Understanding BitLocker and Encryption

[jre751]

I just want to understand some basic points about encryption in Windows 7. If I setup BitLocker or VeraCrypt in Windows 7 and someone removes my hard drive they 'technically' cannot view my drive without an unlock key or password.

However if I encrypt the whole drive and it is decrypted on boot with an unlock code or password, which I guess is standard procedure, that means its security at this stage is exactly the same as a standard decrypted HDD and a hacker can view all my data if they break through the internet security suite?

 

[Alejandro85]

Your understanding is totally correct.

Like with every security feature, the key point is to understand what it's meant to protect against. In the case of full-disk encryption, it helps deter physical attacks. If someone picks the HD and puts in another computer, or boots with another OS, he'll only see the encrypted contents. He won't see what it contains, what it's used and how much is free, much less can alter anything. What you gain from this is privacy.
Of course, an attacker is NOT prevented from simply formating your hard disk and damaging the whole data, or from tacking the disk altogether, you'll still loss the HD

BitLocker, VeraCrypt, or anything like work pretty much in the same way, they replace the Windows bootloader with their own, ask for the password, then decrypt the required sectors in-memory and only saves encrypted data back (plaintext never hits the disk). And this isn't even limited to Windows, any OS does pretty much the same thing.

Like you said, once you've booted the computer, the layer of protection is removed and the OS works normally. Viruses, deliverate destructive actions, human errors or program bugs affect the same there, since the encryption layer will happily save any malicious action into the HD, just scrambled. It offers exactly zero protection against malware. You still have to do your backups, firewall, updates, permission hardening as normal to get security against that.

 

[jre751]

Sorry for the late reply. Is there a way to part encrypt folders on a drive one by one or in groups and then decrypt each one(s) only when required? This isn't ideal but just a thought.