Powerful open source program TrueCrypt 7.1 (free/donationware) creates encrypted volumes on your computer, or encrypts entire disks--including your system disk. It allows you to create hidden volumes, or even an entire hidden operating system.

Proper computing practices usually keep people from attacking your system remotely, but there's still a high risk if they gain physical access to your PC or your drives. Encryption programs such as TrueCrypt render the actual stored data unreadable without the proper key, making it difficult to even determine which parts of the encrypted disk hold data and which hold random gibberish. This imposes very few limits on ordinary system use, as modern encryption software is extremely fast and performs on-the-fly encryption and decryption with a very minimal speed hit.

TrueCrypt can be used by anyone, but it sometimes delves into technical terms. However, the extensive documentation should be understandable to anyone who is in a position to use or need this kind of software.

There are two modes of using TrueCrypt. The first, the easiest for most users, is to create an encrypted volume as a file on an existing disk. This requires a good chunk of free space, though that depends on how much you want secured--if it's just a few Excel files or the like, you can make a very small volume; if it's extensive archives, you will need much more space. Once the file is created, it can be mounted like any other Windows disk, and files can be read from it and written to it. All programs treat it like a normal drive: The TrueCrypt drivers intercept all read and write requests, processing the data transparently. Without the password (and/or a key file), no one else can mount that volume, and anyone who copies the encrypted volume will just have random bytes. (Usage tip: This doesn't apply if they access your system while the volume is mounted and the decryption is running; they will then see the files just as you do. So keep your firewall secure and if you're in a shared environment, set TrueCrypt to dismount shared volumes after inactivity.)

The second mode is full-volume encryption. This can be a non-system partition, or you encrypt your system drive. Doing the latter provides the maximum in security, since it means that all of the things Windows stores without your knowledge, such as system restore points, temp files, and other clutter, will also be encrypted. It also means that if you ever forget your password, you cannot boot your computer. TrueCrypt will insist you make a recovery CD in the event that the boot level drivers on the encrypted disk become corrupt, but useing the CD still requires you to know the password, and there's no way to recover or reset the password if you've forgotten it.

Encrypting a disk can be time-consuming; it took about 20 hours to encrypt my 1TB USB drive. This process can be safely paused, but the disk cannot be mounted while it's being encrypted. If you encrypt your system disk, TrueCrypt will do it without locking up your computer, but these actions are best saved for a time when you don't plan to use your computer for a while.

TrueCrypt has the ability to create hidden volumes, which are useful if you fear you will be forced to reveal a key. Basically, Key 1 unlocks a volume and reveals files and data. Key 2, applied to the same volume, reveals different files. Because the free space on an encrypted volume is random data, it's very difficult to prove that a volume contains hidden data.

I strongly recommend TrueCrypt as a disk encryption solution. It's probably enough for most users to set aside a few dozen gigabytes for an encrypted volume to store your most sensitive information, but if your need for security is greater, TrueCrypt will meet it.

Note: This program is donationware. It is free to try, but the author accepts and encourages donations towards further development.

--Ian Harac