Originally Posted by
nkedel
Rather like the recommendation for BitLocker, that only works in some releases of Windows (not just 7/8 but also varies by edition) and ties you not to a particular encryption software but also to the Microsoft OS features around VHD files.
Remember, TrueCrypt only offered full disk encryption on Windows. Its container file was the only cross-platform part.
Originally Posted by
nkedel
It also creates the volume in a well-known format, and while the data inside of it is encrypted, the metadata around the container is not. Using the Windows EFS to encrypt a VHD file is going to be more secure in some cases, especially if you are not using full-disk encryption.
There's not much metadata that's exposed. For non-OS volumes all that's in the clear is a list of methods available to decrypt the volume and a unique identifier. There's nothing about files, folders, etc exposed; all that's encrypted.
For OS volumes, there is a boot loader partition that (out of necessity) is in the clear. But there's nothing in that partition other than the standard Windows boot loader. On UEFI systems with Secure Boot enabled, every bit in that boot loader partition is digitally signed, and verified by hardware before it’s executed.
As for EFS, that’s even less portable. As wherever the VHD is stored, needs to be NTFS and can’t be copied to/from over a network. Plus, the EFS certificate needs to follow the VHD file. Worst of all, you’d have to decrypt the VHD file prior to using it. As VHDs are mounted in the context of System, which doesn’t have access to the user’s certificate store.
Originally Posted by
nkedel
The biggest problem for many of us is that it's not cross-platform, and indeed, I'm not aware of any other free, practical cross-platform tool
I don’t really see much benefit to cross-platform FDE products. For example, how often is a Windows user going to decrypt the contents of a Mac’s boot drive (or vice versa)? If anything, I see much more utility in a tool which can share encrypted files (or collections of files) between different OSes. For that, there’s GPG.
Originally Posted by
nkedel
Yes, as I said, neither is mandatory. OTOH, the use of TPM as the only factor for decryption (then depending on Windows security to prevent access to the drive, effectively already decrypted) is very popular in the corporate environment. It certainly seems to lead many folks in IT to a false sense of security.
I completely agree.