Need To Encrypt A Partition

I am consciously needing to lock ( Encrypt ) a partition. I created a small partition to play encryption with.
My goal is to encrypt just that partition ( Z:\ ). I am confused in what comes up.
Explanation please !!!
Cheers

If it's an older partition that has areas where files have been deleted, encrypting the entire drive might be what you want as areas that contain information from deleted files would also be encrypted.

If it's a new partition where you haven't deleted anything yet, encrypting only the current files would be much faster.

No matter which choice you make, new data is encrypted dynamically as you add, modify, or delete it.

TraderGary said:

If it's an older partition that has areas where files have been deleted, encrypting the entire drive might be what you want as areas that contain information from deleted files would also be encrypted.

If it's a new partition where you haven't deleted anything yet, encrypting only the current files would be much faster.

No matter which choice you make, new data is encrypted dynamically as you add, modify, or delete it.

Click to expand...

Ok, this is a new encryption knowledge for me.
This partition I showed is new in an older drive, created just for a test run.

1. The files I need to encrypt will not be up to 100mb and about ten or twenty of them.
Wouldn't encrypting the individual files be more cumbersome?
2. I would like to store them in one new small partition or in a folder in an existing partition.
3. Or, in a low profile USB flash drive, plug it to PC, encrypt the drive, and just leave the drive there?

Once in a while, I backup my drives to an external drive.
4. What would encryption do to a backed up Folder, Partition or Image in an external drive?
5. If I were to use a USB flash drive, would any file system be better ( Fat32 / NTFS )?

Caxtin said:

Ok, this is a new encryption knowledge for me.
This partition I showed is new in an older drive, created just for a test run.

1. The files I need to encrypt will not be up to 100mb and about ten or twenty of them.
Wouldn't encrypting the individual files be more cumbersome?

Click to expand...

I would be surprised if encryption of those few files took longer than a few seconds.

Caxtin said:

2. I would like to store them in one new small partition or in a folder in an existing partition.

Click to expand...

When you copy files from an encrypted partition, they are no longer encrypted. Unless, of course, you encrypt the destination partition.

Caxtin said:

3. Or, in a low profile USB flash drive, plug it to PC, encrypt the drive, and just leave the drive there?

Click to expand...

I back up my encrypted C: drive to a Samsung 4TB portable SSD using Macrium Reflect. The destination SSD has been encrypted with BitLocker To Go so the backup is again encrypted.

Caxtin said:

Once in a while, I backup my drives to an external drive.
4. What would encryption do to a backed up Folder, Partition or Image in an external drive?

Click to expand...

When files are copied from an encrypted drive, they are no longer encrypted.

Caxtin said:

5. If a USB flash drive, would any file system be better ( Fat32 / NTFS )?

Click to expand...

Flash drives almost always use Fat32. If you copy files from a BitLocker encrypted drive to a USB Flash Drive, the files would be automatically decrypted and the files now on the USB drive would not be encrypted.

Windows and the applications you use to access the data stored on the encrypted partition typically will write plaintext versions of this data in various storage locations outside the encrypted partition such as the page file, cache files, temporary files, etc.. As a result, to the average user, the kind of protection that you describe almost always turns out to be really nothing more than just an illusion. Device Encryption and BitLocker Drive Encryption are features of Windows that can be used to let all of the drives be encrypted, but now we are assuming that you know your stuff about these (and how to use them). When I say "in various storage locations", what I factually mean is, even if all your internal/fixed drives are protected with BitLocker, you still have to factor all your other types of storage (e.g., external/removable storage, network storage, etc.) also properly into the equation. Among multiple other data security subtopics.

What @hdmi says is true. To mitigate these risks, you should enable BitLocker on the entire system drive, which would include page file, cache files, temporary files, etc..

You might also be confusing Drive Encryption with File Encryption.

Am glad I asked sent out the original post. I sure have learned a lot from the two of you with respect to encryption. Sometimes the English langues becomes a hindrance to me in expressing exactly what I need or want.

Currently, I have a USB flash drive I use to save my personal file. When I need something there, I would have to go get the flash drive, plug it into the PC, view a file or two, get what I need, Safely Remove the drive, go and put it back where I have it hidden ( stored ) Now I feel I have gotten older, I thought it would be nice to just have these file attached to the PC, view as I wish. Sometimes, I copy or overwrite a file or two, and that's it. I just remember I don't even have a backup of them, so as not to be in two different places.

I had previously created a small partition, moved the files in this partition, then hide it with my disk software. The only issue is, anyone can just unhide it with the app.

I don't need anything in my PC encrypted ( protected ), except the files I have in the USB I mentioned above.
Also, I would rather not encrypt individual files. I would only like to encrypt where the files are.

I really appreciate you guy's helping me on this issue.

Just noticed this from the app.

Others have already given you some excellent answers, all I want to do is summarize and clarify the points that were already made...

1) Let's start with the question of whether to encrypt used space only or the entire disk. If you choose to encrypt used space only then all of the data on your partition will be encrypted EXCEPT for unused areas of the disk. So, let's say that you had a partition that you had used previously and you now delete a bunch of data. Bear in mind that simply deleting data does not physically wipe if from the drive. It is possible to use recovery tools to retrieve such data. If you are concerned about this, then encrypt the entire drive. If you do not have previous data on the drive that you are concerned about, simply encrypt the used space only. No matter which option you select, all the used space will be encrypted and any new data that you add to the partition will be encrypted on the fly.

2) Once data is encrypted, decryption happens automatically and transparently. For example, suppose you want to open a Word document. You do not need to do anything special at all. Once the drive is unlocked, any attempt to access encrypted data results in that data being decrypted on the fly as you access it without you ever even needing to know whether that data was encrypted or not. In other words, you do nothing differently than you would do on any drive, encrypted or not. Just as with any operation that accesses files, if you want to copy files to another location, then the file(s) will become decrypted on the fly as they are accessed and then will be stored on the destination decrypted. The one exception is if the destination is itself encrypted. In that case the file(s) will be decrypted on the fly and then re-encrypted using the encryption appropriate for the destination.

Since it sounds like you are new to BitLocker, some suggestions:

Create a small test partition. Turn on BitLocker on that partition. Copy some unimportant data to this partition and simply experiment to get familiar with it, although there is really not much to see. But this at least gives you a risk free way to experiment. Also, make 100% sure that you save the BitLocker key! When you turn on BitLocker, it will force you to save the key. Make sure to keep it in a safe place where you can easily get to it but no one else can.

TraderGary said:

To mitigate these risks, you should enable BitLocker on the entire system drive, which would include page file, cache files, temporary files, etc..

Click to expand...

The page file is located on the operating system drive indeed, but some of cache files and temporary files can potentially be written elsewhere, e.g., on a secondary drive like on a separate physical disk. Similarly, backup software may create backup copies of these same cache files and temporary files, etc..

Just trust me about it, you'd be terribly surprised at how many different storage locations end up containing (partial) copies of sensitive data on an average Windows PC. They're very often almost everywhere.

So, to prevent these kinds of compromisations from happening inadvertently, one could consider to restrict write access on every non-encrypted drive, but that won't be easy to achieve on volumes with the kind of filesystem that cannot be used to set up permissions like NTFS can be, such as FAT32 or exFAT, for example. Even if you unplug all your non-encrypted USB drives, various portions of your sensitive data may still be written to them after you plug them back in. The assumption that all the applications you use will always ask you for your consent is just that. An assumption.

As an alternative choice to setting up NTFS permissions to achieve this goal, Virtual Machines can be set up in such a way that restricts write access on non-encrypted drives i.e. for those specific processes that will be running on the Virtual Machines, but it's not straightforward, as security hardening and isolation are not what Virtual Machines are primarily intended for. Isolation features like Windows Sandbox and isolation software like Sandboxie-Plus might be better suited for this purpose, and, if running Windows on a Virtual Machine, then it also becomes possible to consider using some kind of combined strategy/approach like using the Virtual Machine's own featureset in conjunction with one or more of the aforementioned sandbox technology choices. Either way, it still isn't straightforward to the average user.

That's why, to the average user, choosing to let all drives be encrypted with BitLocker Drive Encryption or with Device Encryption is usually recommended. That is, in addition to utilizing, and understanding how to utilize, other data security principles that are also critically important to solidify your strategy, as opposed to relying on little more than flawed conclusions the flaws of which are typically getting ignored as a result of (also typically) shifting the focus of attention toward the only concept of data encryption technology.