System Encryption

VeraCrypt can on-the-fly encrypt a system partition or entire system drive, i.e. a partition or drive where Windows is installed and from which it boots.

System encryption provides the highest level of security and privacy, because all files, including any temporary files that Windows and applications create on the system partition (typically, without your knowledge or consent), hibernation files, swap files, etc., are always permanently encrypted (even when power supply is suddenly interrupted). Windows also records large amounts of potentially sensitive data, such as the names and locations of files you open, applications you run, etc. All such log files and registry entries are always permanently encrypted as well.

Note on SSDs and TRIM: When using system encryption on SSDs, it's important to consider the implications of the TRIM operation, which can potentially reveal information about which sectors on the drive are not in use. For detailed guidance on how TRIM operates with VeraCrypt and how to manage its settings for enhanced security, please refer to the TRIM Operation documentation.

System encryption involves pre-boot authentication, which means that anyone who wants to gain access and use the encrypted system, read and write files stored on the system drive, etc., will need to enter the correct password each time before Windows boots (starts). Pre-boot authentication is handled by the VeraCrypt Boot Loader, which resides in the first track of the boot drive and on the VeraCrypt Rescue Disk (see below).

Note that VeraCrypt can encrypt an existing unencrypted system partition/drive in-place while the operating system is running (while the system is being encrypted, you can use your computer as usual without any restrictions). Likewise, a VeraCrypt-encrypted system partition/drive can be decrypted in-place while the operating system is running. You can interrupt the process of encryption or decryption anytime, leave the partition/drive partially unencrypted, restart or shut down the computer, and then resume the process, which will continue from the point it was stopped.

The mode of operation used for system encryption is XTS (see the section Modes of Operation). For further technical details of system encryption, see the section Encryption Scheme in the chapter Technical Details.

To encrypt a system partition or entire system drive, select System > Encrypt System Partition/Drive and then follow the instructions in the wizard. To decrypt a system partition/drive, select System > Permanently Decrypt System Partition/Drive.

Because of BIOS requirement, the pre-boot password is typed using US keyboard layout. During the system encryption process, VeraCrypt automatically and transparently switches the keyboard to US layout in order to ensure that the password value typed will match the one typed in pre-boot mode. However, pasting the password from the clipboard can override this protective measure. To prevent any issues arising from this discrepancy, VeraCrypt disables the option to paste passwords from the clipboard in the system encryption wizard. Thus, when setting or entering your password, it's crucial to type it manually using the same keys as when creating the system encryption, ensuring consistent access to your encrypted system.

Note: By default, Windows 7 and later boot from a special small partition. The partition contains files that are required to boot the system. Windows allows only applications that have administrator privileges to write to the partition (when the system is running). In EFI boot mode, which is the default on modern PCs, VeraCrypt can not encrypt this partition since it must remain unencrypted so that the BIOS can load the EFI bootloader from it. This in turn implies that in EFI boot mode, VeraCrypt offers only to encrypt the system partition where Windows is installed (the user can later manually encrypt other data partitions using VeraCrypt). In MBR legacy boot mode, VeraCrypt encrypts the partition only if you choose to encrypt the whole system drive (as opposed to choosing to encrypt only the partition where Windows is installed).

In EFI boot mode with Secure Boot enabled, VeraCrypt selects a Microsoft UEFI CA-signed bootloader set allowed by the active firmware Secure Boot policy during install, repair, upgrade, or Windows PostOOBE repair: every required CA must be present in the allowed database (db) and absent from the forbidden database (dbx). The 2023 VeraCrypt loader set requires both Microsoft UEFI CA 2023 and Microsoft Option ROM UEFI CA 2023, while the 2011 loader set requires Microsoft Corporation UEFI CA 2011. If the active db/dbx policy permits neither supported set, VeraCrypt aborts instead of installing a loader that firmware will reject. If you manually change firmware Secure Boot db or dbx entries, run VeraCrypt repair or reinstall to refresh the installed bootloader set. For details, including the Microsoft 2023 certificate transition and recovery procedures, see EFI Secure Boot.

Windows feature updates and recovery files

Install the current VeraCrypt before preparing a Windows feature update. Resolve any warning about Windows feature update support before continuing. If Windows Setup has already staged its support files, restart feature-update preparation so that it stages the updated files. Updating VeraCrypt changes the source registration; it does not replace a script that Windows Setup has already copied. See Microsoft's Windows Setup documentation for details of script staging.

If the installer cannot update VeraCrypt's Windows feature update registrations, it completes the installation and displays a warning that names the file or registry value concerned. VeraCrypt does not register an installation folder that it cannot determine or that lacks VeraCrypt.exe or the driver files; existing registrations are then kept. The VeraCrypt system service retries the update whenever it starts. If the warning persists, resolve the reported error and run Repair/Reinstall before starting a Windows feature update. If the executable of the VeraCrypt system service is in use during an upgrade, it is replaced when Windows restarts, and the service is not started again until then.

Recovery backups made by VeraCrypt 1.26.29 and older are stored in the VeraCrypt directory under ProgramData, where standard users could create files. VeraCrypt uses or migrates such a backup only if it is owned by an administrator account or by SYSTEM, and if no other user can modify or replace it. VeraCrypt also deletes the Windows Setup script of older versions from that directory, and prevents standard users from creating files there. On BIOS systems, automatic original-loader restoration requires a complete trusted backup. If that backup is unavailable, VeraCrypt asks for explicit confirmation before decryption or cleanup without automatic loader restoration; obtain trusted recovery media first. If an upgrade warns that the original loader backup is missing, damaged, unreadable, or untrusted, preserve any existing backup files and obtain a known trustworthy VeraCrypt Rescue Disk or a verified original backup before proceeding. Changing ownership or permissions alone cannot establish the safety of an old backup. Do not create a replacement backup from the current boot area of an encrypted system, or restore an unencrypted loader while the drive remains encrypted.

New support files are stored in the VeraCryptSystem directory under the native Common Files folder (normally C:\Program Files\Common Files), where only administrators can create files. Windows Setup adds the VeraCrypt driver from the VeraCrypt installation folder to the updated system. Recovery backups are retained during application uninstall, as is the VeraCrypt directory under ProgramData, so that standard users cannot create files there. Uninstallation and decryption remove VeraCrypt's Windows Setup registrations; a failure to remove them is reported but does not stop the uninstallation.

Next Section >>