Referring to my post about TrueCrypt, I mentioned a disadvantage of using this software — you cannot use it on a computer without administrative rights.

Actually, there is a third-party GUI interface program that can be run on a computer without administrator rights, and you are still able to access the container file of TrueCrypt upon supplying the correct password.

This software is called TCExplorer, and you can access it for free here:

http://www.codeproject.com/KB/files/TCExplorer.aspx

I have been testing this for a while and I think it’s a great piece of software, especially if you want to use a TrueCrypt file on a public computer.

Here are some notes about using this software:

1   TCExplorer cannot manage the TrueCrypt file created by the latest version. I tried this software on a container file made with Version 6.0a without success. Based on information in the author’s release information, I tried the earlier version of TrueCrypt back to 2007, such as Version 4.3a, and it works fine.

2   Fortunately, Version 4.3a’s container file can still be managed by the latest TrueCrypt program, v6.0a. So what you need to do is create a v4.3a container file using the old version of the TrueCrypt program by running it once (you can download the old version of TrueCrypt here: http://www.truecrypt.org/pastversions.php) and use the latest version to manage the file, like mapping this old version container file as a drive to your computer with administrative rights.

You might wonder why the official TrueCrypt project does not offer this feature to the program. Actually, this is a common drawback of all so-called “on-the-fly” real time data encryption programs. One of the main intentions of this kind of real-time data encryption program is to use system drivers to embed all encryption processes in the system so that the user will not need to take care of the encryption/decryption process when they add or extract data files from the container file. The whole process can be made transparent to the users.

And to be able to install and use the specially created system drivers, you must have the administrative rights.

If the on-the-fly feature is not needed, then we definitely do not need to install the system drivers and hence there is no need to have the administrative rights. But then you have to take care of another security concern. The user needs to set up a temporary place to store and process the encrypted/decrypted file from the container file as now there is no real-time process to help encrypt/decrypt the file directory to the system. This place is prone to data leakage as the user must remember to clean it up after using the program.

Take the TCExplorer as an example. It automatically creates a temporary directory either in the USB thumb drive you are using or it sets up a temporary directory in your computer, such as: C:\Documents and Settings\YourUserName\Local Settings\Temp.

After using the program, you need to clean the temporary data there or risk that the decrypted files will be left there without encryption. This program does provide a feature to delete the temporary directory as shown:

But the user still has to remember to use this feature.

So perhaps this explains why the official TrueCrypt project does not provide this feature, because it introduces a security weakness to the program if we allow the user to use this program on a computer without administrative rights.

So use this program carefully if you think it can help. As the author of TCExplorer commented, there are advantages and disadvantages of using this program. The author’s intention is to provide a truly portable solution for people with documents that are not highly confidential but don’t want others to view their documents (for instance, if a thumb drive is lost). If this is what you’re looking for, then perhaps TCExplorer is right for you.

Tags: on-the-fly data encryption, USD Data Encryption, Encrypting data without administrative rights, USB Data Encryption and Decryption without administrative rights