mirror of
https://github.com/veracrypt/VeraCrypt.git
synced 2026-10-22 06:12:35 +00:00
Mounir IDRASSIandGitHub
ac09940bd9
* Windows: protect system encryption support files Use protected Common Files storage and validated file handles for setup scripts, driver packages and loader backups. Remove legacy registrations and preserve recovery backups without accepting untrusted contents. Fail incomplete service replacement and keep setup configuration errors independent of boot-loader repair. * Windows: fix system encryption setup failure handling Remove PostOOBE registration after failed setup, even if loader rollback fails, while preserving the original exception. Honor service wait hints and checkpoints with a two-minute cap, and preserve failure codes in both installers. Restore saved driver flags when service replacement fails.
86 lines
10 KiB
HTML
86 lines
10 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
|
<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
|
|
<meta name="description" content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
|
|
<meta name="keywords" content="encryption, security"/>
|
|
<link href="styles.css" rel="stylesheet" type="text/css" />
|
|
</head>
|
|
<body>
|
|
|
|
<div>
|
|
<a href="Documentation.html"><img src="VeraCrypt128x128.png" alt="VeraCrypt"/></a>
|
|
</div>
|
|
|
|
<div id="menu">
|
|
<ul>
|
|
<li><a href="Home.html">Home</a></li>
|
|
<li><a href="Code.html">Source Code</a></li>
|
|
<li><a href="Downloads.html">Downloads</a></li>
|
|
<li><a class="active" href="Documentation.html">Documentation</a></li>
|
|
<li><a href="Donation.html">Donate</a></li>
|
|
<li><a href="https://sourceforge.net/p/veracrypt/discussion/" target="_blank">Forums</a></li>
|
|
</ul>
|
|
</div>
|
|
|
|
<div>
|
|
<p>
|
|
<a href="Documentation.html">Documentation</a>
|
|
<img src="arrow_right.gif" alt=">>" style="margin-top: 5px">
|
|
<a href="System%20Encryption.html">System Encryption</a>
|
|
</p></div>
|
|
|
|
<div class="wikidoc">
|
|
<h1>System Encryption</h1>
|
|
<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
|
|
VeraCrypt can on-the-fly encrypt a system partition or entire system drive, i.e. a partition or drive where Windows is installed and from which it boots.</div>
|
|
<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
|
|
System encryption provides the highest level of security and privacy, because all files, including any temporary files that Windows and applications create on the system partition (typically, without your knowledge or consent), hibernation files, swap files,
|
|
etc., are always permanently encrypted (even when power supply is suddenly interrupted). Windows also records large amounts of potentially sensitive data, such as the names and locations of files you open, applications you run, etc. All such log files and
|
|
registry entries are always permanently encrypted as well.</div>
|
|
|
|
<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
|
|
<strong>Note on SSDs and TRIM:</strong>
|
|
When using system encryption on SSDs, it's important to consider the implications of the TRIM operation, which can potentially reveal information about which sectors on the drive are not in use. For detailed guidance on how TRIM operates with VeraCrypt and how to manage its settings for enhanced security, please refer to the <a href="Trim%20Operation.html">TRIM Operation</a> documentation.
|
|
</div>
|
|
|
|
<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
|
|
System encryption involves pre-boot authentication, which means that anyone who wants to gain access and use the encrypted system, read and write files stored on the system drive, etc., will need to enter the correct password each time before Windows boots
|
|
(starts). Pre-boot authentication is handled by the VeraCrypt Boot Loader, which resides in the first track of the boot drive and on the
|
|
<a href="VeraCrypt%20Rescue%20Disk.html" style="text-align:left; color:#0080c0; text-decoration:none">
|
|
VeraCrypt Rescue Disk (see below)</a>.</div>
|
|
<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
|
|
Note that VeraCrypt can encrypt an existing unencrypted system partition/drive in-place while the operating system is running (while the system is being encrypted, you can use your computer as usual without any restrictions). Likewise, a VeraCrypt-encrypted
|
|
system partition/drive can be decrypted in-place while the operating system is running. You can interrupt the process of encryption or decryption anytime, leave the partition/drive partially unencrypted, restart or shut down the computer, and then resume the
|
|
process, which will continue from the point it was stopped.</div>
|
|
<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
|
|
The mode of operation used for system encryption is <a href="Modes%20of%20Operation.html" style="text-align:left; color:#0080c0; text-decoration:none">
|
|
XTS</a> (see the section <a href="Modes%20of%20Operation.html" style="text-align:left; color:#0080c0; text-decoration:none">
|
|
Modes of Operation</a>). For further technical details of system encryption, see the section
|
|
<a href="Encryption%20Scheme.html" style="text-align:left; color:#0080c0; text-decoration:none">
|
|
Encryption Scheme</a> in the chapter <a href="Technical%20Details.html" style="text-align:left; color:#0080c0; text-decoration:none">
|
|
Technical Details</a>.</div>
|
|
<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
|
|
To encrypt a system partition or entire system drive, select <em style="text-align:left">
|
|
System</em> > <em style="text-align:left">Encrypt System Partition/Drive</em> and then follow the instructions in the wizard. To decrypt a system partition/drive, select
|
|
<em style="text-align:left">System</em> > <em style="text-align:left">Permanently Decrypt System Partition/Drive</em>.</div>
|
|
<div style="text-align:left; margin-top:19px; margin-bottom:19px; padding-top:0px; padding-bottom:0px">
|
|
Because of BIOS requirement, the pre-boot password is typed using <strong>US keyboard layout.
|
|
</strong>During the system encryption process, VeraCrypt automatically and transparently switches the keyboard to US layout in order to ensure that the password value typed will match the one typed in pre-boot mode.
|
|
However, pasting the password from the clipboard can override this protective measure. To prevent any issues arising from this discrepancy, VeraCrypt disables the option to paste passwords from the clipboard in the system encryption wizard.
|
|
Thus, when setting or entering your password, it's crucial to type it manually using the same keys as when creating the system encryption, ensuring consistent access to your encrypted system.</div>
|
|
<p>Note: By default, Windows 7 and later boot from a special small partition. The partition contains files that are required to boot the system. Windows allows only applications that have administrator privileges to write to the partition (when the system is
|
|
running). In EFI boot mode, which is the default on modern PCs, VeraCrypt can not encrypt this partition since it must remain unencrypted so that the BIOS can load the EFI bootloader from it. This in turn implies that in EFI boot mode, VeraCrypt offers only to encrypt the system partition where Windows is installed (the user can later manually encrypt other data partitions using VeraCrypt).
|
|
In MBR legacy boot mode, VeraCrypt encrypts the partition only if you choose to encrypt the whole system drive (as opposed to choosing to encrypt only the partition where Windows is installed).</p>
|
|
<p>In EFI boot mode with Secure Boot enabled, VeraCrypt selects a Microsoft UEFI CA-signed bootloader set allowed by the active firmware Secure Boot policy during install, repair, upgrade, or Windows PostOOBE repair: every required CA must be present in the allowed database (db) and absent from the forbidden database (dbx). The 2023 VeraCrypt loader set requires both Microsoft UEFI CA 2023 and Microsoft Option ROM UEFI CA 2023, while the 2011 loader set requires Microsoft Corporation UEFI CA 2011. If the active db/dbx policy permits neither supported set, VeraCrypt aborts instead of installing a loader that firmware will reject. If you manually change firmware Secure Boot db or dbx entries, run VeraCrypt repair or reinstall to refresh the installed bootloader set. For details, including the Microsoft 2023 certificate transition and recovery procedures, see <a href="EFISecureBoot.html" style="text-align:left; color:#0080c0; text-decoration:none">EFI Secure Boot</a>.</p>
|
|
<h3>Windows feature updates and recovery files</h3>
|
|
<p>Install the current VeraCrypt before preparing a Windows feature update. Resolve any warning about Windows feature update support before continuing. If Windows Setup has already staged its support files, restart feature-update preparation so that it stages the updated files. Updating VeraCrypt changes the source registration; it does not replace a script that Windows Setup has already copied. See Microsoft's <a href="https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-setup-command-line-options#postoobe" target="_blank">Windows Setup documentation</a> for details of script staging.</p>
|
|
<p>If the installer cannot verify or remove VeraCrypt's previous Windows feature update registrations, it reports installation failure because security remediation is incomplete. Resolve the reported error and run Repair/Reinstall. An encrypted-system upgrade also reports failure if it cannot publish the replacement support files. Resolve the error before starting a Windows feature update.</p>
|
|
<p>VeraCrypt checks the ownership and permissions of recovery backups before using or migrating them. On BIOS systems, automatic original-loader restoration requires a complete trusted backup. If that backup is unavailable, VeraCrypt asks for explicit confirmation before decryption or cleanup without automatic loader restoration; obtain trusted recovery media first. If an upgrade warns that the original loader backup is missing, damaged, unreadable, or untrusted, preserve any existing backup files and obtain a known trustworthy VeraCrypt Rescue Disk or a verified original backup before proceeding. Changing ownership or permissions alone cannot establish the safety of an old backup. Do not create a replacement backup from the current boot area of an encrypted system, or restore an unencrypted loader while the drive remains encrypted.</p>
|
|
<p>New support files are stored in the VeraCryptSystem directory under the native Common Files folder (normally C:\Program Files\Common Files). Recovery backups are retained during application uninstall. Cleanup removes VeraCrypt's Windows Setup registrations and leaves protected support files in place; it does not depend on deleting a file that another process has open. A failure to remove a registration still requires resolution.</p>
|
|
<p> </p>
|
|
<p><a href="Hidden%20Operating%20System.html" style="text-align:left; color:#0080c0; text-decoration:none; font-weight:bold">Next Section >></a></p>
|
|
</div>
|
|
</body></html>
|