1

I've read the docs but could not find an answer to my specific question (or didn't understand which one was the answer).

My question context: after I mount the encrypted partition USB drive) on Win10 it is seen as a regular partition and I can move files there. I move files using windows explorer - normal copy-paste in windows.

Actual question: what is happening in the background when I copy-paste a file to the mounted partition on windows? Does Win10 magically know to encrypt it or Vera in the background?

In other words, is the decrypted drive stored in RAM memory for sure? Not on some file on the main hard drive? My guess is yes, but I couldn't find it in the docs.

My worry is the mounted partition is some decrypted file on Win10 main hard drive that is being translated and encrypted to USB drive.

In that case it would mean the decrypted version of all files exists somewhere on the system hard drive. Couldn't find more specific info on this.

The USB drive is bigger than my laptop RAM memory so I just wonder how this exactly works so I can use the decrypted disk and not risk it will be temporarily stored on the main SSD system drive since main SSD is not encrypted it would be no advantage of using Veracrypt in this scenario.

Improve this question
5
  • 2
    Just because you access something via explorer it does not mean that it is in "your harddrive"... it simply means windows is able to "speak" to the device and treat it as a standard disk/folder/file. In this case when you copy a file into the veracrypt volume Windows will perform the systemcalls to copy that file to that location, it will locate the veracrypt driver and pass the information to veracrypt which will store the file in your encrypted volume. Veracrypt can save the file byte-by-byte, it doesn't have to store it completely in RAM as a whole, it just needs a bit of ram.
    – Bakuriu
    Jan 7, 2022 at 15:07
  • Thanks for comment, I assumed it works kind of this way, but prefer not to assume but to understand more of that tech behind.
    – kkonrad
    Jan 7, 2022 at 17:57
  • 1
    VeraCrypt has passed multiple security assessments. Such a simple vulnerability would have been uncovered long ago. And for the way VeraCrypt works consider it to be an realtime translator. If you write a data block to the encrypted volume the block will be "translated" (encrypted) while it is saved and then the result is saved into the image. Reading is just the opposite way. Note that the used application can of course save an decrypted copy e.g. in temp folder if it is programmed that way so it depends not on VeraCrypt but on the programs you use.
    – Robert
    Jan 7, 2022 at 20:30
  • 1
    I think @Robert's comment is really spot on. Most people - including me - has no realistic chance at vetting a complex product such as Veracrypt. Observing that knowledgeable people has assessed it, and published their findings, is probably the best most of us an do.
    – vidarlo
    Jan 8, 2022 at 14:50
  • Maybe just read about "full disk encryption": For example if you double-clock a ZIP file on the encrypted volume, there is actually a temporary directory created elsewhere, where the files are extracted temporarily to view them. Or when using cloud services, your encrypted files might go to the cloud unencrypted. Several programs also create temporary files or backup files from the files you opened on an encrypted volume, etc.
    – U. Windl
    Jun 30 at 8:39

2 Answers 2

Reset to default
4

Actual question: what is happening in the background when I copy-paste a file to the mounted partition on windows? Does Win10 magically know to encrypt it or Vera in the background?

Veracrypt has a driver installed in the operating system that handles encryption or decryption on the fly. This driver uses Windows API's to provide a filesystem interface to Windows.

Software then uses the normal Windows API to perform operations on files, and the Veracrypt driver handles encryption and decryption of data on writes and reads from that mounted volume.

In that case it would mean the decrypted version of all files exists somewhere on the system hard drive. Couldn't find more specific info on this.

This is a very valid risk, but not for the reasons you believe:

  1. Windows has a paging file, which is by default stored on c:\. This file contains data that is written out to a slower cache to free memory. In addition there's a hibernation file present on some systems, where memory content is written to disk whenever the computer hibernates. This is also located on c:\. What ends up in a paging file may vary with the memory pressure on the system, and may or may not be quickly overwritten quickly.
  2. Many Windows programs stores temporary data, including temporary copies of files in temp folders, e.g. %USERPROFILE%\AppData\Local\Temp.

If you work with secret files on a computer, you should probably consider full disk encryption, to ensure that all copies of that file is encrypted. Otherwise there's a very real risk that content of the file may be saved in cleartext somewhere on the system.

Improve this answer
4
  • But the paging file won't have all files, just recently accessed ones, right (with some definition of 'recently')?
    – schroeder ♦
    Jan 8, 2022 at 14:11
  • 3
    @schroeder I'm more familiar with Linux' swap, but my observation on Linux is that you can't really know; I've found LUKS keys on the swap partition months after the drive was disconnected from the system - probably because high enough swap pressure to overwrite it never occured. If windows behaves in a similar fashion? Probably, to some degree.
    – vidarlo
    Jan 8, 2022 at 14:48
  • Ok, fair enough. An unknown and unknowable set of files.
    – schroeder ♦
    Jan 8, 2022 at 14:50
  • 1
    Indeed. And if it's a large hard drive with lots of free space, deleted temporary files may hang around for ages. So I'd argue there's a risk of data left behind if you ever open secret data on a system without FDE.
    – vidarlo
    Jan 8, 2022 at 14:52
-1

Found there is RAM disk possible on Windows and this satisfies my tech knowledge for how this works (presumably).

This means there is no "disk file" but the drive operates entirely in the RAM.

https://en.wikipedia.org/wiki/RAM_drive

Improve this answer
4
  • 5
    That is not correct. Windows accept drivers for filesystems. Veracrypt provides a driver that sits between the disk and Windows, and encrypts anything that windows wants to write to that partition. The source code for the driver can be found in veracrypt: github.com/veracrypt/VeraCrypt/tree/master/src/Driver
    – vidarlo
    Jan 8, 2022 at 8:29
  • Sits between so exactly where? Not in a RAM mem?
    – kkonrad
    Jan 8, 2022 at 12:08
  • Between the block device and the windows file system interface. Computer memory is of course used to hold data at some point in the encryption or decryption process. But that has nothing whatsoever to with the concept of RAM drives.
    – vidarlo
    Jan 8, 2022 at 13:02
  • 1
    There is a difference between a RAM drive and the OS using RAM for normal operations like file system reads/writes. Veracrypt does not use a RAM drive. This answer is completely wrong.
    – schroeder ♦
    Jan 8, 2022 at 14:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .