TrueCrypt whole disk encryption: process and performance

TrueCrypt now offers whole disk encryption. I've used this software regularly for the past three years for its standard encryption functionality (which is awesome) but was cautious about using it for the whole disk. But after scanning through this transcript I decided that TrueCrypt is probably robust enough for the job by now, so I gave it a whirl on my laptop. I won't explain the full rationale for whole disk encryption here, just relate the results and offer some comparisons with other whole-disk encryption products I've used.

You use a wizard-like dialog box to step through the encryption process, and the steps are pretty straightforward. You pick your password and generate your keys, then the program makes you burn a .ISO of a rescue disk (mine was 2mb in size) and then it checks the rescue disk to ensure it was burned properly. The system then replaces your bootloader and does a test reboot before it even starts the encryption process, to make sure the TrueCrypt bootloader will work on your machine. At each step there is a lot of detailed explanatory text and I really get the sense that the program's authors know their way around all the possibilities and have the user's best interest in mind.

Feature Comparison: Like other products, TrueCrypt's encryption process happens "in-place" - you can use your computer normally while the hard drive is being encrypted. It took about 45 minutes to encrypt my 32GB drive (without the full disk wipe option).

The pre-boot authentication is very simple. The screen is plain-text, no graphic logos. You type in your password which is shown as asterisks on the screen, after which the computer boots normally. Hopefully future versions will allow some customization of this screen. Some people have even asked for the option of a blank screen with no visual feedback as you type, allowing you to lie to people and say the thing is broken and won't boot up, could be very useful.

Unlike other products I have used, such as GuardianEdge, TrueCrypt does not support single sign-on. With single sign-on, the encryption software synchronises your pre-boot password with your Windows password, and you only have to type in your password once - at bootup - and the encryption software logs into Windows for you. Hopefully this can be added later as well.

Performance: One of the guys in the transcript I mentioned earlier made the interesting claim that his hard disk performance bechmarks actually improved after the encryption was in place. I was curious about this, so I did some performance benchmarks of my hard drive before and after the encryption.

My laptop is a bit unusual because it has a small 32GB SSD flash drive instead of a spinning-disc hard drive. This means it is a lot faster than a normal hard disk to start with. Here is the "before" benchmark:



(As you'll see if you check out some comparison shots from HD Tune's website, a 0.3 msec seek time is pretty durn fast. Also an SSD's performance doesn't vary depending on the location of the file, while on a normal disk the files on the outside of the spinning disk come up faster. But I disgress.)

Here is the "after" shot:


The access time is still pretty low, but the average transfer rate has droppped by 40% and CPU usage has roughly quintupled.

It's possible that a normal spinning disk would actually experience gains as a byproduct of TrueCrypt encryption, but I haven't had time to try it out and I probably won't get to it anytime soon.

Resurrected

Welcome to Notely, the successor to my old tech-notes blog Notepad.Exe. Like its progenitor, this site exists mainly for me to record tips and solutions to unusual techie-type problems that I occasionally encounter and solve. That way hopefully the solution will be ready to hand for anyone googling for solutions to the same problems in the future. I accidentally deleted the original version of this blog but was able to rebuild it thanks to the fact that the Wayback Machine has a snapshot of it from 2006. All the old posts are here (with the original timestamps even!) - the only thing is I couldn't save all the comments from the previous posts. Posts are not regular or frequent, but they are focused and (I like to think) well-written. Even if it seems like I haven't been here awhile, rest assured I'll be back when I have a new solution worth recording. Some of the more helpful posts, judging by past feedback, are:

• Solution for Windows Error: Directory or File could not be created - Oct 31, 2006
• Outlook 2003 - Warn if subject line empty - July 1, 2005

Tips for setting up your own MediaWiki

I just set up my first MediaWiki for our corporate intranet. It's easy to do, but the vanilla MediaWiki installation is missing some features that you'll probably want to duplicate from Wikipedia. I found myself wishing that there were some steps I could follow to get the wiki quickly to that point. Here's the result:

1. Install MediaWiki
2. Add the logo
3. Enable the 'upload files' capability
   
4. Copy the 'ambox' template from Wikipedia - also download a copy of all the little ambox icons
5. Install the Reference extension to enable actual footnotes
6. Install the FCKeditor MediaWiki extension

Windows error: Directory or File could not be created

I once helped a guy out with a wierd problem: he was trying to save an Excel Spreadsheet to a USB flash drive, and kept coming up with this error:

The file or directory could not be created.

We tried dragging and dropping the file – same error. There was plenty of space available on the USB drive, and fragmentation was not an issue.

I finally figured out that the problem was that the flash drive’s root directory (where we were trying to save the file) had too many files with really long filenames. The FAT filesystem has a limit on the number of filename characters that can be used in the root directory. From MS TechNet :

“An interesting side effect results from the way VFAT stores its long filenames. When you create a long filename with VFAT, it uses one directory entry for the MS-DOS alias and another entry for every 13 characters of the long filename. In theory, a single long filename could occupy up to 21 directory entries. The root directory has a limit of 512 files, but if you were to use the maximum length long filenames in the root directory, you could cut this limit to a mere 24 files. Therefore, you should use long filenames very sparingly in the root directory. Other directories aren’t affected by this limit.”

This drive’s root directory had a lot of files with very long filenames, so that although there was plenty of physical space available for storage, the limitations of the filesystem itself prevented the addition of another file with more than ten or so characters in the filename.

This was confirmed when we renamed the file “test.xls” (fewer letters) and were able to copy it to the flash drive successfully.

The solution, as you might suspect, is better organization. Rather than storing all your files in the root directory, create some folders and store your files inside those.

Most USB drives are formatted as FAT for compatibility between various platforms and I suggest you leave it that way.

Internet Explorer keeps crashing when accessing CRM

Can you tell we've been having fun with Microsoft CRM lately? On one of our machines, IE was able to access CRM as normal but would always crash after a couple of clicks. This turned out to be a known IE bug. Microsoft has released a fix which you can download here.

Sharepoint Site - "access denied"

Incidentally, we have also had users unable to log in to SharePoint sites — the browser would say something like "access denied" without even giving them a chance to login — and found that the cause was essentially the same problem as the post below: cached incorrect username/password combinations.

Once again, simply delete the affected sites' entry from the Managed Passwords list as described in that post. Also make sure that any SharePoint sites you use are in your "trusted sites" list under IE's Internet Options window.

CRM Outlook client won't go back online; IE CRM client closes abruptly

When using the outlook client for MS CRM 3.0, and trying to click the Go Online button, you may get an error message saying:

“Microsoft CRM cannot go online. The Microsoft CRM server was not found.”

Often when this is the case, you are also unable to access CRM directly through Internet Explorer. You can confirm this is the problem by opening a new Internet Explorer window, typing the name of your CRM server in the address bar (usually just “crm”), and clicking “Go.” IE will resize for a split-second and then just abruptly disappear.

First of all, make sure of the following:

1. That you are connected to the LAN and logged in to the Windows domain
2. That the url of your CRM server is in your “Trusted Sites” list in Internet Explorer, and that the security level for “Trusted Sites” is set to “Low”.

What’s happening is that IE has cached a username/password combo for the CRM server that is incorrect. It fails in the background, and gives up without ever letting you know what happened or giving you a chance to enter it correctly.

To fix it:

1. Go to Control Panel → User Accounts. Click the Advanced tab, and click “Manage Passwords”.
2. If we’re on the right track, you will see an entry for the CRM server among the list of stored passwords. Go ahead and delete it.