How should I password protect an external hard drive?
Hi, everyone. Leo Notenboom
here for askleo.com.
Let's dive right into the question because it's a common one.
I'm wondering if it's possible to password protect a USB flash drive or any other
external total hard drive if I'm using Windows as my operating system.
In Windows. There's a feature called BitLocker.
Is it any different than putting on a password?
So let's be clear about something.
A password is not enough.
A password.
Even if you were able to somehow associate a password with the drive,
unless the information on that drive is itself somehow protected by encryption,
then the password doesn't really get you anything, because that way somebody could
take that drive to another machine that doesn't follow the password protocol
or whatever it is, and they can still access the information.
What's important here is that the information on the drive be protected.
And the way it's protected is
by encrypting it and requiring a password to get at it.
And yes, BitLocker is one approach.
I will show you how to password protect an external drive using BitLocker,
and then I will show you how to password protect an external drive using VeraCrypt
instead, in case you have an addition of Windows that doesn't support BitLocker.
So here we are in windows eleven. Pro.
This pro edition does support BitLocker.
I'm going to fire up
Windows File Explorer, and you can see that I have a drive here.
I call it my Fauxb because I had
to manufacture or something that looked like a USB drive.
The answer is actually very simple.
You right click on it, turn on BitLocker,
and select Use a password to unlock the drive.
I'm going to use a very short
and unsecured password just for demonstration purposes.
And yes, you can see that there are other options here associated with that.
I'm not going to delve into that.
We're just going to focus on the one
problem, how to encrypt the data, how to protect the data on this drive.
Do not forget the password.
You will not be able to get back the information without it.
Now, I say that, but you can also save
a recovery key that can, in some cases, be used to extract the data.
Should you forget the password,
I recommend you just don't forget the password.
Save the password.
Save the key, but save the password.
And I say that, but of course,
you immediately are required to save something called a recovery key,
which is for exactly that purpose, forgetting your password.
You are required to save this key somewhere.
I'm going to go ahead and save it to my Microsoft account,
which will upload it to there, and you can access it later if you need to.
My strong recommendation is that you never rely on this.
You don't plan on relying on this.
Choose a password,
a passphrase that you'll remember or that you've saved somewhere else securely.
We'll hit next encrypt the used disk space only.
This means that only the files that are currently on the drive will be encrypted.
All the free space and whatever it may
have had in the past will remain unencrypted.
As new data is written to the drive,
of course, that will be encrypted automatically.
It's only about what remains in the free space.
Encrypting the entire drive is the way to prevent that from being an issue.
It literally encrypts everything,
be it the files you have on the drive and the free space, so that no matter what
may have been there in the past, it won't necessarily be visible.
Should somebody be able to use an undelete
utility or something like that, I'm just going to do only the used disk space.
New encryption method is fine.
I really don't see a reason not to choose this option.
And yes, I'm ready to encrypt.
And it's that quick.
It just did encrypt the drive.
And in fact, if I take a look at the drive,
I don't have anything on it, but it acts like any other drive.
That's why BitLocker is actually a really good solution with a couple of caveats.
It is transparent.
Once you turn it on, things just work.
Once you supply the password,
the drive is there and unlocked, just like any other drive.
There are two big downsides.
BitLocker, used in this way, is only available in Windows Pro Edition.
Windows, seven windows, ten windows, eleven.
It's always the Pro Edition, or better, like the Enterprise Edition and so forth.
Most notably, it's not present in the home edition of Windows.
So if you have the Home Edition, this isn't going to work for you.
The other is that it only works with Windows.
So if you're expecting to take that drive to some other operating system like say,
Mac or Linux or somewhere else, then BitLocker is not a solution.
It'll be encrypted, it'll be safe.
It will be so safe you can't read it anywhere else but on a Windows machine.
So what's the solution for that?
How do we deal with that?
Well, let's go over to a different machine.
This is Windows Ten Home Edition.
What we're going to do is we're going to install and use VeraCrypt to fully
encrypt the external drive here, to be clear, once again,
in Windows File Explorer, you can see that I have another foe USB, this E drive.
It is empty, but it's effectively an external drive, a USB drive.
So the first thing we're going to do is load up VeraCrypt.com.
You can see it redirects to a different
domain, but the bottom line is this is VeraCrypt.
This is the VeraCrypt website.
We're going to go to downloads,
and for me, for Windows, I'm going to go ahead and use the MSI installer 64 bit.
That's my recommendation.
In general, it's downloading.
We've opened the set up program.
I'm going to go ahead and get rid of Edge right now hit Next.
Accept the terms. Hit Next.
Install for all users.
I personally don't like desktop shortcuts.
I want it on the Start menu and sure,
the HC file extension, we can go ahead and associate with it.
You may want to review the tutorial.
If you've never used VeraCrypt for the purposes of this video,
I'm just going to do the thing so you can see exactly what it takes.
So VeraCrypt has now been added to the Start menu.
Somewhere like right there.
VeraCrypt.
So the default Vera crypt interface.
Yeah, it's kind of intimidating.
The good news is that the steps we're about to take are pretty simple.
What we're going to do is create a volume.
What we're going to do is encrypt a nonsystem partition or drive.
Essentially what that means is we're going to encrypt a drive or external drive.
The encrypted file container is something we'll talk about another time.
Encrypting the system partition or the entire system drive is specifically
for encrypting your C partition or the partition you boot from.
That requires a little bit more work.
Again, we're not going to deal with that.
We're only worried about the external drive we have here.
We'll hit next.
This is going to be a standard Vira crypt volume, the volume location.
In other words, we're going to select the device we care about.
I've clicked on Select Device and you can
see here that ender hard disk one in partition two is E.
That faux USB that I had created.
It's a 32 gigabyte USB drive.
Don't worry about any of the rest of this.
Create the encrypted volume and format it.
What that means is that we are going to erase everything that's there.
It's my recommendation in general,
but if you've got data that's stored on that drive already,
then you'll want to encrypt the partition in place, the algorithms.
Unless this is something that's super interesting to you, skip it.
Just hit next.
Size of the drive.
Again, since this is a hard drive,
all we're doing here is verifying that it's about the size we think it is.
31gb is correct for my 32 gigabyte drive.
Here's where you specify your password.
Now, it's probably going to complain that my password is too short,
which is fine, but you do want to make sure you've got
an appropriate password for the level of security you expect.
Remember an external hard drive,
if somebody steals it, that means they have the opportunity to brute force it.
I typed in an eight character password.
They can probably brute force that in short order.
You'll want a passphrase that's longer
and more secure and, of course, something that you'll remember.
This is a case where if you forget
the password, you will not get your data back, period.
There is no back door.
There is no saved key.
There's no nothing.
Remember this passphrase.
Lose it and you've lost your data.
These are the other things that other options you can use.
Again, I'm trying to keep it simple.
We're just going to do the basic thing here.
Yes. Do I want to keep using a short password?
Yes, I want to do that.
They recommend 20 characters or more, and I completely agree.
Large files.
Do I intend to store large files greater than 4GB?
This actually has more to do with the formatting.
The short answer for me is no.
Unless you're doing video or something
like that, it's probably not something that's going to come to mind for you.
This is kind of an interesting part.
First of all, we're going to select what kind of a file system we do.
And this is very much exactly like formatting a hard risk for initial use.
I'm going to go ahead and use Ex Fat so
that I can take it to some other machines if I want to cluster size, fine.
We'll do a quick format because I don't
have anything on the drive that I necessarily want to protect.
This is the same thing where it's only
going to encrypt the bare minimum to make the drive usable.
If you unselect quick format,
it's going to encrypt the entire drive and everything that used to be on it.
Now, this random pool thing is kind of interesting.
You'll notice that as I move the mouse around, the letters are changing.
I can have it look as an Hexadecimal
number if I like, but this is actually a little bit more entertaining.
The bottom line here is that encryption is
heavily dependent on randomness, and nothing is more random than you or I.
Moving the mouse around in random ways gives them a certain amount of randomness.
And you can see this bar moving here that says, you know what, it's getting better.
It's getting better.
Okay, now it's green.
You don't have to go all the way. It doesn't really matter.
If you really are concerned about the security and the ultimate inability
to decrypt this, you can go for the full green bar.
But at this point, I'm just going to go ahead and say, format
a warning that everything there is going to be erased.
This is an important little piece
of information, and I'll talk about that in a moment.
So if we now exit the Volume creation wizard, we'll find that what's really
changed is nothing other than our faux USB drive has this error.
Don't format the disk.
Remember, it's encrypted.
What that means is that Windows itself has
no idea what's on that drive and it doesn't know what to do.
So how do you get at the contents?
This is where you say auto mount devices.
Now, we have a free drive letter here.
I'll use the drive letter F that's currently not being used.
We'll auto mount devices.
It wants my password for that device.
And we'll click OK.
Now this is a little disconcerting the first time it happens.
Mounting for whatever reason in VeraCrypt can actually take a moment or two while it
does its job, and your entire system, or just VeraCrypt, will seem unresponsive
for a certain amount of time while it's doing this job.
But once it's done, we've now mounted this encrypted drive.
What does that mean?
Well, to go back to Windows File Explorer again, we'll see.
We've still got this faux USB thing on e, but we can't look at it.
F is what we care about.
Remember, f is the drive.
We mounted this as.
This is your encrypted drive.
The files you put here are encrypted automatically.
You just use F like you would any other drive.
You copy files to it, you read files from it.
When you're done, before you eject the USB
drive, you then say, There's F, and we're going to dismount it.
Now, all of a sudden, the F drive is no longer visible
in Windows File Explorer, and neither is your encrypted data.
It's gone, it's on the drive, it's encrypted, but it's not visible.
This is how you do a full encrypted external USB using VeraCrypt.
Like anything, VeraCrypt has pros and cons.
The cons you've kind of seen there's
a process to set it up, you have to mount the thing.
It doesn't show up as the same drive
letter, so it's not quite as transparent as, say, a Bitlocker solution.
But once you've got it mounted, the pros are actually pretty strong.
You can use the mounted drive like you would use any drive.
You just copy things to it, take things off of it.
Whatever stays on that drive is encrypted at the hardware level.
Once you dismount it, it's just an encrypted drive.
Nobody can see what's on it.
As long as you don't forget the password,
you can then mount it again using Viracrit on another machine.
And that's one of the other hidden
benefits of VeraCrypt, is that you can use VeraCrypt on more than just Windows.
Not only does it work on all editions
of Windows, it works on a Mac, it works on Linux.
So it's a wonderful way to ensure that your encrypted data could potentially
be used by other machines other than Windows.
Unlike BitLocker, there's one more drawback to VeraCrypt.
It needs to be installed.
In fact, I believe it actually needs to be
installed by someone with administrative privileges.
And I believe you may need administrative privileges to do the mount.
But beyond that, it's a pretty nifty solution.
Now, the solution that I've just shown you walks through encrypting the entire drive.
There's another approach using VeraCrypt,
where you essentially create a file that is a volume on that drive.
I'm not going to go into it here.
The bottom line, though,
is that I do have that covered in the companion article
for this at askleo.com/6250, that uses what's called a VeraCrypt file
container, which is a file that's visible on the USB drive.
But the contents of the file are encrypted.
You mount the file, just like we mounted this old hard drive,
and then you can access the contents of that file as if it were a drive itself.
Again, the steps are very similar,
but those are on the companion article with this video.
I hope that's helpful.
I hope that gives you two solid ways to encrypt your hard drives BitLocker if
you're doing only Windows and Windows Pro, or better.
Or VeraCrypt if you need something that's going to work on other editions of Windows
and other operating systems besides Windows.
For comments, for updates, for related links and more, visit askleo.com/6250
I'm Leo Notenboom.
And this is Askleo.com. Thanks for watching.