Truecrypt Container Mode

[Arthur]

I think I have sussed it out. Here’s what I’ve done so far and it appears to work really well…

 

1) Download and install the Mac OS X version of TrueCrypt.

2) Download and open TrueCrypt_un-mount.dmg. I have also attached a copy to this post just in case the website disappears.

3) Drag TrueCrypt (un)mount to your USB flash drive. It could be in a sub-folder if you want to keep the Mac-specific files separate from the rest of the Windows bits?

4) Right-click on TrueCrypt (un)mount and select Show Package Contents.

5) Open main.scpt (Contents > Resources > Scripts) in AppleScript Editor. On Snow Leopard you will find this in /Applications/Utilities.

6) On the second line, modify the path so that it points to your encrypted container file. e.g.

 

From

property tcVolume : "/Volumes/USB-Stick/truecrypt/save.tc"

 

To

property tcVolume : "/Volumes/USB-Stick/TrueCrypt/TC-private"

 

In the example above, USB-Stick is the volume label of your flash drive. If it contains spaces you need to escape them using backslashes i.e. if you wanted to use "School Name" it would become "School\ Name". If the flash drive is formatted as FAT32 the label must be 11 characters or less in length.

 

On line 12, you can add additional command line parameters if you wish (more details here). I didn't bother since the default are fine. By the way, you can't use the exact same ones from the Windows batch file.

 

7) Save the script (via File > Save) and close AppleScript Editor.

 

All users have to do now is double-click on TrueCrypt (un)mount to mount the encrypted container file (after they have entered the correct password) and then double-click it again to unmount it. The flash drive itself can be safely ejected once this has been done.

TrueCrypt (un)mount.zip

[enjay]

Thanks so much Arthur. Only problem with that is that it requires non-technical people to start editing scripts - perhaps if documented carefully enough they'd get it...

[Arthur]

You only have to edit the script once. If you have access to a Mac, you could do it so they don't have to.

 

As long as the volume label of the flash drive didn't change that script would work for all staff Mac's.

[enjay]

You only have to edit the script once. If you have access to a Mac, you could do it so they don't have to.

 

As long as the volume label of the flash drive didn't change that script would work for all staff Mac's.

 

Yeah, that's probably what I'll do. I don't have a Mac myself, but I could easily borrow one next time I'm at an iFriend's house.

 

Thanks again for your help with this Arthur. I definitely owe you!

[enjay]

I'm still battling this, trying to find a teacher-friendly way of getting this working without enabling autorun. I thought the right-click options had it nailed, but I've just found they don't work on our restricted accounts - for some reason, they don't see the options.

 

I may just have to bite it and buy encrypted drives, but even those come with the issue of how long they take to open - personally, I don't think making people wait 15-20 seconds is acceptable. Also, a decent VLE (a project for next year) may obsolete the need for teachers carrying sensitive data on pen drives anyway!

[Arthur]

I'm still battling this, trying to find a teacher-friendly way of getting this working without enabling autorun. I thought the right-click options had it nailed, but I've just found they don't work on our restricted accounts - for some reason, they don't see the options.

They could double-click your batch files to mount/unmount the TrueCrypt volume couldn't they? It's only one more click.

 

I may just have to bite it and buy encrypted drives, but even those come with the issue of how long they take to open - personally, I don't think making people wait 15-20 seconds is acceptable.

15-20 seconds is quite a long time. Have you looked into why it takes so long (maybe using something like Process Monitor)? Does it just takes ages decrypting the drive or is it copying something to the HDD/network profile during this time?

 

Also, a decent VLE (a project for next year) may obsolete the need for teachers carrying sensitive data on pen drives anyway!

I suppose you then have to worry about teachers saving the sensitive data onto their home computers or leaving laptops on trains.

[enjay]

They could double-click your batch files to mount/unmount the TrueCrypt volume couldn't they? It's only one more click.

 

No can do, command prompt is blocked for regular users.

 

15-20 seconds is quite a long time. Have you looked into why it takes so long (maybe using something like Process Monitor)? Does it just takes ages decrypting the drive or is it copying something to the HDD/network profile during this time?

 

That's how long it takes at home too, so I think that might just be how it is.

 

I suppose you then have to worry about teachers saving the sensitive data onto their home computers or leaving laptops on trains.

 

True, but there's that possibility even with encrypted pen drives isn't there. We could always say that school data can only be copied to personal computers if the computer is first encrypted with TrueCrypt or the like; not sure how viable that would be, though.

[Arthur]

No can do, command prompt is blocked for regular users.

I thought that may be the case. An AutoIt script (compiled to an EXE) will work for regular users though.

[enjay]

I think it is time I look at AutoIT, as it just might solve all my problems. Well, all my TrueCrypt related problems anyway!

[enjay]

You know what, after all that I think it was actually my autorun.inf which was the problem! I copied your one, Arthur, from the other post and this worked fine. I had used "shell\verb" and yours uses "shell\Item1".

 

So, that's XP in school and at home sorted, Win7 sorted (using your batch scripts); just my handful of Mac users now. Do you think you could create me a copy of that script you posted earlier if I gave you the details needed? Also, any way of getting it work without referencing the USB drive by volume name?

[Arthur]

You know what, after all that I think it was actually my autorun.inf which was the problem! I copied your one, Arthur, from the other post and this worked fine. I had used "shell\verb" and yours uses "shell\Item1".

I'm glad to hear you got it working. The strange thing is, "shell\verb" should have been fine because the "verb" part can be any text you want according to Microsoft, as long as it doesn't contain a space.

 

Just my handful of Mac users now. Do you think you could create me a copy of that script you posted earlier if I gave you the details needed?

Sure, no problem. I'll give it a go. All I need is the path to the TrueCrypt container file and the volume label you have given to your USB flash drive (which must be 11 characters or less).

[enjay]

Sure, no problem. I'll give it a go. All I need is the path to the TrueCrypt container file and the volume label you have given to your USB flash drive (which must be 11 characters or less).

 

Thank you! The container file can be called something like "encrypted"; volume label will be harder though, as they are called all sorts of things - in fact, we encourage people to rename their drives to their own names, so we can easily return lost drives without having to read the contents. Is there any way around using this?

[Arthur]

volume label will be harder though, as they are called all sorts of things - in fact, we encourage people to rename their drives to their own names, so we can easily return lost drives without having to read the contents. Is there any way around using this?

There might be, although I'm not sure how at the moment. Perhaps this?

 

The AppleScript in post #51 relies on a static volume label in order to be able to find the flash drive.

[enjay]

That is a seriously cool little application! Not sure if it would meet the need here or not...

[joe90bass]

Hi guys! I'm trying to follow through this thread and pull together the various scripts to enable our staff to easily use Truecrypt on USB drives on our school PCs and at home. I like the right click options,and it worked great on XP, but as above I'm struggling with Vista/7. Is it possible to get one script/inf to cover both scenarios? And what was needed altogether to get it working

 

Cheers!

[Arthur]

A new version of TrueCrypt was released today which has a feature which might prove useful...

 

Volumes can now be configured to automatically mount whenever the host device gets connected to a computer system.

 

For example, if you have a TrueCrypt container on a USB flash drive and you want to configure TrueCrypt to mount it automatically whenever you insert the USB flash drive into the USB port, follow these steps: 1. Mount the volume. 2. Right-click the mounted volume in the drive list in the main TrueCrypt window and select ‘Add to Favorites’. 3. The Favorites Organizer window should appear. In it, enable the option ‘Mount selected volume when its host device gets connected’ and click OK. (Source)

 

More details here.

[joe90bass]

Must say I didn't look to closely at the new release as we've started deploying 6.3a already... Wonder if it's just a case of extracting the msi from version 7 and a straightforward upgrade via gpo? The good news is nobody is actually using it yet, and there's been no training or documentaiton given out yet! So version 7 sounds like a job for tomorrow!

[joe90bass]

Creating an msi looks like one tricky task, I don't fancy manual install on all teacher PC/laptops

[Arthur]

If I have a bit of spare time this week or next, I should be able to update my TrueCrypt MSI to v7.0. If I do, I'll post a link to it in this thread.

[joe90bass]

That would be much appreciated! I'm trying to create one now, never done it before though! I'll post back how I get on

 

edit: My latest attempt doesn't seem to install shortcuts for users, or recognise tc file associations....

Edited July 21, 2010 by joe90bass

[enjay]

Has anyone got an MSI - preferably the driver-only one, but I'll take anything - for v7?

 

You need 7 in order to use it on Win7, and v6.3 can't open v7 containers. I tried installing v7 normally, but get the usual "you must be an administrator" messages when using Traveller Mode as a teacher.

[AlexB]

Did a 7.x msi ever surface?

[soapyfish]

Is anything in the works, a driver only version for Windows 7 and XP would be the most awesome thing

[Arthur]

Would anyone mind testing the TrueCrypt v7.0a MSI I have created?

 

Download: TrueCrypt v7.0.1 (x86).msi

 

I'm still working on a 64-bit MSI and will post a link in due course. Need to make sure this one works first.

[soapyfish]

Hi Arthur,

 

I can test it today maybe, if things stay calm-ish thanks for the download