2

I am setting up an external hard drive to backup several computers to, and I want to keep its contents private by using VeraCrypt. I don't want to encrypt the entire drive because then when it's inserted, Windows shows a popup asking if I want to format it, which I find annoying. Instead I have formatted it as a regular exFAT drive, and am currently creating a VeraCrypt file container on it that is almost as large as the drive: the drive is 3.63 TB and the file container is 3.61 TB, leaving 25.8 GB free.

Doing it this way also allows me to have a small amount of unencrypted space on the drive where, for example, I can store install files for VeraCrypt.

I know that normally it's not good to keep a drive almost full because then there isn't space for pagefiles and the data can get fragmented. However this is an external, so there are no pagefiles, and once the VeraCrypt file container is initially created, I don't see how it could ever get fragmented.

So, will I be OK? Or are there issues with this setup?

Improve this question

1 Answer 1

Reset to default
3

There should be no issues either with the cryptography or with the integrity or performance of the exFAT filesystem. The only thing you should keep in mind is that you are losing plausible deniability. When you encrypt the entire drive, it is computationally indistinguishable from a drive that has merely been wiped and has no data on it. If the drive is formatted and has a large VeraCrypt container on it, it is much harder to claim that it is anything but a large tomb of secrets. If that is outside of your threat model, then what you suggest is completely fine. The only real issue I can think of is that filesystem corruption would do more damage than it otherwise would, as it could render the entire VeraCrypt container inaccessible.

Improve this answer
2
  • I had tried the dual partition method (one encrypted, one not), but Windows still shows a pop-up asking if I want to format the encrypted one. My required security level is fairly low, so I have no need for plausible deniability. Thanks for the answer, it sounds like this should work well for me.
    – jertrop
    Feb 24, 2019 at 8:42
  • Hi, just to clarify you do not loose plausible deniability by using a large VeraCrypt container on your drive as VeraCrypt allows you to create a hidden encrypted container within the visible encrypted container. The hidden encrypted container is computationally indistinguishable from the visible encrypted container hence you still have plausible deniability i.e. the visible encrypted container that contains dummy files exists but the hidden encrypted container which contains sensitive files does not exist and there is no way to prove it does exist. Also recovery disk means no corruption issue
    – mister_cool_beans
    Oct 22, 2021 at 8:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .