FAQ

(Well, more of a pre-emptive FAQ really; this will be added to as appropriate when other FAQs crop up)

Q: Is FreeOTFE based on CrossCrypt?

A: The answer to that is an emphatic NO! FreeOTFE and CrossCrypt are two completely separate projects, written by completely different people.

It's easy to see why users may get the idea that FreeOTFE is based on CrossCrypt; CrossCrypt was released first, and the CrossCrypt's GUI (CrossCryptGUI) look practically identical to FreeOTFE's interface.

The reality is that CrossCrypt itself is a command line based OTFE system; it has no GUI. CrossCryptGUI was a project I created to provide a GUI to CrossCrypt to improve it's ease of use.

In actual fact, far from FreeOTFE looking a lot like CrossCryptGUI, it's actually the other way around - CrossCryptGUI looks a lot like FreeOTFE! The Delphi GUI to FreeOTFE was already developed before CrossCrypt was released. For the sake of expediency, I dropped the CrossCrypt Delphi component I wrote into FreeOTFE's GUI, hijacking it to produce CrossCryptGUI; a cannibalized version of the FreeOTFE interface.

The cyphers supplied with the first public release of FreeOTFE (v00.00.01) were the same as those used by CrossCrypt. Originally I had planned to release the first beta of FreeOTFE for compatibility testing with only the NULL, XOR, DES and AES cyphers; these apparently being the most common cyphers used with Linux volumes. After CrossCrypt was released (which uses AES and Twofish) DES was the only cypher in the above list I had not implemented. I decided to switch from DES to Twofish in order that people without Linux could easily use CrossCrypt to verify that FreeOTFE was operating correctly with AES and Twofish volumes (and vice versa; benefiting both systems).

Since it's initial release, FreeOTFE has seen significant developments, including support for many more hashes, cyphers, and other options.


Q: Is FreeOTFE based on Linux's "losetup"?

A: No, FreeOTFE is a completely separate project in it's own right. It was only after I realised how "simple" Linux encrypted losetup volumes are (they are nothing more than an encrypted partition image), that I added support for them into FreeOTFE.

Having said that the format of losetup volumes are "simple" - have you any idea how many different options, combinations, etc it has?! Each option on it's own may be relatively simple, but there's a fair number of them...! (See the relative complexity of the FreeOTFE's Linux mount dialog - you have to tell it everything!)


Q: Right now, FreeOTFE supports losetup volumes; do you have any plans to include support for DriveCrypt, BestCrypt, etc volumes?

A: This is unlikely to happen as there is no standard for OTFE volume files (each system uses it's own layout). Since adding support for other OTFE systems is non-trivial, and few OTFE systems have released proper technical documentation into the public domain, it may be awhile before such support is added


Q: When I mount a FAT/FAT32 formatted Linux volume under FreeOTFE everything works perfectly. When I do the same with my ext2/ext3/RiserFS/etc volume, I can't see my files!

A: FreeOTFE does one thing: when a volume file is mounted, FreeOTFE presents a new storage device to the operating system.

Like all OTFE systems, it has no comprehension at all of what FAT/FAT32/NTFS, let alone ext2/ext3/etc - this understanding lies well outside the scope of an OTFE system, and is the responsibility of the filesystem drivers installed.

Although MS Windows does come with filesystem drivers for FAT/FAT32/NTFS, it does not (natively) support other filesystems such as ext2.

As a result, in order to read/write to your encrypted Linux volumes under MS Windows, you will need to either:
  1. Format the volume under Linux using one of the filesystems MS Windows understands (e.g. FAT), or
  2. Install 3rd party software on your MS Windows system, which provides the filesystem (e.g. ext2) that you wish to use

Q: FreeOTFE comes with a set of command line decryption utilities! Anyone can just decrypt my data!

A:
The decryption software included with FreeOTFE is completely useless without the password used to encrypt your data. And anyone with that information can decrypt your data anyway!

The command line decryption utilities are not some form of "password cracking" tool - far from it; they actually act to increase your security by allowing you to verify that encryption is actually taking place.


Q: When I mount a volume and then view it's properties under FreeOTFE, it states that the hash algorithm used "n/a" - but I use a hash algorithm!

A:
The hash algorithm shown is the one used to generate sector IVs. If the sector IV generation method used does not make use of a hash algorithm (see the "Sector IVs" item on this dialog), "n/a" will be displayed for the hash algorithm.

This is separate from any hash algorithm used to process your password, which in the case of FreeOTFE volumes can be seen in the output file of a CDB dump (select "Tools | Critical data block | Dump to human readable file..."), or in the case of Linux volumes, is specified at time of mounting.


Q: When creating a FreeOTFE volume, the wizard shows me which stage of volume creation I am currently on - but it goes haywire, and the number of stages to complete keeps changing!

A:
The number of different stages to creating a new FreeOTFE volume varies, depending on what options you choose - for example, if you elect to the mouse movement to generate random data, then you will have to complete an extra step to actually generate this random data; if you switch to using the Microsoft CryptoAPI for generating random data, you can skip that step, as it is done for you automatically.


Q: FreeOTFE is currently available for free - are you intending to "sell out" later, and start charging for it once enough users have been "hooked" on it?

A: NO! FreeOTFE is free, and will always be free. As much as anything else, it would look a little silly if people had to pay for "FreeOTFE"! ;)

Seriously though, I have no intention in turning FreeOTFE into a commercial product.

The nearest that I may do is request donations. This would, of course, be fully voluntary.


Q: FreeOTFE may always be free, but will an "enhanced" version (which is charged for) with extra features be released (perhaps under a different name)?

A: Personally, this sounds a lot like the "selling out" idea above - if such a "paid for" version was to be released, FreeOTFE development may become at risk of stalling, ceasing completely, or omitting particularly useful features. This would have practically the same effect as making FreeOTFE a paid-for commercial system.


Q: Is it possible to dismount my FreeOTFE volumes when I hit a certain "hotkey"?

A: Yes; this functionality is included with SecureTrayUtil (see http://www.SDean12.org/SecureTrayUtil.htm)


Q: Why can't I dismount my volume(s)?

A: The most common reason for this is because FreeOTFE cannot gain an exclusive lock on the associated drive. This is normally caused by one or more files being open on the encrypted volume.

"Normal" (non administrator) users may also have problems dismounting drives (see the TODO list this documentation)

"Emergency dismount" functionality, to under development (see the TODO list in this documentation)


Q: How can I be sure that there are no backdoors in FreeOTFE?

A: Review the source code to your satisfaction, and build your own (see relevant section on how to build FreeOTFE)

This is strongly recommended, and the best way of ensuring that the software is not compromised.

However, this is not always practical (many people are not familiar with how to read source code, or lack the required tools to build their own). In which case, if you are trust the author, and the system on which the release was built on, then you may prefer to simply check the SHA-1 and PGP signatures associated with the binary release.


Q: Why are the drivers written in C, but the GUI in Delphi?!

A: Good question. The drivers are written in C as the DDK pretty much requires it. The GUI is in Delphi as this was the easiest for me to implement.

A C GUI may be developed at a later date; a command line utility which carries out the same functionality as the Delphi GUI is currently "in the pipeline"


Q: Why am I not prompted to enter a password when creating a Linux volume?

A: This is covered in the documentation; see section relating to creating Linux volumes.

In a nutshell, creating a Linux volume only requires a file to be created of the appropriate size. It is when the volume is subsequently mounted that a password is required; the same process as when creating an encrypted Linux volume under Linux.


Q: By examining a FreeOTFE/encrypted Linux volume file, can anyone tell what it is?

A: Neither FreeOTFE nor encrypted Linux volumes have any kind of "signature" that would allow an attacker to identify them for what they are.

In particular, the "critical data block" in every FreeOTFE volumes is encrypted, and as such it is not possible to identify it for what it is


Q: What is "plausible deniability?"

A: See documentation section on "plausible deniability".


Q: What to the numbers and letters after a hash name mean?

A: When required to choose which hash you wish to use, FreeOTFE will present you with a list of all hashes that are provided by the FreeOTFE drivers installed. These lists will display hash names in the format:
<hash name> (<hash length>/<blocksize>)
Note: The key and blocksizes shown are in bits, not bytes.

For example:
SHA-512 (512/1024)
This indicates that the hash used is SHA-512, which generates 512 bit hash values, and processes data in 1024 bit blocks.

If the hash length shown is zero, then the hash generates no output.
If the hash length shown is "-1", then the length of the hash values returned can vary.

If the blocksize is "-1", then the hash processes data using a variable blocksize.

Typically, when presented with a selection of different hashes to choose from, you will see a "?" or "..." button next to the list; clicking this button will display full details on the driver.


Q: What to the numbers and letters after a cypher name mean?

A: When required to choose which cypher you wish to use, FreeOTFE will present you with a list of all cyphers that are provided by the FreeOTFE drivers installed. These lists will display cypher names in the format:
<cypher name> ([<mode>; ] <keysize>/<blocksize>)
Note: The key and blocksizes shown are in bits, not bytes.

For example:
AES (CBC; 256/128)
This indicates that the cypher is AES, operating in CBC mode with a keysize of 256 bits and a blocksize of 128 bits.

If the keysize shown is zero, then the cypher does need take a key (password) to carry out encryption (e.g. the "Null" test cypher).
If the keysize shown is "-1", then the cypher can accept keys of arbitrary size.

If the blocksize is "-1", then the cypher encrypts/decrypts arbitrary blocksize.

Typically, when presented with a selection of different cyphers to choose from, you will see a "?" or "..." button next to the list; clicking this button will display full details on the driver.


Q: Can I burn my volumes on a CD (or CDRW, or DVD), and mount them from there?

A: Yes; at the end of the day, volume files are just plain straight (albiet very large) files. Just ensure that when you mount them, you mount them as readonly volumes, (for obvious reasons - even with CDRWs).

It is recommended that volumes which are to be written to CD are formatted using either the FAT or FAT32 filesystem. NTFS volumes will work (under Windows XP), though AFAIR Windows 2000 is unable to mount NTFS volumes readonly (meaning the volume must be copied back to your HDD, the file set to read/write, and then mounted).


Q: What is the largest volume that I can create?

A: The largest volume supported is theoretically 2^64 bytes (16777216 TB; 17179869184 GB). For fairly obvious reasons, I have not had the opportunity to test a volume this size!

In practice however, limitations with the filesystem that the volume file is to be stored upon may prevent this FreeOTFE's limits from ever being reached.


Q: Help! I forgot my password! I know it was something like...

A: Oops. That was silly of you, wasn't it?

If you've secured your volume with something like AES, then you can pretty much kiss goodbye to your data.

If you know what most of your password is though, then you could certainly write an application which would carry out a brute force attack on your volume, assuming those known characters. How long this would take to run would depend on the cypher used, the strength of your password, and how much you remember of it.

Note: This is not a security risk; that last comment equally applies to pretty much any OTFE system which has been implemented correctly.


Q: Can I use FreeOTFE over a network?

A: Yes. By installing FreeOTFE on the computers you wish to access your data from, you can mount a volume file located on a networked server.

When mounting over a network, simply specify the UNC path (e.g. \\servername\sharename\path\volumefilename) to the volume file begin mounted.

When a volume is mounted over a network in this way, all data read/written to that volume will be sent over the network in encrypted form.

If you wish to mount a networked volume file by more than one computer at the same time, you may do so provided that they all mount the volume readonly. If any computer has a volume file mounted as read/write, you should dismount all other computers (even if they were accessing the volume as readonly), and ensure no other computer mounts the volume until the computer mounted as read/write has dismounted.


Q: Why do I get "Unable to connect to the FreeOTFE driver" errors?

A: This message indicates that you have either not installed the main FreeOTFE driver ("FreeOTFE.sys"), or you have not started it yet.

It is normal to see this message in the following circumstances:
  1. The first time you run FreeOTFE, when no drivers have been installed
  2. When exiting the driver installation dialog, if the main FreeOTFE driver hasn't been both installed and started.
  3. When starting FreeOTFE after installing the main FreeOTFE driver, if the driver has not been started (e.g. you rebooted, and the driver was set for manual start, as opposed to at system startup)
  4. When stopping all portable mode drivers, where the main FreeOTFE driver was started in portable mode.
  5. When exiting FreeOTFE and stopping all portable mode drivers, where the main FreeOTFE driver was started in portable mode.
To eliminate this error message, ensure that that the main FreeOTFE driver is installed and started.

To prevent this error message from being displayed when FreeOTFE is run after rebooting, set the main FreeOTFE driver to start at system startup.

The status of all installed drivers can be checked by selecting "File|Drivers..."


Q: How safe is FreeOTFE?

A: FreeOTFE is about as pretty much just as safe as writing directly data to your hard drive, without FreeOTFE encrypting it (see also the FAQ: "What happens if my volume file is corrupted or damaged in some way? Will I lose all my data?")

If you forget your password however, then by definition you will not be able to recover your data (see also the FAQ: "Help! I forgot my password! I know it was something like...")


Q: What happens if my volume file is corrupted or damaged in some way? Will I lose all my data?

A: As with pretty much all OTFE systems, if you were to corrupt a FreeOTFE volume is some way, the damage your data would receive would be about the same as if you had stored it directly on your hard drive, without FreeOTFE encrypting it.

For example: If you mount a FreeOTFE volume file and then write a byte of data, at random, to somewhere on that mounted drive, the effect would be exactly the same as if you had randomly written the same byte to a real hard drive.

On the other hand, if you were to write a byte to data to a random location within an umounted FreeOTFE volume, then the amount of damage caused would dependant on where that byte was written:
  1. If the volume file was created with a critical data block (CDB) at the start of it, and the byte was written to the first 512 bytes of the volume file (where the CDB is located), then the volume would be unmountable, unless you had made a backup of this area of your volume, or created a keyfile - in which case, you could restore from your backup/mount from your keyfile, and continue as if nothing had happened.
  2. If the volume file was created without a critical data block, or the byte was written to any other part of your volume file, then the sector that corresponded to the location that the byte was written to would be corrupted from approximatly the point the byte was written, to the end of that sector; a maximum of 512 bytes.
To protect against (1), FreeOTFE included functionality to backup a volume's CDB (see "Tools | Critical data block... | Backup..."), and to create keyfiles (see "Tools | Create keyfile...")
Should case (2) occur, the damage to your volume would be minimal (up to a maximum of 512 bytes), and restricted to the sector that was corrupted.


Q: If someone steals my keyfile, will they be able to decrypt my data and read it?

A: No, not unless they have the keyfile's password as well.

Keyfiles are encrypted. Without the password used to encrypt it, a keyfile is pretty much just a useless block of random data.


Q: When selecting a cypher to use, why do the same cyphers appear multiple times?

A: This is because you have more than one version of a particular cypher driver installed. See also: Why are there duplicated cypher drivers?


Q: Why do I get prompted to select a driver whenever I attempt to mount some of my FreeOTFE volume?

A: If your volume looks as though it can be decrypted by using more than one cypher/hash driver combination, you will be prompted to select which combination you wish to use.

This happens, for example, if you used Twofish or AES to encrypt your data as FreeOTFE comes supplied with a choice of drivers for these cyphers (see also: Which of the duplicated drivers should I use?)

To prevent the prompt appearing, please uninstall one of the offending drivers.


Q: Why are there duplicated cypher drivers?

A: Different drivers use different cypher implementations. For example, there are three Twofish drivers; one based on the Hi/fn and Counterpane Systems Twofish implementation, another which uses the libtomcrypt implementation, and a third which relies on the Gladman implementation.

Both drivers do exactly the same thing. It is recommended that if you wish to use a cypher which has multiple supplied drivers, you uninstall one of the them. (See also: Which of the duplicated drivers should I use?)


Q: Which of the duplicated drivers should I use?

A: It doesn't particularly matter too much; they both do exactly the same thing, but are based on different implementations.

Simply choose one and uninstall the other.


Q: Why do I need Administrator rights to install FreeOTFE?

A: This is probably the most common FAQ wrt OTFE systems.

In order for most (if not all) OTFE systems to operate, they require the use of "kernel mode drivers" to carry out drive emulation.

A "kernel mode driver" is special piece of software which operates at a very low-level within your computer's operating system. As such, it can do pretty much anything to your system - including carrying out privileged actions that normal users are not allowed to do (e.g. formatting your HDD). Because of this, MS Windows only allows users with Administrator rights to install such drivers.

NOTE: Administrator rights are not required in order to use FreeOTFE once installed.


Q: Why do I need Administrator rights to start "portable mode"?

A: Administrator rights are required to start "portable mode" starting portable mode implicitly registeres the FreeOTFE drivers on the computer it's running on. When portable mode is stopped, they are unregistered.

Administrator rights are required for this operation, for the same reasons as given for the answer to "Why do I need Administrator rights to install FreeOTFE?"


Q: Can FreeOTFE run under MS Windows 95/98/Me?

A: No - and there are currently plans to port FreeOTFE to these OSs due to the different driver model used.


Q: Can FreeOTFE run under Linux?

A: No - although FreeOTFE can read, write and create volumes which can be used under Linux.


Q: Can FreeOTFE generate keyfiles which only allow readonly access?

A: Not at present, though if I receive enough requests for it, I may add this functionality.

Until then, it should be borne in mind that anyone with a "readonly" keyfile has, pretty much by definition, a copy of your master key and so has the potential to modify their "readonly" keyfile, turning it into a "read-write" keyfile.

i.e. It is debatable how much use this functionality has; certainly it should not be relied upon to prevent users from gaining write access to your volume files.


Q: After creating an encrypted partition/disk, MS Windows reports that partition I used as being type "RAW" and prompts me to format it - why?

A: After creating an encrypted partition/disk, if you have a drive letter associated with the physical partition used, MS Windows will report that drive as being "RAW" since it cannot understand what is stored on it (for obvious reasons, it can't understand what the encrypted data means).

WARNING: Do not let MS Windows format this partition! Although formatting the "virtual drive" FreeOTFE creates after mounting your encrypted partition is certainly a requirement before it can be used, formatting the partition it resides on could destroy your encrypted data!

The safest course of action is to prevent MS Windows from allocating a drive letter to the encrypted partition. By doing so:
To do this:
  1. Go to "Start -> Settings -> Control Panel -> Administrative tools -> Computer Management"
  2. Select "Disk Management"
  3. Rightclick on the partition you have setup an encrypted and select "Change Drive Letter and Paths"
  4. Remove any drive letters associated with the partition

Q: How can I get FreeOTFE to mount my volumes at startup/when I login?

A: By creating a shortcut with suitable command line paramters in your "Startup" directory (click the MS Windows "Start" button, then go to "Programs | Startup"), FreeOTFE can mount volume files after your system starts up/you login.

See the Command Line Interface section for full details of FreeOTFE's command line options.