Encrypt all data on a Windows 7 Pro laptop 1

[guitarzan]

I have a client who is getting a new laptop shortly (Windows 7 Pro), will be using this laptop on the road a lot, and will be storing a lot of sensitive photos on it (medical). He already had one laptop "disappear" on him (no sensitive info on it, luckily) so I need to encrypt his data on the new laptop.

Does anyone have any recommendations on good software to use, free or paid? I really need this to run as smoothly and translarently as possible, as the user's technical level is not great.

 

[DrB0b]

http://www.truecrypt.org/

This allows you to basically create a separate drive in which all files stored on it are encrypted. Can also be used in conjunction with a USB flash drive as the encrypted drive. And its free.

"Silence is golden, duct tape is silver...

 

[guitarzan]

Thanks, DrB0b. Yes, I had looked into that. I would probably encrypt the entire system drive. Assuming I set it up properly, is it transparent to the user (other than entering a password at bootup)? Any noticeable performance drop?

 

[DrB0b]

Is an entire system encryption necessary? If the only sensitve data is the pictures, why not just do a folder or a USB stick? Ive never used it to fully encrypt a drive so I cant speak on what if any performance issues could arise.

"Silence is golden, duct tape is silver...

 

[guitarzan]

Thanks for the help. Yes, I am pretty sure he will want the entire system drive encrypted, as that will cover files that could have website passwords stored, his vpn to the office, etc. Since it's a new laptop, I will probably set this up and see how it works before and after. I can always choose to decrypt later.

 

[DrB0b]

Yea that's very true, the full disc encryption seems relatively straight forward. Just make sure to keep a copy of that password somewhere safe and accessible because without it, all those files are gone forever .

"Silence is golden, duct tape is silver...

 

[linney]

Windows 7 : Using Compression and Encryption (part 3) - Encrypting Files and Folders

http://programming4.us/desktop/2804.aspx

How to Encrypt your Windows 7 Hard Disk with BitLocker

http://www.informationweek.com/byte/howto/personal-tech/storage-memory/231000137

Make sure you understand the recovering of encrytpted data in case things go wrong.

 

[rclarke250]

We use PGP desktop encryption at work.

http://www.symantec.com/business/theme.jsp?themeid=pgp

It does the whole disk, does any plug in drives also.

 

[guitarzan]

Thanks linney. "Make sure you understand the recovering of encrytpted data in case things go wrong." You mean recovering in the case of a hard drive error? I'm not too concerned about that, as I will have to work out some sort of backup routine.

and rclarke250: how does PGP desktop work for you? seamless? any noticeable slowdowns, or anything different from a machine that does not have that software installed?

 

[BadBigBen]

I've used TrueCrypt before to encrypt a system drive, due to the sensitive nature of the data contained, and the customer never once complained about a slow down...

and this was on an IDE drive, Twinhead Durabook with a Pentium-M, 1GB mem, and XP Pro as the OS...

PS: the customer used a PassPhrase on that laptop, which was some 18 characters long (+/- 5) (don't remember exact length)...


Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[linney]

I guess I am more concerned about the loss of passwords, certificates, and recovery agents, that allow for the decryption of data should you lose the "user" (physically) for any reason.

 

[rclarke250]

PGP works well, I can detect no slow down. It is seamless with the desktop, install took about 15 minutes on my laptop, and was instituted months after I had received the laptop. Updates, and installation of software are normal, no extra steps to perform, just on a power up or reboot, you type in the windows desktop password, and it boots you into windows, and no need to log into windows separately. Also, if the user forgets their password, you can contact symantic and they can generate a one time password to get back into the machine.

 

[MitelInMyBlood]

Only for what it's worth....

My (Fortune-500) employer, after having had many laptops stolen over the years now does a full drive encryption on every new laptop using Bitlocker, with hopes that without the password, the sensitive data will finally be somewhat safe(er). The performance impact seems to be about a 10% hit in disk i/o speed.

Original MUG/NAMU Charter Member

 

[58sniper]

Bitlocker works great, and the recovery keys can be stored in Active Directory. Performance on my laptop degraded FAR less than 10%.

I know a couple of orgs that have tens of thousands of laptops with Bitlocker configured (including boot pin), and it works great.

Free, built into the OS, and recovery support in AD.

Do you have your Tek-Tips.com swag? I've got mine! Pick some up at

https://www.advantageemblem.com/PromoItems/ApparelStore.aspx?CategoryId=392

Stop by the new Tek-Tips group at LinkedIn.

http://www.linkedin.com/groups/Networking-TekTipscom-forums-members-3952395