Truecrypt Container Mode

[Arthur]

So I would use the same MSI and just apply the relevant MST/package.ini file, yeah? That's cool. I'll give that a spin.

Correct.

 

Am I right in thinking that if someone forgets their TrueCrypt password or dismounts the drive incorrectly, they permanently lose all the data?

If you backup the headers of the encrypted volume it shouldn't matter if someone forgets their password since you can just restore the header for that volume to restore the original password. In terms of data loss, if TrueCrypt is left running in the background while in container mode it supposedly prevents that from happening.

[enjay]

Okay, I've been doing some playing with this, and have it working pretty nicely if I configure the autorun to mount the volume. The catch is that the manual process doesn't seem to work (saying something similar to password error or volume not found) and is far too complicated, but we have autorun.inf disabled.

 

Given that disabling autorun.inf saved us from the likes of conficker, I don't really want to go releasing it.

 

So, what do I do?

[enjay]

So I've spent the day looking at Cryptainer, TrueCrypt and a Lexar hardware-encrypted pen drive - the front-runner by far was Cryptainer, for the ease of use and difficulty of fouling it up. It is quite expensive though (£40/user), so I want to try a few others before I go and buy that.

 

What I'm after is something as simple as possible to use, the closer it is to double-click, enter password then start working the better.

 

Any suggestions?

[Arthur]

What I'm after is something as simple as possible to use, the closer it is to double-click, enter password then start working the better.

Not sure if it helps, but I use a combination of AutoIt and a Autorun.inf (so you can still right-click the USB flash drive and mount/unmount the TrueCrypt volume). More info here...

 

http://www.edugeek.net/forums/scripts/30327-arrrrggghh-vbs-quotes-2.html#post287766

 

The reason for using AutoIt was so that the encrypted volume still mounted properly even when the drive letter changed.

[enjay]

Not sure if it helps, but I use a combination of AutoIt and a Autorun.inf (so you can still right-click the USB flash drive and mount/unmount the TrueCrypt volume).

 

Autorun is disabled here, and considering things like Conficker, I'm not sure I want to change that...

[Arthur]

Autorun is disabled here, and considering things like Conficker, I'm not sure I want to change that...

We have autorun disabled too for exactly the same reasons. However, that doesn't mean you can't use the autorun.inf to add items to the context menu of the flash drive when a user right-clicks it e.g. mount/unmount.

 

http://msdn.microsoft.com/en-us/library/cc144200(VS.85).aspx#shell

[enjay]

We have autorun disabled too for exactly the same reasons. However, that doesn't mean you can't use the autorun.inf to add items to the context menu of the flash drive when a user right-clicks it e.g. mount/unmount.

 

That's true - didn't think of that...

[enjay]

use the autorun.inf to add items to the context menu of the flash drive when a user right-clicks it e.g. mount/unmount.

 

Absolutely genius, thank you. That works a treat.

 

So, the options are now TrueCrypt for free but with data corruption if misused and no password recovery, or Cryptainer which has neither of those limitations but costs £1500. Hmm...

[enjay]

@Arthur - that doesn't play nicely on Win7, though, since it handles autorun in a different way; presumably the same applies to Macs, too.

 

I tried creating a shortcut which had the same command as the autorun file (on Win7 this is), but for some reason it comes back saying "file not found".

 

Any ideas?

[Arthur]

I noticed this too when I tested it on my Windows 7 computer at home. For the Mount.au3 script, try this instead...

 

#NoTrayIcon
#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_icon=..\TrueCrypt\Icon.ico
#AutoIt3Wrapper_outfile=..\Mount.exe
#AutoIt3Wrapper_UseUpx=n
#AutoIt3Wrapper_Res_Description=Mounts TrueCrypt encrypted volumes
#AutoIt3Wrapper_Res_Fileversion=1.0.6.3
#AutoIt3Wrapper_Res_LegalCopyright=GPL
#AutoIt3Wrapper_Res_Language=2057
#AutoIt3Wrapper_Res_SaveSource=y
#AutoIt3Wrapper_Run_After=upx.exe --best --compress-resources=0 "%out%"
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****

; Declare variables
Dim $truecrypt_hdd, $truecrypt_usb, $volume, $switches

; Variables
$truecrypt_hdd = '"' & @ProgramFilesDir & '\TrueCrypt\TrueCrypt.exe' & '"'
$truecrypt_usb = '"' & @ScriptDir & '\TrueCrypt\TrueCrypt.exe' & '"'
$volume = '"' & @ScriptDir & '\TrueCrypt\Encrypted.tc' & '"'
$switches = ' /v ' & $volume & ' /q background /cache y /history n /mountoption removable /explore /beep'

; Mount encrypted volume
If FileExists($truecrypt_hdd) Then
ShellExecute($truecrypt_hdd, $switches, "", "open")
Else
ShellExecute($truecrypt_usb, $switches, "", "open")
EndIf

 

Hopefully it all makes sense?

[enjay]

Fell at the first hurdle, I'm afraid - what and where is the mount.au3 script?!

[Arthur]

I should have mentioned that the Mount.exe used in my Autorun.inf was a compiled AutoIt script (Mount.au3) that I used to launch TrueCrypt and mount the encrypted container and not something included with TrueCrypt as standard.

 

shell\Item1=&Mount TrueCrypt Volume
shell\Item1\command=[b]Mount.exe[/b]

 

You can substitute the bit shown in bold for the command-line you use to mount your encrypted container file. The reason I used AutoIt was so that TrueCrypt could still mount this file even when the drive letter changed.

 

If you post your Autorun.inf, I'll see if I can help.

[enjay]

My autorun.inf currently looks like this:

 

[autorun]

label=Encrypted Disk

icon=TrueCrypt\TrueCrypt.exe

action=Open Encrypted Area

open=TrueCrypt\TrueCrypt.exe /q background /e /m rm /v "TC-private"

shell\verb=Open Encrypted Area

shell\verb\command=TrueCrypt\TrueCrypt.exe /q background /e /m rm /v "TC-private"

shell\dismount=Dismount all TrueCrypt volumes

shell\dismount\command=TrueCrypt\TrueCrypt.exe /q /d

 

Before release, I will change "dismount all TrueCrypt volumes" to something which people will understand!

[enjay]

Still struggling with this on Win7 - I tried the shell\item1, but it didn't do anything. I'm not against using AutoIT if you reckon that is easiest (although I've never used it before).

 

I'll also need a Mac-friendly way of doing this too...

[Arthur]

Apologies for the delay getting back to you. I've done a bit of investigating and it seems there's a bug in Vista and 7 when using the Shell command and relative paths in an Autorun.inf. This means...

 

shell\dismount\command=TrueCrypt\TrueCrypt.exe /q /d

becomes...

 

shell\dismount\command=[b]C:\Windows\System32\[/b]TrueCrypt\TrueCrypt.exe /q /d

... which could be why it's not working for you?

 

Then there's the other issue of Microsoft disabling Autorun for everything except for CD/DVDs. This affects Windows 7 and Vista/XP once KB971029 has been installed. The only solution I can think of would be to use a script (AutoIt, VBScript or Batch File) located in the root of the USB flash drive which mounts/unmounts the TrueCrypt container when autorun doesn't work or the items on the context menu do not show up?

[enjay]

The only solution I can think of would be to use a script (AutoIt, VBScript or Batch File) located in the root of the USB flash drive which mounts/unmounts the TrueCrypt container when autorun doesn't work or the items on the context menu do not show up

 

How would I deal with people's USB drives getting different drive letters? Is there a way of giving a relative path, or would I just have to create several scripts, one for each drive letter?

[Arthur]

The only way I can see that you could get around the drive letter issue would be to use a script or perhaps USBDLM if the flash drives are mainly going to be used at school.

[Arthur]

I would normally use AutoIt for something like this, but you could use a batch file like the one below to automatically find the drive letter of the USB flash drive without having separate scripts for each drive letter.

 

Mount.cmd

@echo off
:: Find drive letter of USB flash drive by locating a file called Tag.txt in the root of the drive.

set tagfile=\[b]Tag.txt[/b]
for %%i in (c d e f g h i j k l m n o p q r s t u v w x y z) do if exist "%%i:%tagfile%" set USBDRIVE=%%i:

:: Run TrueCrypt and open the container file.
start "%USBDRIVE%\TrueCrypt\TrueCrypt.exe" /q background /e /m rm /v "TC-private"

[enjay]

Sorry, I should have clarified that the Win7 and Mac computers are staff members' home computers, we're XP throughout school. I've got the XP/school side sorted with the right-click options which you gave me earlier, I'm just now trying to find a way of enabling staff to easily use the pen drives when they get home.

[enjay]

That batch file works an absolute treat, thank you so much.

 

Any offers for how to do this on a Mac now?!

[Arthur]

Glad that worked. I've never actually used TrueCrypt on a Mac. I'll try a few things on my Mac mini at home tonight and see what I can come up with.

 

In the mean time, the AppleScript on the website below might be what you need?

 

http://www.gensthaler.de/en/?Projects:AppleScripts

[enjay]

That would be beyond awesome if you could test it for me...

[Arthur]

I have had a go with TrueCrypt on my Mac now, but there are two fairly major issues I've come across.

 

The first is that the TrueCrypt application on OS X depends on MacFUSE and this needs to be installed on each Mac the encrypted flash drive will be used on. While you could get staff to install this pre-requisite beforehand (it's included in the TrueCrypt installer), it kind of defeats the point of using the "traveller mode" when you have to install additional software to get it working. I suppose you could include a copy of the TrueCrypt installer on your USB flash drives given that the staff will most likely have the relevant permissions to install applications on their home Mac's?

 

Secondly, when I used the AppleScript linked above, mounting the encrypted container worked perfectly but it was impossible to unmount the flash drive cleanly since there were a couple of hidden TrueCrypt processes which were still accessing the drive and prevented it from being ejected properly. I had to open Activity Monitor and kill the TrueCrypt processes. Perhaps, Automator might be better in this regard?

[enjay]

I don't think the need for MacFUSE completely defeats the point of Traveller mode, since we wish Traveller as a means of transferring data from school to home (let's face it, PC users need admin rights to use Traveller, too).

 

Once the initial set up had been done, how fiddly was it to mount/unmount the volume?

[Arthur]

I don't think the need for MacFUSE completely defeats the point of Traveller mode, since we wish Traveller as a means of transferring data from school to home (let's face it, PC users need admin rights to use Traveller, too).

Good point.

 

Once the initial set up had been done, how fiddly was it to mount/unmount the volume?

It was actually really easy. Just need to solve the unmounting issue though.