Diskcryptor is an open-source competitor to TrueCrypt for Windows. It has an edge over Truecrypt for system encryption, because it allows for more than one independently encrypted system partition, and this is exactly why I use it.

Can anyone here confirm that this program doesn't have backdoors and is as secure as Truecrypt? Is anyone aware of any security analysis of this product?

By secure I mean: lack of backdoors, proper handling of encryption, and even resistance against the evil maid attack.

  • Secure is subjective. What sort of attacks are you looking to protect against?
    – Steve
    Mar 23 '12 at 20:00
  • I can't find any documentation on how key derivation works. There are some mentions of PBKDF2, but that's about it. Mar 23 '12 at 20:13
  • I mean as secure as TrueCrypt is, with all the caveats. I'll update the question. Mar 23 '12 at 20:38
  • 1
    DiskCryptor (as of version 1.1.846.118) won't really tell you anything, but it's NOT compatible with windows 8.1. I do have a Lenovo Yoga 2 Pro and it just rendered my notebook unbootable. DiskCryptor does not check for any system requirement before crypting the whole partition, which it did really easilly and without any problem. But it seem that what ever bootloader it installed, it doesn't work. I'm not in the painful process of making up a boot CD on a USB thumbdrive ( since I don't have a CD Drive ). This software wasted my whole day.
    – FMaz008
    May 13 '15 at 19:17
  • @FMaz008 +1. This post was asked way ago, when I was using Windows XP. I've moved to Linux now, and I think I will not be able to maintain this topic any more. Thank you very much for the input. May 14 '15 at 8:37

You do know that Truecrypt is also free and open-source, right?

Aside from commissioning independent testing, the only assurance you are likely to get is from users/hackers discovering issues and publishing them on the web, so your first port of call should be a google search for Diskcryptor advisories

Number of advisories published can be a reasonable indicator of development quality, when considered along with usage numbers - obviously a product with large numbers of users could be expected to have more issues reported than a less popular one. Alternatively, look at the documentation on their development and testing processes - or their bugfix revisions.

Finally, you could look into the authors of each tool and see whether you can place some reliance in their work.


Ultimately when I look at software, I tend to rate the reliability based on how long it has been around and how solid of a community it has, plus I'll look at how it's being used and what the buzz on the internet is around it.

When it comes to DiskCryptor, although I can't answer your question with a yes/no, what you might want to do is search around and see the history, the usages, partners, etc. and from there decide whether or not it's what you need.


"I can't find any documentation on how key derivation works. There are some mentions of PBKDF2, but that's about it. " DiskCryptor is very visibly derivated from Truecrypt and shares some of its old style constants. It uses SHA-512 with 1000 iterations as key derivation algorithm according to https://github.com/smartinm/diskcryptor/blob/master/driver/crypto_head.c a call to sha512_pkcs5_2 has i_count=1000


I'm all for opensource and free, however depending on the application (work computers VS. personal laptop) you may want to consider a paid third party program to shift "plausible deniability" from yourself to the manufacturer who is selling the encryption software to your company. Otherwise if something goes wrong, your company may try to hold you liable for any damages and or losses. To detect any possible "backdoors" you could run wireshark and just sniff your own traffic and see. There are also several free firewalls that could help in detecting a program trying to communicate to outside sources. I'd start with wireshark.

  • 4
    Almost all software - paid or free has an AS IS clause in the EULA so the company is shielded from exactly the scenario you mention. Regardless of the case, the responsibility is pretty much always placed on the person who deploys and manages the system. If makers were liable, Microsoft and others would be bankrupt by now
    – theonlylos
    Mar 26 '12 at 23:43
  • 1
    Most of the time this is correct, however depending on the type of business that it's used there are manufacturers that actually have service level agreements and business associate agreements, say for example HIPAA or HITECH acts. LuxSci sells a product for email encryption and they provide several written contracts that help offset the liability of the tech who would impliment it. Check out luxsci.com/extranet/hipaa-baa-standard.html There is always some level of liability of the one who impliments it, but premium providers usually have something that will help cover your butt.
    – Brad
    Mar 27 '12 at 16:04
  • Ah, thanks for the clarification on that. As I don't often deal with regulated environments I typically have clients using less stringent software.
    – theonlylos
    Mar 28 '12 at 1:47
  • Thank you very much for your time in explaining. I'm self-employed, so it doesn't really matter for me who would be responsible for leakage of data. I just want' to make sure it doesn't happen. Mar 28 '12 at 8:14
  • Since you are a consultant I'd hire an attorney to go over any contracts that you have clients sign and make sure that you have a clause that would limit damages and make sure that you have a good umbrela policy in case you need it. If you deal with any retail stores you will have to deal with PCI compliance for handling credit cards so don't let those clients skimp on any security costs and be sure to cover EVERY aspect in your contract with them.
    – Brad
    Mar 29 '12 at 15:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.