External HDD safety without Full disc encryption

Question

I am not very informed when it comes to disk security but interested to learn more ( so please if it seems like i am misunderstanding some concepts point me to the right reading material )

I've got an external hdd for redundancy that i would like to "password protect". I am aware of full disk encryption but the disk is quite large in data ( 4TB ) and most of the data in there isn't really sensitive. It would still be nice to keep it safe against common thiefs that might just grab it and know how to usb plug it in a Windows machine but not really able to do much more with it.

Is there a way to password protect such a disk for windows without full disk encryption? The reason i am avoiding full disk encryption is that ( presumably ) :

a) It would take a really long time to perform b) I imagine that it must cause some wear to the disk, I dont know how much but it must be a lot of read write operations when you have to encrypt 4TB of data ( naivety ? ) c) Its not really necessary. Yes a slightly tech savvy person can imagine to boot this disk in Linux but so be it, no government secrets are kept on that disk, mainly family photos and videos

Thank you and apologies for the naivety.

P.S : I would like to be a little more educated on the subject as this is the first time I preoccupy myself with and so feel free to point me to reading material or anything for better understanding.

Answer 1

Besides installing a Truecrypt file on windows disk (Truecrypt can create a file and encrypt files in there, not just the full disk) , you can look into normal windows Bitlocker encryption. It should run on every windows version since XP (read-only there though) and prompt a password when you connect the disk, and is the easiest solution for most users.

Disk wear is not an issue, even on SSD, there is only 1 extra read/write cycle on top of normal usage (the actual encryption). If this is enough to wear your disks out, you're better off asking for new disks here :)

Answer 2

Full Disk Encryption using Bitlocker as suggested by another answer is a really good option.

However, in the spirit of your original question, there is another option to protect individual files and folders without FDE, and it's even easier. NTFS supports encryption of files and folders very simply and it's called EFS, the Encrypting File System. You simply right click on the file or folder you want to encrypt, and from the Properties menu, click the Advanced button and check the Encrypt contents to secure data checkbox.

The key used to encrypt is associated with your user credentials, so will protect against a grab & go style attack. An attacker who steals your drive will still be able to access unencrypted files and see the metadata for encypted files, but will not have the key to decrypt the contents of the encrypted files.

Answer 3

It is surprising that vendors of external HDDs have not thought of capitalising on an obvious sales opportunity - offering an optional HDD sized booklet outlining the basics of using their HDD effectively, including security considerations. After all, if you buy a toaster or kettle or TV or hi-fi, you get how-to instructions in mind-numbing detail (often in 24 languages) even though mostly they're not needed. With an HDD you get a box, an HDD in it in a plastic bag, and maybe some nice polystyrene foam.

This bit is a further Q rather than an answer: I was wondering, what are the "user credentials" used by EFS? Is this the user name and password combined, or is it based on the MAC address or some other machine identifier? What I am thinking of is, is there any way that a thief could decrypt the contents posing as the legitimate user? (eg by decrypting on the user's stolen machine).