Suggestions for securing an external hard drive

[Phantom Warrior]

I have a 120 GB Western Digital external HD.  For a desktop I prefer just installing a second HD, but I have a laptop, so I use this sucker.  Now, I live in the barracks and have been copying a lot of files off my HD to other guys.  However, I have some personal stuff on there and I'm not entirely comfortable having it open to the public.  Right now anyone can just plug the USB cord in and go.

Is there a simple, quick way to secure my HD?  I'm guessing I could encrypt all my files somehow, but I don't want to have to wait for the file to decrypt everytime I want something.  Is there a way to lock the whole HD, similar to the Welcome screen in Windows XP?  Your thoughts would be appreciated.

[Felonious Monk/Fignozzle]

Maybe a password protection option?

[Paddy]

Yeah, I was gonna say password protection.  While we're on the subject, is there a setup for using an external HD as a backup device?  Along with software to only backup changed files?   I've had two HD crashes in the last few years, both in the boot sector, and have lost everything as a result.

[Felonious Monk/Fignozzle]

If it's WinXP, backup has been made really easy.  Take a look under Start>Programs>Accessories>System Tools.

I've found these little $20 or so external HDD enclosures that connect with USB to be magic, as far as ease of use, handy and convenient.  Best thing since sliced bread.

You'll find the one I'm using (with an 80GB HDD) on Tiger Direct's website here:
http://www.tigerdirect.com/applications/SearchTools/item-details.asp?EdpNo=1281816&Sku=M501-1090

[Harold Tuttle]

you would think someone would have a keyed power switch enclosure

[TarpleyG]

Download Blowfish Advanced CS and just encrypt everything.

Greg

[BryanP]

XP has the ability to encrypt folders.  Performance is quite snappy, believe it or not.  Details here:

http://support.microsoft.com/default.aspx?scid=kb;en-us;308989&sd=tech

[mtnbkr]

also, consider repartitioning it into two drives.  Use one for stuff you want to share and the other for private files.  Encrypt the snot out of it and leave the "public" drive open and free.  That way, you're not encrypting/decrypting stuff for folks, only your stuff.

Chris

[Phantom Warrior]

Where would I find Blowfish?

[Felonious Monk/Fignozzle]

Where would I find Blowfish?

Umm...South Carolina, with Hootie?

[TarpleyG]

http://www.download.com/Blowfish-Advanced-CS/3000-2092_4-10433570.html?tag=lst-0-1

[Telperion]

Windows EFS (encrypting file system) is built-in and is quite secure in XP SP1 or later, when they switched to AES-256.  The key is encrypted by your login password and is stored as a part of your Windows user profile.  The encryption key is not a hash of your password, so it is imperative that you backup the key.  PM/email me if you want help setting it up.

Edit: it's also convenient because the encrypting/decrypting is done automatically.  You don't have to explicitly run a command to access or encrypt a file.

[mtnbkr]

The key is encrypted by your login password and is stored as a part of your Windows user profile.  The encryption key is not a hash of your password, so it is imperative that you backup the key.

how well does that work when moving the volume between systems that aren't authenticated by the same Domain Controller (or whatever MS calls it now)?  Say, you take your encrypted drive from one separate machine to another (both with localized logins or on completely separate domains).  How can you unencrypt your files?

I ask because I know from prior experience that simple file system permissions are troublesome in this scenario.  It's one of the reasons I prefer encryption secured by a third party that can be reached from all systems (such as a PKI or a portable token, etc).

Chris

[Telperion]

My understanding is that EFS can be tied to a PKI.  The keys would be generated by a CA, and there would be a recovery agent designated.  I use EFS on my personal computer only, so I don't know how it works.

If you were to move the drive to a different computer that didn't have your EFS certificate, you'd get an error trying to access the file.  Which is probably what you want to happen.

[mtnbkr]

Which is probably what you want to happen.

Correct, if done by an unauthorized user.  However if you, the authorized user, needed to access those files via a different PC, you'd need some way to authenticate other than login id.  Assuming a non-domain (or active directory for you newer folks) environment, each PC is going to contain it's own set of user accounts.  Or, if you have to rebuild your system from scratch, the IDs won't match.  This isn't a portable solution when using Microsoft's built in authentication schemes (or any centralized authentication mechanism that isn't available to all systems).

I'm not familiar with EFS, but if it's anything like similar mechanisms, you're screwed if you can't take your keys with you.  

Chris

[Telperion]

In that case, you'd want to install your EFS certificate on the other machines.

[mtnbkr]

In that case, you'd want to install your EFS certificate on the other machines.

Are you talking about a PKI certificate or some other system Cert that authenticates you to your EFS volume?  If the latter, can it be stored on one of those flash memory dealies and carried around like a key?  Or is it something that's installed more or less permanently on each system that needs to mount the volume?  Hmm, that sounded kinky.  

Chris

[Telperion]

Are you talking about a PKI certificate or some other system Cert that authenticates you to your EFS volume?  If the latter, can it be stored on one of those flash memory dealies and carried around like a key?

Yes and yes.  It is like site certificate and can be exported to a file, with an optional password.

[Phantom Warrior]

Okay, I'm trying to keep this simple.  I downloaded an implementation of Blowfish and it works very smoothly...for individual files.  I was hoping I could just encrpt and decrypt my entire folder in one step.  I'm often digging through a folder and opening several things at once.  I'd rather not have to sit and decrypt each file.  Any additional suggestions?

[Telperion]

You can mark folders for encryption with EFS and it will recursively apply your choices to the contents.

[TarpleyG]

Okay, I'm trying to keep this simple.  I downloaded an implementation of Blowfish and it works very smoothly...for individual files.  I was hoping I could just encrpt and decrypt my entire folder in one step.  I'm often digging through a folder and opening several things at once.  I'd rather not have to sit and decrypt each file.  Any additional suggestions?

The Blowfish I specified above will allow you to select one or multiple files in a folder to encrypt/decrypt or you can simply do the whole folder.  There is an option to integrate Blowfish with Explorer so it is available in the context (right-click) menu when in Explorer.

Greg