2

I am setting up an external hard drive to backup several computers to, and I want to keep its contents private by using VeraCrypt. I don't want to encrypt the entire drive because then when it's inserted, Windows shows a popup asking if I want to format it, which I find annoying. Instead I have formatted it as a regular exFAT drive, and am currently creating a VeraCrypt file container on it that is almost as large as the drive: the drive is 3.63 TB and the file container is 3.61 TB, leaving 25.8 GB free.

Doing it this way also allows me to have a small amount of unencrypted space on the drive where, for example, I can store install files for VeraCrypt.

I know that normally it's not good to keep a drive almost full because then there isn't space for pagefiles and the data can get fragmented. However this is an external, so there are no pagefiles, and once the VeraCrypt file container is initially created, I don't see how it could ever get fragmented.

So, will I be OK? Or are there issues with this setup?

3

There should be no issues either with the cryptography or with the integrity or performance of the exFAT filesystem. The only thing you should keep in mind is that you are losing plausible deniability. When you encrypt the entire drive, it is computationally indistinguishable from a drive that has merely been wiped and has no data on it. If the drive is formatted and has a large VeraCrypt container on it, it is much harder to claim that it is anything but a large tomb of secrets. If that is outside of your threat model, then what you suggest is completely fine. The only real issue I can think of is that filesystem corruption would do more damage than it otherwise would, as it could render the entire VeraCrypt container inaccessible.

  • I had tried the dual partition method (one encrypted, one not), but Windows still shows a pop-up asking if I want to format the encrypted one. My required security level is fairly low, so I have no need for plausible deniability. Thanks for the answer, it sounds like this should work well for me. – jertrop Feb 24 at 8:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.