When you delete a file, it’s not physically removed
from your PC; instead, the first few bytes of the file
are overwritten with a tag that tells Windows that
the file is deleted and the space it currently resides
in is available when writing other files to disk. It
speeds things up, but it’s not good for security.
Until the file is physically overwritten by another
file, its contents are still retrievable. What’s more,
even if the file is overwritten, it might be possible
to retrieve part or all of it using sophisticated
file recovery techniques. So, how do you protect
yourself against that kind of technology?
Thankfully, there are tools that can securely
wipe data from your drive. One that’s free and open
source is Eraser (grab the latest stable version,
5.8.8, from https://eraser.heidi.ie/download).
During installation, enable the Windows Explorer
extension to allow you to securely shred any file by
right-clicking it and choosing “Eraser > Erase.”
What about files you’ve previously deleted? Eraser
can securely wipe all free space to make deleted
files unrecoverable—right-click the drive in File
Explorer, and click “Erase > Erasing Free Space.”
Open the main Eraser program and you can set
up on-demand and scheduled tasks to periodically
shred specific files, files in folders, or free
space. By default, Eraser wipes data using the
Gutmann technique—if this is too slow, choose
“Edit > Preferences > Erasing” to choose a
different method, including one of two used by the
Department of Defense.encrypted volume and format it”
(destructive, and best for empty
drives or drives with no data worth
keeping) and “Encrypt partition in
place.” The latter is much slower
but preserves existing data—see
the box on page 38 for details. If
creating an encrypted volume from
scratch, the process is virtually
identical to creating virtual drives.
Once the drive has been
encrypted, read any warning
messages, then click “Finish.” ToSHRED DATA
SECURELY
to unlock your Windows boot
drive, then choose “Add to System
Favorites”—this way, the drive is
unlocked with your boot drive, and
available when Windows loads.Encrypt cloud backups
VeraCrypt can protect your files
locally, but copy them anywhere
else, and they’re left unprotected.
The box opposite reveals what to
do about protecting local backups
using the same types of algorithms
with suitable backup software, but
what about those files you back
up to the cloud? Cloud providers
claim to encrypt your files, but
sometimes that only applies to the
way the files are transferred—
when stored “at rest” in the cloud,
they may be left unencrypted, and
therefore potentially vulnerable.
Even where encryption is
provided, is it true end-to-end
encryption, where only you possess
the all-important encryption
keys required to decrypt the
files? Some cloud providers—
SpiderOak (https://spideroak.com)
and Tresorit (https://tresorit.com),Selec t “ Volume Proper ties...” to verif y the securit y of your drive.Mount
encrypted
data drives
automatically
with Windows.mount the drive, select the drive
letter you wish to assign to it, then
click “Auto-mount Devices.” Enter
the credentials required, wait,
and then the drive is mounted and
available. Ordinarily, you have
to do this every time you restart
Windows—to have the drive
automatically mount when you
log into Windows, right-click it in
the main VeraCrypt window after
mounting, and choose “Add to
Favorites.” Be sure to check “Mount
selected volume upon logon” before
clicking “OK.” Going forward,
you are prompted to provide the
password and any key files each
time you log into Windows, and then
the drive is available.
One problem with this approach
occurs if you’ve moved system
folders—such as user folders or
those linked to cloud services—on
to this encrypted storage space. You
get errors about missing folders
before you unlock the drive. If you’ve
encrypted your Windows boot
drive, you can get around this by
ensuring the password on your data
drive is the same as that requiredprotect your data
40 MAXIMUMPC MAR 2020 maximumpc.com