How to PROPERLY SECURE my laptop and ext hdds?

[EternalFun]

Hi, breakins happen where I live so want to take extra precaution when I go out of my home without taking my laptop and external hdds.

1. How do I make sure that if someone breaks in, they cannot use my laptop? I bet log on screen password is not the best in this case. I mean those can be passed by formatting windows right? What do you think about bios password (or what is the exact term for this?)? Moreover how can I prevent anyone from unauthorized access if they get their hand on my laptop and they take it with them?
   
   
2. Suppose my external hdds get stolen, how do I make sure that they cant see the contents when they connect my hdds to their own laptops? Will bitlocker or any other software (which ones) do for locking entire contents? What is a good way for this?

Looking for a solution for this. Safety is better than everything here.

 

[infinix69]

RE: Hard Drives

• You want FULL DISK ENCRYPTION. There is a bootloader that runs BEFORE windows and asks you to enter password, which is used to decrypt the entire contents of the drive. Without it, the entire disk is like a brick \ random data. Make SURE you don't lose your password, because there is no 'backdoor recovery' method. Also make sure to make backups of the disk\container headers.
• Use VeraCrypt. It's free, supports FDE, and has been audited by independent parties to ensure the code is not flawed.
• Password should be long (most would suggest 20+ characters, numeric, alpha, upper and lower case, and symbols). This is important because shorter passwords could still be bruteforced on modern hardware.
• You are best of also using LAYERED encryption, such as: AES -> Twofish -> Serpent.
• BitLocker might be all well and good... but I personally wouldn't trust Microsoft (remember NSAKEY?)
• There isn't really a better way than this to secure your drives. If you really want to be safe, run a triple pass DoD standard disk wipe on the drive before full-disk encrypting it. This way the old data on it has a very very low chance to be recovered, via. electron microscope magic that is very expensive and rarely used (or so I have read.)

RE: Windows Account \ Password

• Pre windows 10/8.1, I can verify this is easily bypassed on both WIn 7 and XP.
• Generally even if the login can't be bypassed, the disk contents are not encrypted, so booting into linux or an XP live distro you can easily read all files off the main drive / windows install.

RE: BIOS Password

• Always a really good idea. It makes the laptop harder to modify and resell if stolen. Modern laptops have it so that pulling the CMOS battery doesn't wipe the password, and only specialized hardware-based approach to modify the NVRAM or whatever specific security chip is the only way to reset it.

RE: Laptop Security Options

• Many DELL and Lenovo ThinkPads have Computrace which is a service you pay for that can trace wherever your laptop is, what internet it gets plugged into, remotely wipe your device, and even take screenshots of the desktop (and camera apparently). I don't recommend it because it is basically a backdoor into the computer that trojans\rootkits have knowingly exploited in the past to be almost un-removable (then again, its there by default and nothing you can do about it other than 'permanently disable', which apparently can be undone via exploit anyways). But at the same time, it is apparently quite effective and recovering stolen devices when it does work.
• Intel has has their own AT anti-theft stuff too, usually present on Lenovos, but I don't know much about that.

FINAL NOTE
Full disk encryption with VeraCrypt means that when your laptop is shut off, nobody will be able to access the harddrive and files anymore. If they take the disk and put in their own PC \ drive bay, they wont be able to access it because its fully encrypted. This is what you are looking for, I believe. However, if you leave your PC on and they manage to bypass the windows login (or its left unlocked) -- then they will obviously have full access to your unlocked system (until its shut down)

You can also create VeraCrypt "containers", kinda like file-based hard drives \ partitions inside your hard drive. Very similar to a zip file that you can mount as a drive and add\remove\modify files on. These you can mount and unmount at your lesiure within windows -- another option. However your windows swap file, program files, history, etc etc... won't be encrypted that way, and may contain sensitive data.

EDIT: External HDD
Oh yeah, I don't believe VeraCrypt supports full disk encrypting USB devices -- however, you can create multiple containers or one giant encrypted container to fill the entire external drive. There may be some other software that does support fully encrypting external devices, but I don't know enough to help you there.


Like and subsc.... err, hope that was informative

 

[Deleted member 813988]

I have couple dogs guarding it

 

[TheVigilante]

I have couple dogs guarding it

Hope it's not neon lol

 

[Writerly]

Keep the laptop somewhere safe? And make it your next goal to move from the area. Or get a guard dog heh. Sorry, it's just that most protections we can put on a laptop are pretty easy to bypass.