0

I have certain documents in my External HDD that I need to keep secure with a password & NOT BY ENCRYPTION.

I thought of a method to create two partitions in the drive, so that one is public & the other is private. How to password protect a partition on an External Hard Drive? I would want it to prompt the user for password on both Linux & Windows systems.

By the way, if there is a method to password protect a particular folder only, that is also fine. I just need it to be accessible on both Linux & Windows without installing softwares on every machine that I connect the drive to.

EDIT: even if the authentication system is buggy or easily bypassed or with any other security concerns, It's still okay.

schegu
  • 3

3 Answers3

1

What you are asking is not possible in the general sense.

You can't password protect a partition.

If you are password protecting a directory this would be filesystem specific, and none of the common filesystem's that work on both OS,'s support this.

Veracrypt ( a variant of Truecrypt) can be used on both platforms, but will require additional software.

You might be able to use something like zip to create archives which are password encrypted but you need to be very careful uncompressing and cleaning up after yourself. Likewise some documents have built in encryption, but its not universal.

davidgo
  • 73,366
1

If your goal is performance, use full-disk encryption. It works at sector level and is almost completely invisible – sectors are encrypted or decrypted on the fly, so there are no separate archiving/extraction steps necessary.

Microsoft BitLocker is supported on Linux, but the standard cryptsetup tools only gained support just a month ago, so for now you'll still need some additional tools (either Dislocker or libbde).

The same applies even if using "containers" (encrypted disk images like VeraCrypt provides), as they're treated like virtual disks and not as archives. VeraCrypt works on both systems and supports both full-disk and container encryption, but has to be installed separately.


If your goal is to avoid encryption for other reasons unrelated to performance – there is probably no such thing that actually works well.

  • Password protection can be done at hardware level (that is, enforced by the disk's firmware) – e.g. most SATA HDDs can have an "ATA password" applied – but neither Windows nor Linux know how to deal with it. You will not get a password prompt when connecting an "ATA password" locked disk to either OS; the disk will just refuse all I/O, and might hang the system for a short while. (Besides that, data recovery companies have been able to bypass the ATA password for a very long time. It's just voluntarily enforced, after all.)

  • At software level, there is no disk-level nor filesystem-level password feature built in to Windows nor Linux. Practically all "password protection" methods that are in use today will involve encryption, as that's the only method that is not absolutely trivial to bypass. (Any "file locking" software which tries to enforce password protection without encryption can be simply patched to not enforce it – the password can usually be replaced with a known one, or the check itself can be removed.)

In practice, Windows "BitLocker To Go" disk encryption is the only full-disk protection method that works on both operating systems without requiring additional software.

(And even that's stretching it a bit: Linux cryptsetup only gained BitLocker support very very recently, so in most distributions you will still need to install Dislocker or libbde to access the drive. (Which is still less than you would need to access a LUKS-encrypted drive on Windows...))

If that doesn't suit you, there are a few external HDDs with a fingerprint reader or even buttons to input a physical PIN. These offer varying levels of security – some of them can be defeated easily, others actually use the PIN/fingerprint to unlock some encryption mechanism – but the overall idea is that the unlocking doesn't depend on the OS.

(Manufacturer-provided software is usually still needed for actually enabling the protection, though.)

By the way, if there is a method to password protect a particular folder only, that is also fine. I just need it to be accessible on both Linux & Windows without installing softwares on every machine that I connect the drive to.

Put it inside an Zip archive that's encrypted using the "Zip 2.0" method. That's about the only common format between the two operating systems that supports some form of password protection.

Note that you will specifically need to use "Zip 2.0" aka "Zip legacy encryption" instead of AES, in order to satisfy both requirements: it is the only method supported by Windows, and it's weak enough to practically count as "no encryption".

Aside from that, none of the filesystems common between both operating systems – FAT32, exFAT, NTFS – have any form of password protection that does not involve encryption. (If they did, it would be trivial to bypass, just as Linux will already bypass NTFS "access security lists".)

grawity
  • 501,077
0

I understand you need a portable disk that may be connected to multiple computers, but that you wish at least part of it to be protected with a password across all devices.

The best utility for this task is VeraCrypt. It might be better to use for the VeraCrypt data an encrypted file on the disk, that can be mounted by VeraCrypt as a volume, rather than encrypt a partition on the disk. The problem will come from Windows that does not support multi-partition external disks.

While VeraCrypt is available as install package under both Windows and Linux, your needs dictate the use of its portable version. In this way, you may carry with you the data on the disk as encrypted, but also carry on the same disk the VeraCrypt software that will unlock it on any other computer.

For Windows, you will find the portable version of VeraCrypt on the Portable Apps website. Full documentation is included with the link.

Linux and MacOSX distributions don't have this option, but the apps are already portable. You only need to copy the executables from /usr/bin in Linux and Applications in OSX. See this answer for more details.

In case of a problem under Windows with the Portable Apps version, the same approach might also work by copying the installation folder of VeraCrypt to the disk.

harrymc
  • 498,455