on the version of the operating system you are currently using.</entry>
     <entry lang="en" key="SYS_ENCRYPTION_UNSUPPORTED_ON_CURRENT_OS">VeraCrypt does not support encryption of a system partition/drive on the version of the operating system you are currently using.</entry>
     <entry lang="en" key="SYS_ENCRYPTION_UNSUPPORTED_ON_VISTA_SP0">Before you can encrypt the system partition/drive on Windows Vista, you need to install Service Pack 1 or higher for Windows Vista (no such Service Pack has been installed on this system yet).\n\nNote: Service Pack 1 for Windows Vista resolved an issue causing a shortage of free base memory during system boot.</entry>
@@ -1363,17 +1363,17 @@
     <entry lang="en" key="VK_ALT">Alt</entry>
     <entry lang="en" key="VK_WIN">Win</entry>
     <entry lang="en" key="BYTE">B</entry>
-    <entry lang="en" key="KB">KB</entry>
+    <entry lang="en" key="KB">KiB</entry>
-    <entry lang="en" key="MB">MB</entry>
+    <entry lang="en" key="MB">MiB</entry>
-    <entry lang="en" key="GB">GB</entry>
+    <entry lang="en" key="GB">GiB</entry>
-    <entry lang="en" key="TB">TB</entry>
+    <entry lang="en" key="TB">TiB</entry>
-    <entry lang="en" key="PB">PB</entry>
+    <entry lang="en" key="PB">PiB</entry>
     <entry lang="en" key="B_PER_SEC">B/s</entry>
-    <entry lang="en" key="KB_PER_SEC">KB/s</entry>
+    <entry lang="en" key="KB_PER_SEC">KiB/s</entry>
-    <entry lang="en" key="MB_PER_SEC">MB/s</entry>
+    <entry lang="en" key="MB_PER_SEC">MiB/s</entry>
-    <entry lang="en" key="GB_PER_SEC">GB/s</entry>
+    <entry lang="en" key="GB_PER_SEC">GiB/s</entry>
-    <entry lang="en" key="TB_PER_SEC">TB/s</entry>
+    <entry lang="en" key="TB_PER_SEC">TiB/s</entry>
-    <entry lang="en" key="PB_PER_SEC">PB/s</entry>
+    <entry lang="en" key="PB_PER_SEC">PiB/s</entry>
     <entry lang="en" key="TRIPLE_DOT_GLYPH_ELLIPSIS">…</entry>
     <entry lang="en" key="IDC_BOOT_LOADER_CACHE_PIM">Include &amp;PIM when caching pre-boot authentication password</entry>
     <entry lang="en" key="IDC_PREF_CACHE_PIM">Include PIM when caching a password</entry>
@@ -1437,6 +1437,7 @@
     <entry lang="en" key="IDC_ENABLE_RAM_ENCRYPTION">Activate encryption of keys and passwords stored in RAM</entry>
     <entry lang="en" key="IDT_BENCHMARK">Benchmark:</entry>
     <entry lang="en" key="IDC_DISABLE_MOUNT_MANAGER">Only create virtual device without mounting on selected drive letter</entry>
+    <entry lang="en" key="LEGACY_PASSWORD_UTF8_TOO_LONG">The entered password is too long: its UTF-8 representation exceeds 64 bytes.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

src/Common/Password.c

@@ -224,6 +224,19 @@ int ChangePwd (const wchar_t *lpszVolume, Password *oldPassword, int old_pkcs5,
 
 	if (dev == INVALID_HANDLE_VALUE)
 		goto error;
+	else if (!bDevice && bPreserveTimestamp)
+	{
+		// ensure that Last Access and Last Write timestamps are not modified
+		ftLastAccessTime.dwHighDateTime = 0xFFFFFFFF;
+		ftLastAccessTime.dwLowDateTime = 0xFFFFFFFF;
+
+		SetFileTime (dev, NULL, &ftLastAccessTime, NULL);
+
+		if (GetFileTime ((HANDLE) dev, &ftCreationTime, &ftLastAccessTime, &ftLastWriteTime) == 0)
+			bTimeStampValid = FALSE;
+		else
+			bTimeStampValid = TRUE;
+	}
 
 	if (bDevice)
 	{
@@ -313,13 +326,6 @@ int ChangePwd (const wchar_t *lpszVolume, Password *oldPassword, int old_pkcs5,
 
 	SetRandomPoolEnrichedByUserStatus (FALSE); /* force the display of the random enriching dialog */
 
-	if (!bDevice && bPreserveTimestamp)
-	{
-		if (GetFileTime ((HANDLE) dev, &ftCreationTime, &ftLastAccessTime, &ftLastWriteTime) == 0)
-			bTimeStampValid = FALSE;
-		else
-			bTimeStampValid = TRUE;
-	}
 
 	for (volumeType = TC_VOLUME_TYPE_NORMAL; volumeType < TC_VOLUME_TYPE_COUNT; volumeType++)
 	{

src/Common/Tcdefs.h

@@ -55,7 +55,7 @@ extern unsigned short _rotl16(unsigned short value, unsigned char shift);
 #define TC_APP_NAME						"VeraCrypt"
 
 // Version displayed to user 
-#define VERSION_STRING					"1.24"
+#define VERSION_STRING					"1.24-Update3"
 
 #ifdef VC_EFI_CUSTOM_MODE
 #define VERSION_STRING_SUFFIX			"-CustomEFI"
@@ -67,9 +67,9 @@ extern unsigned short _rotl16(unsigned short value, unsigned char shift);
 #define VERSION_NUM						0x0124
 
 // Release date
-#define TC_STR_RELEASE_DATE			L"October 6, 2019"
+#define TC_STR_RELEASE_DATE			L"December 21, 2019"
 #define TC_RELEASE_DATE_YEAR			2019
-#define TC_RELEASE_DATE_MONTH			 10
+#define TC_RELEASE_DATE_MONTH			 12
 
 #define BYTES_PER_KB                    1024LL
 #define BYTES_PER_MB                    1048576LL
@@ -263,6 +263,10 @@ extern ULONG AllocTag;
 typedef int BOOL;
 #endif
 
+#ifndef BOOLEAN
+typedef unsigned char  BOOLEAN;
+#endif
+
 #ifndef TRUE
 #define TRUE 1
 #endif
@@ -289,6 +293,8 @@ typedef NTSTATUS (NTAPI *ExGetFirmwareEnvironmentVariableFn) (
   PULONG          Attributes
 );
 
+typedef BOOLEAN (NTAPI *KeAreAllApcsDisabledFn) ();
+
 extern NTSTATUS NTAPI KeSaveExtendedProcessorState (
     __in ULONG64 Mask,
     PXSTATE_SAVE XStateSave
@@ -299,6 +305,9 @@ extern VOID NTAPI KeRestoreExtendedProcessorState (
 	PXSTATE_SAVE XStateSave
 	);
 
+extern BOOLEAN VC_KeAreAllApcsDisabled (VOID);
+
+
 #else				/* !TC_WINDOWS_DRIVER */
 #if !defined(_UEFI)
 #define TCalloc malloc

src/Core/CoreBase.cpp

@@ -20,6 +20,9 @@ namespace VeraCrypt
 {
 	CoreBase::CoreBase ()
 		: DeviceChangeInProgress (false)
+#if defined(TC_LINUX ) || defined (TC_FREEBSD)
+		, UseDummySudoPassword (false)
+#endif
 	{
 	}
 

src/Core/CoreBase.h

@@ -77,6 +77,10 @@ namespace VeraCrypt
 		virtual void SetFileOwner (const FilesystemPath &path, const UserId &owner) const = 0;
 		virtual DirectoryPath SlotNumberToMountPoint (VolumeSlotNumber slotNumber) const = 0;
 		virtual void WipePasswordCache () const = 0;
+#if defined(TC_LINUX ) || defined (TC_FREEBSD)
+		virtual void ForceUseDummySudoPassword (bool useDummySudoPassword) { UseDummySudoPassword = useDummySudoPassword;}
+		virtual bool GetUseDummySudoPassword () const { return UseDummySudoPassword;}
+#endif
 
 		Event VolumeDismountedEvent;
 		Event VolumeMountedEvent;
@@ -87,6 +91,9 @@ namespace VeraCrypt
 
 		bool DeviceChangeInProgress;
 		FilePath ApplicationExecutablePath;
+#if defined(TC_LINUX ) || defined (TC_FREEBSD)
+		bool UseDummySudoPassword;
+#endif
 
 	private:
 		CoreBase (const CoreBase &);

src/Core/RandomNumberGenerator.cpp

@@ -46,6 +46,16 @@ namespace VeraCrypt
 
 			throw_sys_sub_if (read (random, buffer, buffer.Size()) == -1 && errno != EAGAIN, L"/dev/random");
 			AddToPool (buffer);
+			
+			/* use JitterEntropy library to get good quality random bytes based on CPU timing jitter */
+			if (JitterRngCtx)
+			{
+				ssize_t rndLen = jent_read_entropy (JitterRngCtx, (char*) buffer.Ptr(), buffer.Size());
+				if (rndLen > 0)
+				{
+					AddToPool (buffer);
+				}
+			}
 		}
 #endif
 	}
@@ -80,6 +90,12 @@ namespace VeraCrypt
 		ScopeLock lock (AccessMutex);
 		size_t bufferLen = buffer.Size(), loopLen;
 		byte* pbBuffer = buffer.Get();
+		
+		// Initialize JitterEntropy RNG for this call
+		if (0 == jent_entropy_init ())
+		{
+			JitterRngCtx = jent_entropy_collector_alloc (1, 0);
+		}
 
 		// Poll system for data
 		AddSystemDataToPool (fast);
@@ -127,6 +143,12 @@ namespace VeraCrypt
 
 			pbBuffer += loopLen;
 		}
+		
+		if (JitterRngCtx)
+		{
+			jent_entropy_collector_free (JitterRngCtx);
+			JitterRngCtx = NULL;
+		}
 	}
 
 	shared_ptr <Hash> RandomNumberGenerator::GetHash ()
@@ -232,4 +254,5 @@ namespace VeraCrypt
 	size_t RandomNumberGenerator::ReadOffset;
 	bool RandomNumberGenerator::Running = false;
 	size_t RandomNumberGenerator::WriteOffset;
+	struct rand_data *RandomNumberGenerator::JitterRngCtx = NULL;
 }

src/Core/RandomNumberGenerator.h

@@ -16,6 +16,7 @@
 #include "Platform/Platform.h"
 #include "Volume/Hash.h"
 #include "Common/Random.h"
+#include "Crypto/jitterentropy.h"
 
 namespace VeraCrypt
 {
@@ -53,6 +54,7 @@ namespace VeraCrypt
 		static size_t ReadOffset;
 		static bool Running;
 		static size_t WriteOffset;
+		static struct rand_data *JitterRngCtx;
 	};
 }
 

src/Core/Unix/CoreService.cpp

@@ -13,6 +13,7 @@
 #include "CoreService.h"
 #include <fcntl.h>
 #include <sys/wait.h>
+#include <stdio.h>
 #include "Platform/FileStream.h"
 #include "Platform/MemoryStream.h"
 #include "Platform/Serializable.h"
@@ -290,6 +291,53 @@ namespace VeraCrypt
 
 			while (!ElevatedServiceAvailable)
 			{
+				//	Test if the user has an active "sudo" session.
+				//	This is only done under Linux / FreeBSD by executing the command 'sudo -n uptime'.
+				//	In case a "sudo" session is active, the result of the command contains the string 'load average'.
+				//	Otherwise, the result contains "sudo: a password is required".
+				//	This may not work on all OSX versions because of a bug in sudo in its version 1.7.10,
+				//	therefore we keep the old behaviour of sending a 'dummy' password under OSX.
+				//	See : https://superuser.com/questions/902826/why-does-sudo-n-on-mac-os-x-always-return-0
+				//
+				//	If for some reason we are getting empty output from pipe, we revert to old behavior
+				//	We also use the old way if the user is forcing the use of dummy password for sudo
+				
+#if defined(TC_LINUX ) || defined (TC_FREEBSD)
+				
+				if (!Core->GetUseDummySudoPassword ())
+				{
+					std::vector<char> buffer(128, 0);
+					std::string result;
+					bool authCheckDone = false;
+					
+					FILE* pipe = popen("sudo -n uptime 2>&1 | grep 'load average' | wc -l", "r");	//	We redirect stderr to stdout (2>&1) to be able to catch the result of the command
+					if (pipe)
+					{
+						while (!feof(pipe))
+						{
+							if (fgets(buffer.data(), 128, pipe) != nullptr)
+								result += buffer.data();
+						}
+						
+						fflush(pipe);
+						pclose(pipe);
+						pipe = NULL;
+						
+						if (!result.empty() && strlen(result.c_str()) != 0)
+						{
+							authCheckDone = true;
+							if (result[0] == '0') // no line found with "load average" text, rerquest admin password
+								(*AdminPasswordCallback) (request.AdminPassword);
+						}
+					}
+					
+					if (authCheckDone)
+					{
+						//	Set to false to force the 'WarningEvent' to be raised in case of and elevation exception.
+						request.FastElevation = false;
+					}
+				}
+#endif				
 				try
 				{
 					request.Serialize (ServiceInputStream);
@@ -396,6 +444,7 @@ namespace VeraCrypt
 		vector <char> adminPassword (request.AdminPassword.size() + 1);
 		int timeout = 6000;
 
+		//	'request.FastElevation' is always false under Linux / FreeBSD when "sudo -n" works properly
 		if (request.FastElevation)
 		{
 			string dummyPassword = "dummy\n";
@@ -457,6 +506,7 @@ namespace VeraCrypt
 				outPipe->Close();
 				errPipe.Close();
 
+				//	'request.FastElevation' is always false under Linux / FreeBSD
 				if (request.FastElevation)
 				{
 					// Prevent defunct process

src/Core/Unix/CoreUnix.cpp

@@ -465,6 +465,7 @@ namespace VeraCrypt
 					continue;
 				}
 
+				options.Password.reset();
 				throw;
 			}
 
@@ -473,8 +474,10 @@ namespace VeraCrypt
 
 		if (options.Path->IsDevice())
 		{
-			if (volume->GetFile()->GetDeviceSectorSize() != volume->GetSectorSize())
+			const uint32 devSectorSize = volume->GetFile()->GetDeviceSectorSize();
-				throw ParameterIncorrect (SRC_POS);
+			const size_t volSectorSize = volume->GetSectorSize();
+			if (devSectorSize != volSectorSize)
+				throw DeviceSectorSizeMismatch (SRC_POS, StringConverter::ToWide(devSectorSize) + L" != " + StringConverter::ToWide((uint32) volSectorSize));
 		}
 
 		// Find a free mount point for FUSE service

src/Core/VolumeCreator.h

@@ -45,6 +45,7 @@ namespace VeraCrypt
 				Ext3,
 				Ext4,
 				MacOsExt,
+				APFS,
 				UFS
 			};
 

src/Crypto/Aeskey.c

@@ -27,6 +27,7 @@
 
 #include "Aesopt.h"
 #include "Aestab.h"
+#include "Common/Tcdefs.h"
 
 #ifdef USE_VIA_ACE_IF_PRESENT
 #  include "aes_via_ace.h"
@@ -95,6 +96,8 @@ AES_RETURN aes_encrypt_key128(const unsigned char *key, aes_encrypt_ctx cx[1])
         cx->inf.b[1] = 0xff;
 #endif
 
+    burn(ss, sizeof(ss));
+
 #if defined( AES_ERR_CHK )
     return EXIT_SUCCESS;
 #endif
@@ -147,6 +150,8 @@ AES_RETURN aes_encrypt_key192(const unsigned char *key, aes_encrypt_ctx cx[1])
         cx->inf.b[1] = 0xff;
 #endif
 
+    burn(ss, sizeof(ss));
+
 #if defined( AES_ERR_CHK )
     return EXIT_SUCCESS;
 #endif
@@ -202,6 +207,8 @@ AES_RETURN aes_encrypt_key256(const unsigned char *key, aes_encrypt_ctx cx[1])
         cx->inf.b[1] = 0xff;
 #endif
 
+    burn(ss, sizeof(ss));
+
 #if defined( AES_ERR_CHK )
     return EXIT_SUCCESS;
 #endif
@@ -352,6 +359,8 @@ AES_RETURN aes_decrypt_key128(const unsigned char *key, aes_decrypt_ctx cx[1])
         cx->inf.b[1] = 0xff;
 #endif
 
+    burn(ss, sizeof(ss));
+
 #if defined( AES_ERR_CHK )
     return EXIT_SUCCESS;
 #endif
@@ -439,6 +448,8 @@ AES_RETURN aes_decrypt_key192(const unsigned char *key, aes_decrypt_ctx cx[1])
         cx->inf.b[1] = 0xff;
 #endif
 
+    burn(ss, sizeof(ss));
+
 #if defined( AES_ERR_CHK )
     return EXIT_SUCCESS;
 #endif
@@ -538,6 +549,8 @@ AES_RETURN aes_decrypt_key256(const unsigned char *key, aes_decrypt_ctx cx[1])
         cx->inf.b[1] = 0xff;
 #endif
 
+    burn(ss, sizeof(ss));
+
 #if defined( AES_ERR_CHK )
     return EXIT_SUCCESS;
 #endif

src/Crypto/Camellia.c

@@ -3,7 +3,7 @@
 #include "Crypto/cpu.h"
 #include "Crypto/misc.h"
 
-#if CRYPTOPP_BOOL_X64
+#if CRYPTOPP_BOOL_X64 && !defined(CRYPTOPP_DISABLE_ASM)
 
 /* camellia.c ver 1.2.0-x86_64_asm1.1
  *

src/Crypto/Camellia.h

@@ -17,7 +17,7 @@ void camellia_set_key(const unsigned __int8 userKey[], unsigned __int8 *ks);
 void camellia_encrypt(const unsigned __int8 *inBlock, unsigned __int8 *outBlock, unsigned __int8 *ks);
 void camellia_decrypt(const unsigned __int8 *inBlock,  unsigned __int8 *outBlock, unsigned __int8 *ks);
 
-#if CRYPTOPP_BOOL_X64
+#if CRYPTOPP_BOOL_X64 && !defined(CRYPTOPP_DISABLE_ASM)
 void camellia_encrypt_blocks(unsigned __int8 *ks, const byte* in_blk, byte* out_blk, uint32 blockCount);
 void camellia_decrypt_blocks(unsigned __int8 *ks, const byte* in_blk, byte* out_blk, uint32 blockCount);
 #endif