Folder level encryption on a Windows 10 Pro laptop

Question

Most of the stuff on my laptop is benign; and the hassle of full disk encryption is not worth it. On the other hand, one or two folders I would love to encrypt and password protect.

What's the best way to do this? I see a couple of options: There is an Advanced option on right click of folders natively which allows one to turn encryption on in Windows. How good is this?

Alternatively I see software like Veracrypt (a successor of Truecrypt) that are recommended by the EFF etc. but mostly they require a partition to be mounted etc. So seems a tad more work then just encrypting a folder.

Any advice?

Comment about Veracrypt: With Veracrypt I will have to mount right? So imagine I have three different folders at different points in my directory structure then to use them each time I need to mount them as a drive. In my understanding, veracrypt allows you to mount a volume stored as an encrypted file. I sort of want to do the opposite. Encrypt folders on my existing already mounted Win drive

Answer 1

the hassle of full disk encryption is not worth it.

You have Windows 10 Pro so you can just turn on Bitlocker encryption with like three steps (these three steps were yoinked from this Microsoft reference):

1. Sign in as an administrator account;
2. In the search box on the taskbar, type Manage BitLocker and then select it;
3. Select "Turn on BitLocker" and then follow the instructions.

Answer 2

I personally like to use x.509 or pgp certificates to encrypt and sign files on my computer. The x.509 (ssl and client certificates) option will be a little more advanced though. PGP will be the easiest option as there are GUI applications that can encrypt/sign files. You can see a list of PGP applications here. For PGP on Windows, I would recommend gpg4win or gnupg.

Create a PGP certificate:

Configure advanced settings to use a strong private key:

Encrypt or Sign the File:

Downside to Kleopatra (gpg4win) is that it wont let me encrypt folders. But Windows does have the native cipher command which will let you encrypt folders or files too. It uses a keypair tied to your Windows user to encrypt the files and make them only accessible when logged in as you. The downside to encrypting the folder this way, is that if someone where to be able to login as you, then they would also be able to access the files.

Demo Using cipher to Encrypt a Folder:

I end up using a combination of the above. I also enable bitlocker as well (which I would recommend), so that my entire Windows filesystem is encrypted (not just the individual files or folders). As of Windows 10 version 1511, bitlocker uses AES-XTS 128 or 256, which is a strong algorithm.

Then I use cipher to encrypt folders with confidential information. Inside of that folder, I use PGP to encrypt the files I deem "top secret", while other files may not be encrypted with PGP since they arent "secret enough" to warrant it. Altogether there are multiple layers of encryption when done this way which will make it extremely difficult for any attacker to gain access to them. You have bitlocker which is encrypting the entire filesystem, you have cipher which is encrypting the folders and only letting your Windows user access it, and then have individual file encryption on top of that with PGP or a x.509 client cert.

Answer 3

There is an Advanced option on right click of folders natively which allows one to turn encryption on in Windows. How good is this?

That is Windows "Encrypting File System" (EFS). It is very convenient to use, but it offers no protection against an adversary able to log in to your Windows account. Also, you won't be able to unencrypt any of the files or folders unless you are logged in to your Windows account.

Alternatively I see software like Veracrypt (a successor of Truecrypt) that are recommended by the EFF etc. but mostly they require a partition to be mounted etc. So seems a tad more work then just encrypting a folder.

Veracrypt does not require a partition. It certainly allows the option of using a partition, but it isn't required at all. See, for example, the Veracrypt Beginner's Tutorial:

A VeraCrypt volume can reside in a file, which is also called container, in a partition or drive. In this tutorial, we will choose the first option and create a VeraCrypt volume within a file.

Please read through the tutorial. It seems complicated at first, but once you've set up the Veracrypt volume it is a very fast and easy way to encrypt and retrieve data.

Given the choice between Windows EFS and Veracrypt, I would probably choose Veracrypt because it allows more flexibility in how you encrypt, store, and access your data.

Regardless of which option you choose, once you have created the encrypted folder/files you must take care to securely delete the original unencrypted folder/files.