Symantec Endpoint Encryption Full Disk User Manual

Symantec™ Endpoint Encryption Full Disk for Mac OS X User's Guide
8.2.1
The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement.
Version 8.2.1. Last updated: April 2012.
Legal Notice
Copyright (c) 2012 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, PGP, Pretty Good Privacy, and the PGP logo are trademarks or registered trademarks of Symantec Corporation or its
affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering.
No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if
any.
THE DOCUMENTATION IS PROVIDED"AS IS"AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR
INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION.
THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR 12.212 and subject to restricted rights as defined in FAR Section 52.227-19 "Commercial Computer Software - Restricted Rights" and DFARS 227.7202, et seq. “Commercial Computer
Software and Commercial Computer Software Documentation”, as applicable, and any successor regulations. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement. Symantec Corporation 350 Ellis Street
Mountain View, CA 94043
Symantec Home Page (http://www.symantec.com) Printed in the United States of America. 10 9 8 7 6 5 4 3 2 1 Contents
About Symantec Endpoint Encryption Full Disk
Using this Guide
Conventions Used in This Guide
Who Should Read This Document
Technical Support
Contacting Technical Support
Licensing and registration
Customer service
Support agreement resources
Symantec Endpoint Encryption Full Disk Basics
Symantec Endpoint Encryption Full Disk Terminology
Symantec Endpoint Encryption Full Disk Product Components
Terms Used in Symantec Endpoint Encryption Full Disk
Using Symantec Endpoint Encryption Full Disk for the First Time
The PGP Desktop User Interface
Accessing the Encryption Features
PGP Desktop Main Window
Using the PGP Desktop Icon in the Menu Bar
Using the PGP Desktop Dock Icon
Viewing the PGP Log
Protecting Disks with Symantec Endpoint Encryption Full Disk
About PGP Desktop
Encrypting Boot Disks
Prepare Your Disk for Encryption
Supported Disk Types
Supported Keyboards
Ensure Disk Health Before Encryption
Calculate the Encryption Duration
Run a Pilot Test to Ensure Software Compatibility
Encrypting a Disk
Supported Characters
Encrypting the Disk
Encountering Disk Errors During Encryption
Using a Disk Encrypted with PGP Desktop
Authenticating at the PGP BootGuard Screen
If You Forgot Your User Name or Password
Maintaining the Security of Your Disk
Modifying the System Partition
Adding Other Users to an Encrypted Disk
Deleting Users From an Encrypted Disk
1
1
1
2
2
2
3
3
3
5
5
5
5
6
7
7
7
8
8
9
11
11
12
12
13
13
14
14
15
15
15
16
18
18
18
20
21
21
21
21
ii
Contents
Changing a User's Password
Re-Encrypting an Encrypted Disk
Accessing the Data on Removable Disks on Other Systems
Backing Up and Restoring
Using Automatic Backup Software on an Encrypted Disk
Working with Whole Disk Recovery Tokens
Recovering Data From an Encrypted Drive
Creating and Using Recovery Discs
Decrypting an Encrypted Disk
Special Security Precautions Taken by Symantec Endpoint Encryption Full Disk
Passphrase Erasure
Virtual Memory Protection
Memory Static Ion Migration Protection
Other Security Considerations
Technical Details About Encrypting Boot Disks
Index
22
22
23
23
23
23
24
24
25
26
26
26
26
26
27
29
1
About Symantec Endpoint Encryption
Full Disk
Symantec Endpoint Encryption Full Disk (SEE Full Disk) ensures that only authorized
users can access data stored on hard disks. This safeguards enterprises from the
accidental loss or theft of a laptop or computer and eliminates the legal need for public
disclosure. As a key component of Symantec Endpoint Encryption, SEE Full Disk offers
seamless deployment and operation across diverse IT infrastructures and
environments.
SEE Full Disk protects the data stored on your hard disk by encrypting it. To access the
data on your disk, you must authenticate during "pre-boot," or before the operating
system loads. Once your disk is encrypted, the encryption is transparent to you. You
can continue to work normally during and after the encryption of your hard disk.
SEE Full Disk includes a server and client installation. Mac OS X client for SEE Full Disk
is powered by PGP Desktop.
This document describes the Mac OS X client installation.
In This Chapter
Using this Guide .............................................................................................................. 1 Technical Support ........................................................................................................... 2 Using this Guide
This Guide provides information on configuring and using the components within
Symantec Endpoint Encryption Full Disk. Each chapter of the guide is devoted to one of
the components of Symantec Endpoint Encryption Full Disk.
Conventions Used in This Guide
Notes, Cautions, and Warnings are used in the following ways.
Notes: Notes are extra, but important, information. A Note calls your attention to
important aspects of the product. You will be able to use the product better if you
read the Notes.
Cautions: Cautions indicate the possibility of loss of data or a minor security breach.
A Caution tells you about a situation where problems could occur unless precautions
are taken. Pay attention to Cautions.
Warnings: Warnings indicate the possibility of significant data loss or a major
security breach. A Warning means serious problems are going to happen unless you
take the appropriate action. Please take Warnings very seriously.
2
About Symantec Endpoint Encryption Full Disk
Technical Support
Who Should Read This Document
This document is for anyone who is going to be using the Symantec Endpoint
Encryption Full Disk for Mac OS X software to protect their data.
Technical Support
Symantec Technical Support maintains support centers globally. Technical Support’s
primary role is to respond to specific queries about product features and functionality.
The Technical Support group also creates content for our online Knowledge Base. The
Technical Support group works collaboratively with the other functional areas within
Symantec to answer your questions in a timely fashion. For example, the Technical
Support group works with Product Engineering and Symantec Security Response to
provide alerting services and virus definition updates.
Symantec’s support offerings include the following:
•
A range of support options that give you the flexibility to select the right amount
of service for any size organization
•
Telephone and/or Web-based support that provides rapid response and
up-to-the-minute information
•
Upgrade assurance that delivers software upgrades
•
Global support purchased on a regional business hours or 24 hours a day, 7 days a
week basis
•
Premium service offerings that include Account Management Services
For information about Symantec’s support offerings, you can visit our Web site at the
following URL:
www.symantec.com/business/support/
All support services will be delivered in accordance with your support agreement and
the then-current enterprise technical support policy.
Contacting Technical Support
Customers with a current support agreement may access Technical Support
information at the following URL:
www.symantec.com/business/support/
Before contacting Technical Support, make sure you have satisfied the system
requirements that are listed in your product documentation. Also, you should be at the
computer on which the problem occurred, in case it is necessary to replicate the
problem.
When you contact Technical Support, please have the following information available:
•
Product release level
•
Hardware information
•
Available memory, disk space, and NIC information
About Symantec Endpoint Encryption Full Disk
Technical Support
• Operating system
• Version and patch level
• Network topology
• Router, gateway, and IP address information
• Problem description:
• Error messages and log files
• Troubleshooting that was performed before contacting Symantec
• Recent software configuration changes and network changes
Licensing and registration
If your Symantec product requires registration or a license key, access our technical
support Web page at the following URL:
www.symantec.com/business/support/
Customer service
Customer service information is available at the following URL:
www.symantec.com/business/support/
Customer Service is available to assist with non-technical questions, such as the
following types of issues:
• Questions regarding product licensing or serialization
• Product registration updates, such as address or name changes
• General product information (features, language availability, local dealers)
• Latest information about product updates and upgrades
• Information about upgrade assurance and support contracts
• Information about the Symantec Buying Programs
• Advice about Symantec's technical support options
• Nontechnical presales questions
• Issues that are related to CD-ROMs or manuals
Support agreement resources
If you want to contact Symantec regarding an existing support agreement, please
contact the support agreement administration team for your region as follows:
Asia-Pacific and Japan
[email protected]
Europe, Middle-East, Africa
[email protected]
North America, Latin America
[email protected]
3
2
Symantec Endpoint Encryption Full
Disk Basics
This section describes the Symantec Endpoint Encryption Full Disk terminology and
provides some high-level conceptual information on cryptography.
In This Chapter
Symantec Endpoint Encryption Full Disk Terminology ........................................... 5 Using Symantec Endpoint Encryption Full Disk for the First Time........................ 6 Symantec Endpoint Encryption Full Disk Terminology
To make the most of Symantec Endpoint Encryption Full Disk, you should be familiar
with the terms in the following sections.
Symantec Endpoint Encryption Full Disk Product Components
Symantec Endpoint Encryption Full Disk is a software tool that uses cryptography to
protect your data against unauthorized access. Symantec Endpoint Encryption Full
Disk is available for Mac OS X and Windows.
•
PGP Desktop: Symantec Endpoint Encryption Full Disk is powered by PGP
Desktop to encrypt your entire hard drive, including your boot record, thus
protecting all your files when you are not using them. Whole disk encrypted drives
are protected with a password that is used to authenticate to the system at
pre-boot. Once authenticated, the Mac OS X system boots as normal.
Terms Used in Symantec Endpoint Encryption Full Disk
Before you use Symantec Endpoint Encryption Full Disk, you should be familiar with
the following terms:
•
Authenticating: The process of entering your user name and password during
pre-boot. When you authenticate at the PGP BootGuard screen, your disk becomes
decrypted and the boot process continues normally.
•
Decrypting: The process of taking encrypted (scrambled) data and making it
meaningful again. When you receive data that has been encrypted by someone
using your public key, you use your private key to decrypt the data.
•
Encrypting: The process of scrambling data so that if an unauthorized person gets
access to it, they cannot do anything with it. The data is so scrambled, it’s
meaningless.
6
Symantec Endpoint Encryption Full Disk Basics
Using Symantec Endpoint Encryption Full Disk for the First Time
•
Conventional cryptography: Uses the same passphrase to encrypt and decrypt
data. Conventional cryptography is great for data that isn’t going anywhere
(because it encrypts and decrypts quickly).
•
Whole Disk Recovery Token (WDRT): A token that is created automatically when
your disk is encrypted. The token is sent to the SEE Management Server. If you
forget your password, you can contact your SEE Management Server
administrator and request the WDRT. The WDRT is then entered into the PGP
BootGuard screen in place of the user name/password combination that is
normally required. Once the WDRT is used, a new token is generated and sent to
the server.
Using Symantec Endpoint Encryption Full Disk for the First
Time
Symantec Corporation recommends the following procedure for getting started with
Symantec Endpoint Encryption Full Disk:
1
Install Symantec Endpoint Encryption Full Disk for Mac OS X on your computer.
If you are a corporate user, your administrator may have specific installation
instructions for you to follow or may have installed Symantec Endpoint
Encryption Full Disk for you. Either way, this is the first step.
2
Encrypt your disk.
If your administrator has not already done so, use PGP Desktop (installed when
you installed SEE FD) to encrypt your boot disk, external disk, or USB thumb drive.
All files on the disk are secured — encrypted and decrypted on the fly as you use
them. The process is completely transparent to you.
3
The PGP Desktop User Interface
This section describes the PGP Desktop user interface.
In This Chapter
Accessing the Encryption Features .............................................................................. 7 Viewing the PGP Log....................................................................................................... 9 Accessing the Encryption Features
The main ways to access the encryption features in PGP Desktop are:
• From the PGP Desktop Main Window (on page 7)
• Using the PGP Desktop Icon in the Menu Bar (on page 8)
• Using the PGP Desktop Dock Icon (on page 8)
PGP Desktop Main Window
The main screen is your primary interface to the product.
The Symantec Endpoint Encryption Full Disk main screen includes:
1
The Symantec Endpoint Encryption Full Disk Work area.
Displays information about, and actions you can take, for the
selected item.
2
The Toolbar. Provides access to display the PGP Log.
3
The PGP Disk item. Use this item to encrypt and decrypt your boot
disk and removable disks.
8
The PGP Desktop User Interface Accessing the Encryption Features Using the PGP Desktop Icon in the Menu Bar
One way to access many Symantec Endpoint Encryption Full Disk features is from the
PGP Desktop icon in the Menu Bar.
When you click the PGP Desktop icon in the Menu Bar, the PGP menu is displayed.
•
About PGP Desktop. Displays a window with information about the version of
PGP Desktop you are using, licensing information, and a list of the people who
helped create the application. This window also has a button that you can use to
uninstall PGP Desktop.
•
Help. Opens the PGP Desktop integrated online help.
•
Open PGP Desktop. Opens the PGP Desktop main screen.
•
Show Log. Displays the PGP Log. Use the log to see what actions PGP Desktop is
taking to secure your data.
•
Clear Log. Clears the PGP Log.
•
Update Policy. Manually downloads policy from the management server.
•
Quit. This command becomes available when you hold down the Option key before
clicking the PGP icon. This removes the PGP icon from the menu bar and causes
the background parts of PGP to quit.
To restart the background processes if the application is not running
1
Locate the PGP Desktop application on your system. The default location is in the
Applications folder.
2
Double-click the PGP Desktop application icon. PGP Desktop starts and its icon is
displayed in the Menu Bar.
Using the PGP Desktop Dock Icon
One way to access the features is from the PGP Dock icon.
Use the PGP icon in the Mac OS X Dock in any of these ways, then select an option from
the menu displayed:
•
Click the PGP Dock icon and hold the mouse button down.
•
Ctrl+click the Dock icon.
•
Right-click the Dock icon, if you are using a two-button mouse.
The PGP icon is displayed in the Dock when the application is open, or when you have
put the PGP icon into the Dock manually.
The PGP Desktop User Interface
Viewing the PGP Log
When you click and hold the PGP icon in the Dock when the application is already open
(or Ctrl+click it, or use the right mouse button if you are using a two-button mouse), a
menu is displayed giving you access to the following commands:
•
Any currently-open PGP windows. If PGP Desktop is currently running, any of its
windows that you have open appear at the top of this menu.
•
About PGP Desktop. Displays the About dialog box. The About dialog box displays
the PGP Desktop credits, what version you are currently using, and has a button
that you can use to uninstall the application.
The remaining menu items, in the lowest section of the menu, are standard Mac OS X
Dock items:
•
Remove from Dock/Keep in Dock. Removes or adds the Symantec Endpoint
Encryption Full Disk icon in the Dock.
•
Open at Login. Sets your Mac OS X Account System Preference so that Symantec
Endpoint Encryption Full Disk starts when you log on to your computer.
•
Show In Finder. Shows the location of the Symantec Endpoint Encryption Full
Disk application in a Finder window.
•
Hide. Hides any Symantec Endpoint Encryption Full Disk application screens.
•
Quit. Quits the Symantec Endpoint Encryption Full Disk application.
If you click and hold the PGP icon in the Dock when the application is not open, you see
the standard Mac OS X Dock items.
Viewing the PGP Log
Use the PGP Log to see what actions Symantec Endpoint Encryption Full Disk is taking
to secure your data.
To view the PGP log
1
2
Do one of the following:
•
Click the PGP icon in the Mac OS X menu bar and select Show Log.
•
In the PGP Desktop main window, click the log icon.
Do the following:
•
Click Clear to clear all of the entries in the PGP Log. To confirm you want to
clear the log entries, click Yes.
•
Click Find to search the entries in the PGP Log. Enter the search terms and
click Next.
•
Click the arrow for Logging level to select the minimum information level of
log entries you want to view: Info or Verbose. Note that Verbose can result
in large log files.
To view Verbose logs, the PGP Log view window must remain open. When you
close the window, the level of logging reverts back to the default level, Info.
Note that Verbose can result in some large log files.
9
10
The PGP Desktop User Interface
Viewing the PGP Log
•
3
Click Save to save a copy of the entries in the log. Specify a file name,
location, and format (the default is a plain text file) for the log file, then click
Save.
Click the red circle in the upper left corner of the window to close the PGP Log.
4
Protecting Disks with Symantec
Endpoint Encryption Full Disk
The PGP Desktop feature in Symantec Endpoint Encryption Full Disk encrypts and
locks down the entire contents of a laptop, desktop, external drive, or USB flash drive,
including boot sectors, system files, and swap files. Encryption runs as a background
process that is transparent to you, automatically protecting valuable data without
requiring you to take additional steps.
In This Chapter
About PGP Desktop .......................................................................................................11 Prepare Your Disk for Encryption ..............................................................................12 Encrypting a Disk ..........................................................................................................15 Using a Disk Encrypted with PGP Desktop ...............................................................18 About PGP Desktop
Use the disk encryption feature in PGP Desktop to fully encrypt the boot disk
(Intel-based Macintoshes only) and external disks on Mac OS X systems.
When you encrypt an entire disk using PGP Desktop, every sector is encrypted using a
symmetric key. This includes all files including operating system files, application files,
data files, swap files, free space, and temporary files.
On subsequent reboots, PGP Desktop prompts you for a user name and password. Then
the encrypted data is decrypted as you access it. Before any data is written to the disk,
PGP Desktop encrypts it. As long as you are authenticated to your PGP
Desktop-encrypted disk (after you have entered the correct user name and password at
the PGP BootGuard screen), the files are available. When you shut down your system,
the disk is protected against use by others.
Before encrypting your disk with PGP Desktop, it is important to understand the
process of creating and using a PGP Desktop-encrypted disk:
1
Perform the tasks to Prepare Your Disk for Encryption (on page 12).
2
Start the encryption process in Encrypting a Disk (on page 15).
3
Learn how to use an encrypted disk in Using a Disk Encrypted with PGP Desktop
(on page 18).
4
Learn how to maintain your encrypted disk in Maintaining the Security of Your
Disk (on page 21).
5
Learn how to decrypt the disk, if needed, in Decrypting an Encrypted Disk (on page
25).
6
Understand the features that help avoid security problems in Special Security
Precautions Taken by Symantec Endpoint Encryption Full Disk (on page 26).
12
Protecting Disks with Symantec Endpoint Encryption Full Disk
Prepare Your Disk for Encryption
Warning: Once you authenticate at PGP BootGuard, all files on your system are
available to you—as well as anyone else who can physically use your system. Your
files are decrypted until you encrypt them again by shutting down your computer.
Encrypting Boot Disks
Using PGP Desktop, you can fully encrypt the boot disk on an Intel-based Macintosh.
You can encrypt removable disks, and USB flash disks.
PGP Desktop supports both 32- and 64-bit Intel-based Mac OS X systems.
Note: The Mac OS X Safe Boot feature does not work on a boot disk that has been
whole disk encrypted; Safe Boot disables kernel extensions required by PGP Desktop.
If you hold down the Shift key after authenticating at the PGP BootGuard screen, the
system will not boot; however, it does restart after a few minutes.
Prepare Your Disk for Encryption
Before you encrypt your disk, there are a few tasks you must perform to ensure
successful initial encryption of the disk.
•
Determine whether your target disk is supported. See Supported Disk Types (on
page 13).
•
Make sure you use supported characters in your passphrase. See Supported
Characters (on page 15).
•
Ensure the health of the disk before you encrypt it. If PGP Desktop encounters
disk errors during encryption, it will pause encryption so you can repair the disk
errors. However, it is more efficient to repair errors before you initiate encryption.
See Ensure Disk Health Before Encryption (on page 14).
•
Back up the disk before you encrypt it. Before you encrypt your disk, be sure to
back it up so that you will not lose any data if your laptop or computer is lost,
stolen, or you are unable to decrypt the disk. Also be sure to make regular backups
of your disk.
•
Consider the time it will take to encrypt the disk and prepare accordingly. See
Calculate the Encryption Duration (on page 14).
•
Run a pilot test to ensure software compatibility. As a good security practice,
Symantec Corporation recommends testing PGP Desktop on a small group of
computers to ensure that PGP Desktop is not in conflict with any software on the
computer before rolling it out to a large number of computers. This is particularly
useful in environments that use a standardized Corporate Operating Environment
(COE) image. Certain other disk protection software is incompatible with PGP
Desktop and can cause serious disk problems, up to and including loss of data. See
Run a Pilot Test to Ensure Software Compatibility (on page 15) for known
interoperability issues, and review the Symantec Endpoint Encryption Full Disk
Release Notes for the latest updates to this list.
Protecting Disks with Symantec Endpoint Encryption Full Disk
Prepare Your Disk for Encryption
Supported Disk Types
PGP Desktop protects the contents of the following types of disks:
• Desktop or laptop disks, including solid-state drives.
Note: Do not use PGP Desktop to encrypt server hardware. PGP Desktop is not
supported on Mac OS X server hardware.
• External disks, excluding music devices and digital cameras.
• USB flash disks, sometimes called thumb drives.
There is no minimum or maximum size for a PGP Desktop-encrypted disk. If the disk is
supported by the operating system, it should work with Symantec Endpoint Encryption
Full Disk.
If you want to partition a drive that has been encrypted with PGP Desktop, you must
first decrypt the drive. After you have decrypted the drive, you may partition it.
PGP Desktop supports normal Sleep mode. Safe Sleep, or Hibernation, is not supported
and is automatically disabled.
Unsupported Disk Types
The following disk types are not supported:
• Disks formatted using the APM partition scheme.
• Any type of server hardware, including RAID disk drives.
• Diskettes and CD-RW/DVD-RWs.
Supported Keyboards
The PGP BootGuard log-in screen supports the following keyboard layouts:
• English (US-International)
• Japanese (Japan)
• German (Germany)
• German (Switzerland)
• French (France)
• French (Switzerland)
• Spanish (Latin America)
• Spanish (Spain; ISO)
Different keyboard layouts can have different mappings between characters,
potentially causing problems when you enter your passphrase to authenticate. Be sure
to specify the supported keyboard layout (in System Preferences > Personal >
International), and then make sure to use that same layout each time you authenticate.
13
14
Protecting Disks with Symantec Endpoint Encryption Full Disk
Prepare Your Disk for Encryption
Note: Not all keyboards are named the same in different languages. If selecting
"English (US-International)" does not work at PGP BootGuard, select "USA."
Ensure Disk Health Before Encryption
Symantec Corporation deliberately takes a conservative stance when encrypting drives,
to prevent loss of data. It is not uncommon to encounter Cyclic Redundancy Check
(CRC) errors while encrypting a hard disk. If PGP Desktop encounters a hard drive with
bad sectors, PGP Desktop will, by default, pause the encryption process. This pause
allows you to remedy the problem before continuing with the encryption process, thus
avoiding potential disk corruption and lost data.
To avoid disruption during encryption, Symantec Corporation recommends that you
start with a healthy disk by correcting any disk errors prior to encrypting.
Best Practices Recommendation
As a best practice, before you attempt to use PGP Desktop to encrypt your disk, use a
third-party scan disk utility that has the ability to perform a low-level integrity check
and repair any inconsistencies with the drive that could lead to CRC errors. These
software applications can correct errors that would otherwise disrupt encryption.
Apple Boot Camp is not supported in this version. If Apple Boot Camp is detected,
Symantec Endpoint Encryption Full Disk will not install.
Calculate the Encryption Duration
Encryption is a time-consuming and CPU-intensive process. The larger the disk being
encrypted, the longer the encryption process takes. You should consider this as you
schedule initial encryption of the disk.
Factors that may affect encryption speed include:
• the size of the disk
• the processor speed and number of processors
• the number of system processes running on the computer
• the number of other applications running on the system
• the amount of processor time those other applications require
With an average system, an 80 GB boot disk takes approximately three hours to encrypt
using PGP Desktop (when no other applications are running). A very fast system, on the
other hand, can easily encrypt such a disk in less than an hour.
You can still use your system during encryption. Your system is somewhat slower than
usual during the encryption process, although it is fully usable.
Symantec Endpoint Encryption Full Disk automatically slows the encryption process if
you are using the system. The encryption process is faster if you avoid using your
computer during the initial encryption. The system returns to normal operation when
the encryption process is complete.
Protecting Disks with Symantec Endpoint Encryption Full Disk
Encrypting a Disk
If you decide to run other applications during the encryption process, those
applications will probably run slightly slower than normal until the encryption process
is over.
Run a Pilot Test to Ensure Software Compatibility
As a good security practice, Symantec Corporation recommends testing PGP Desktop
on a small group of computers to ensure that PGP Desktop is not in conflict with any
software on the computer before rolling it out to a large number of computers.
Encrypting a Disk
Once you have prepared the disk, you can encrypt it. Note the following before you
begin:
•
Your system is somewhat slower than usual during the encryption process,
although it is fully usable. It returns to normal operation when the encryption
process is complete.
PGP Desktop automatically slows the encryption process if you are using the
system. The encryption process is faster if you avoid using your computer during
the initial encryption.
•
You can minimize or close PGP Desktop during encryption. This does not affect
the process, but it does improve the speed of the encryption process.
•
To stop the encryption process for a short time, click Stop, then click Pause on the
dialog box. Click Resume to restart. You may need to authenticate after you click
Resume.
•
To shut down the system before the encryption process is over, perform a normal
shutdown. You do not need to pause the process. When you restart, the encryption
process automatically resumes where it left off.
You can only encrypt, decrypt, or re-encrypt one disk at a time. Once you begin an
operation on a disk, you cannot start encrypting another one until the process is
complete on the first. You cannot circumvent this by pausing the first operation.
Supported Characters
PGP Desktop supports alphanumeric characters, punctuation characters, and standard
meta-characters when creating passphrases or passwords. Tab and control characters
are not supported. As you choose a passphrase or password, please note the following.
•
The following characters are supported:
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
0123456789
`~!@#$%^&*()_+={}\|:;[]'"<>,.?/­
Most extended ASCII characters (such as ç é è ê ë î ï ô û ù ü ÿ) or symbols
(such as ¢ ® œ), are supported.
15
16
Protecting Disks with Symantec Endpoint Encryption Full Disk
Encrypting a Disk
Encrypting the Disk
Before you encrypt your disk, be sure to back it up so that you will not lose any data if
your laptop or computer is lost, stolen, or you are unable to decrypt the disk.
Be sure that you are connected to the network and that all network resources are
available before you begin to encrypt a disk.
Caution: While your disk is encrypting, do not accept any operating system updates if
they are offered. If the update occurs automatically, do not restart your computer
until the encryption process has completed.
To protect a disk using PGP Desktop
1
Open PGP Desktop.
2
Click Encrypt Whole Disk. The Encrypt Whole Disk screen is displayed, showing a
listing of disks on your system that can be protected.
3
From the Select a disk list, click the disk you want to protect and click Continue.
4
In the Add PGP Whole Disk User dialog box, do the following:
•
For User Name, type a name (or accept the default name). This will be the
user name you will enter when you access the PGP BootGuard screen to
authenticate to the system. The user name is case-sensitive (for example, if
you create a user name "Alice Cameron," then you cannot authenticate using
"alice cameron.")
•
Enter your Password, and then re-enter it for Confirm Password.
Your Symantec Endpoint Encryption Full Disk administrator may have defined
certain password requirements. As you enter the password, the items listed at
the bottom of the dialog box will be checked off (with a green check mark) as
you meet the requirement. Note that while many characters are supported
when creating a passphrase, your administrator may not allow certain
characters to be used.
Protecting Disks with Symantec Endpoint Encryption Full Disk
Encrypting a Disk
•
5
Click Continue. Note that if you do not meet the minimum password
requirements, an error is displayed and you are returned to the Add PGP
Whole Disk User dialog box to correct the problem.
In the PGP Desktop Summary screen, review the summary of how your disk is
going to be encrypted, what key is used, and so on.
•
If you want to enable Power Failure Safety, select the check box.
While you can pause the initial encryption process at any time by properly
shutting down or restarting your computer, it is exceptionally important to
avoid unexpected shutdowns (power failures, power cord gets pulled out, and
so on). If this is a possibility for you—or if you do not have an uninterruptible
power supply for your computer—consider choosing the Power Failure Safety
option. When Power Failure Safety is selected, encrypting is journaled; if the
power fails, the encryption process can safely and accurately resume where it
was interrupted. However, this option can cause initial encryption to take
several times longer to complete.
This option is also useful when encrypting USB devices. Interrupting
encryption by removing a USB device during encryption can corrupt the device
and require that it be reformatted. Encrypting with Power Failure Safety
allows you to remove the USB device during encryption and resume encryption
once it is reinserted.
6
Click Encrypt. The encryption process begins and the Encryption Progress screen
is displayed.
7
Click Close. The Symantec Endpoint Encryption Full Disk screen is displayed; the
encryption process continues in the background. A progress bar shows how the
encryption process is progressing.
Note: The encryption process continues even if you close the Encryption
Progress screen. However, you can not see the progress bar until you close this
screen.
8
During the encryption process, you can do the following:
•
To temporarily stop the encryption process, click Stop. The Encryption is not
complete dialog box is displayed.
•
Pause the encryption process, Decrypt the portion of the disk that is already
encrypted, or Cancel to close the dialog box and continue with the
encryption process.
Note: If the encryption process stops and PGP Desktop indicates a disk
read/write error, it means that bad sectors have been encountered on your disk
during the encryption process. Immediately reverse the encryption process by
decrypting the portion of the disk that has been encrypted. Then use your disk
verification tools to find and resolve the problem.
When the encryption process completes, the disk properties for the encrypted disk are
displayed and include the description, type of disk, size, encrypted status, and the user
access information. An additional "administrator" user is also created if you are
encrypting the boot disk. This user can be used by your Symantec Endpoint Encryption
Full Disk administrator to access your disk, if necessary.
17
18
Protecting Disks with Symantec Endpoint Encryption Full Disk
Using a Disk Encrypted with PGP Desktop
Encountering Disk Errors During Encryption
Many hard disks have bad sectors. If PGP Desktop encounters bad disk sectors during
encryption, encryption pauses and you are warned that of the disk errors. (Note that
these errors are unrelated to encryption; they are an indication that your hard disk
needs maintenance.)
You can do one of the following:
•
Force encryption to continue by clicking Yes. Disk errors are frequently
encountered and often harmless. Clicking Yes will continue the encryption
process and PGP Desktop ignores further errors.
•
Stop encryption by clicking No, completely decrypt the disk, and then repair the
disk errors using a disk utility tool before making another attempt to encrypt the
disk. If you know that your disk has many bad sectors, you should immediately
perform the maintenance that your hard disk needs before encrypting the disk.
Using a Disk Encrypted with PGP Desktop
Your computer boots up in a different way once you use PGP Desktop to protect the
boot disk—or a secondary fixed disk—on your system. On power-up, the first thing you
see is the PGP BootGuard log-in screen asking for your user name and password. When
you successfully enter valid log-in information, PGP Desktop then decrypts the disk.
When you use a PGP Desktop-encrypted disk, it is decrypted and opened automatically
as needed. After the disk is completely encrypted, there is no noticeable slowdown of
your activities.
Once you authenticate at PGP BootGuard, all files on your system are available to
you—as well as anyone else who can physically use your system. Your files are
decrypted until you encrypt them again by shutting down your computer.
When you shut down a system with an encrypted boot disk, or if you remove an
encrypted removable disk from the system, all files on the disk remain encrypted and
fully protected—data is never written to the disk in an unencrypted form. Proper
authentication is required to make the files accessible again.
Authenticating at the PGP BootGuard Screen
The PGP BootGuard log-in screen prompts you for the proper authentication for a
protected disk for one of two reasons:
•
If your boot disk is protected using PGP Desktop, you must authenticate correctly
for your system to start up. This is required because the operating system files
that control system startup are encrypted, and must be decrypted before they can
be used to start up the system.
Protecting Disks with Symantec Endpoint Encryption Full Disk
Using a Disk Encrypted with PGP Desktop
•
If a secondary fixed disk is protected using PGP Desktop, you can authenticate at
startup so that you do not have to authenticate later when you need to use files on
the secondary disk. Because the files on the secondary (non-boot) disk are not
required for startup, you are not required to authenticate at startup. You can use
the Bypass feature to skip authentication at startup. You are then asked to
authenticate later, when you try to use files on the secondary disk.
Note: The PGP BootGuard log-in screen accepts the authentication information from
any user configured for an encrypted disk. For example, if you have two users
configured for a boot disk and two different users configured for a secondary fixed
disk on the same system, any of the four configured users can authenticate on the
PGP BootGuard log-in screen at startup, even the two users configured on the
secondary disk.
On the PGP BootGuard log-in screen you can authenticate an encrypted boot or
secondary disk on the system.
To authenticate using the PGP BootGuard log-in screen
1
Start or restart the system that has a disk protected by PGP Desktop. On startup,
the Symantec Endpoint Encryption Full Disk welcome screen is displayed. Press
Cmd+Return to continue.
2
In the PGP BootGuard log-in screen, enter a valid user name and password and
press Return. The user name is case-sensitive (for example, if you created a user
name "Alice Cameron," then you cannot authenticate using "alice cameron.")
Note: Some characters cannot be entered at the PGP BootGuard screen. See
Supported Characters (on page 15).
•
If you make a typing error, or think you might have made a typing error,
press Backspace to clear all characters and start again.
•
To change the keyboard layout, press F2 and select the keyboard from the
list displayed.
•
To see the password characters as you type them, press F3.
•
If you have forgotten your passphrase and need to enter the Whole Disk
Recovery Token (WDRT), press F4. For more information on the WDRT, see
Working with Whole Disk Recovery Tokens (on page 23).
•
To restart your computer, press Esc.
19
20
Protecting Disks with Symantec Endpoint Encryption Full Disk
Using a Disk Encrypted with PGP Desktop When you have correctly authenticated at the PGP BootGuard screen, the system
continues to boot into the Mac OS X operating system.
If You Forgot Your User Name or Password
If you have forgotten your password, you can use the Whole Disk Recovery Token
(WDRT) to authenticate at the PGP BootGuard screen. The WDRT is a one-time-use
token.
To use the WDRT
1
Contact your Symantec Endpoint Encryption Full Disk administrator to obtain the
WDRT.
2
At the PGP BootGuard screen, press F4.
3
In the screen that is displayed, read the unique identifier displayed in the UUID
field to your administrator. Your administrator looks up your system to obtain the
WDRT.
4
Enter the Token exactly as provided by your administrator, and press Enter.
Tip: To return to the previous screen, press Esc.
5
When you have used the WDRT, after you log in to the system you are prompted to
enter a new user name. Do one of the following:
•
To keep the same user, enter the user name that you used before, and enter a
new password. Your password is changed but your user name stays the same.
•
To create a new user, enter a new user name and password. The new user is
created, and the old user remains on the disk.
Maintaining the Security of Your Disk
Modifying the System Partition
Maintaining the Security of Your Disk
The following sections describe how to work with your disk once you have encrypted it
with PGP Desktop.
Modifying the System Partition
Do not make any changes to the system partition on a boot disk that has been encrypted
by PGP Desktop; it will fail to boot properly on the next startup. If you must make
changes to the partitioning of an encrypted disk, decrypt the disk first and then make
the partition changes.
Adding Other Users to an Encrypted Disk
The user who creates an encrypted disk can make it available to others. These
additional users can access the encrypted disk using their own unique password. You
can have up to 120 users per encrypted disk, including the "administrator" user that is
automatically added when encrypting a boot disk.
Caution: Having multiple users who can access a disk protected by PGP Desktop
serves as a backup in case one person forgets their password. Users configured for an
encrypted disk can authenticate at the PGP BootGuard log-in screen to unlock any
protected disk on that system.
To add additional users to an encrypted disk
1
Open PGP Desktop and select the encrypted disk to which you want to add another
user.
2
In the User Access list, right-click and select Add User. You can also click the plus
sign below the list.
3
Enter a user name and a password for the user you want to add, confirm the user's
password, and click OK.
4
When prompted for your password, enter the password and click OK.
Deleting Users From an Encrypted Disk
At some point you may want to remove the ability of a user to access an encrypted disk.
To remove a user from an encrypted disk
1
Open PGP Desktop and select the encrypted disk from which you want to delete
the user.
21
22
Maintaining the Security of Your Disk
Changing a User's Password
2
In the User Access list, right-click the name of the user you want to delete and
select Remove User.
3
Enter the password of the encrypted disk, then click OK.
Note: You cannot remove all users from an encrypted disk; when only one user is
listed in the User Access list, you cannot remove that user.
Changing a User's Password
You may find it necessary to change your password, for example if your organization's
security policy requires that it be changed on a regular basis.
To change the password of a user on an encrypted disk
1
Open PGP Desktop and select the encrypted disk with the user whose password
you want to change.
2
From the User Access list, right-click the name of the user whose password you
want to change and select Change User Password.
3
Enter the passphrase of the encrypted disk, then click OK.
4
In the Confirm PGP Password dialog box, enter and confirm the new password,
then click OK.
5
In the Password Changed dialog box, click OK.
Re-Encrypting an Encrypted Disk
Consider re-encrypting a protected disk that you suspect of having a password or
passphrase that has been compromised.
To re-encrypt a disk, the PGP Desktop feature uses the same encryption algorithm (AES
256)—but a different underlying encryption key—to encrypt the disk again. The result is
as if you decrypted the disk and encrypted it again, but much faster.
To re-encrypt an encrypted disk
1
Open PGP Desktop and select the disk you want to re-encrypt.
2
Select Disk > Re-Encrypt Disk.
3
Enter the password or passphrase of the encrypted disk, then click OK. The
re-encryption process begins.
Maintaining the Security of Your Disk
Accessing the Data on Removable Disks on Other Systems
Accessing the Data on Removable Disks on Other Systems
If you use Symantec Endpoint Encryption Full Disk for Mac OS X to protect a removable
disk—a USB flash disk, for example—you can move that disk to another system and
access the encrypted files on that flash disk on the other system. The system must have
Symantec Endpoint Encryption Full Disk for Mac OS X installed or PGP Desktop version
10.1 installed (for Windows or Mac OS X).
You must be able to authenticate to access the contents of the disk.
Backing Up and Restoring
While most modern backup programs have no problem backing up the data on a PGP
Desktop-encrypted disk, some other backup programs do have problems with it. These
other backup programs fail when they encounter the file PGPWDE01, a file used by PGP
Desktop. The solution is to have these programs exclude PGPWDE01 from the backup
(most backup programs let you exclude individual files). Once you get your backups
working again with these programs, it is a good idea to test the backup to make sure it
works.
Using Automatic Backup Software on an Encrypted Disk
You can automatically back up any disk this is protected with PGP Desktop. Files the
software backs up will be decrypted before being backed up.
For example, backups made using Time Machine, the automatic backup software built
into Mac OS X 10.5 (Leopard), are made normally, and the files in the backup are not
encrypted.
Note: Data recovery software (such as the Mac OS X version of Boomerang Data
Recovery) attempts to recover data from a hard drive that is not currently accessible.
If data recovery software is used on a disk that is protected with PGP Desktop, it will
find encrypted data that is not in a usable form.
Working with Whole Disk Recovery Tokens
Symantec Endpoint Encryption Full Disk creates a recovery token whenever you
encrypt a disk or removable disk with PGP Desktop. This recovery token can be used to
access the disk in case you have forgotten your user name or password.
This recovery token is automatically sent to the Symantec Endpoint Encryption Full
Disk server managing security for the disk protected by PGP Desktop.
If you have forgotten your user name or password, contact your Symantec Endpoint
Encryption Full Disk administrator to obtain the recovery token. To use a recovery
token at the PGP BootGuard screen, see If You Forgot Your User Name or Password (on
page 20).
23
24
Maintaining the Security of Your Disk
Recovering Data From an Encrypted Drive
The recovery token can be used only once to gain access to a disk that has been
protected using PGP Desktop. After a recovery token is used, a new one is generated
automatically and sent to the Symantec Endpoint Encryption Full Disk server. The
Symantec Endpoint Encryption Full Disk user is given the option of creating a new user,
or keeping the existing one(s) on the disk.
Note that the recovery token is used only to gain access to an encrypted disk. You
cannot use the recovery token to encrypt or decrypt data.
Caution: Consider re-encrypting disks protected by PGP Desktop if security is
compromised, by password exposure for example. This process re-encrypts the disk
with the same encryption algorithm, but with a different underlying encryption key.
The result is as if you decrypted the disk or partition and encrypted it again, but is
much faster.
Recovering Data From an Encrypted Drive
Although rare, you may find it necessary to recover data from an encrypted drive that
has been damaged or corrupted. Or, you may find that you do not have the login
information in order to access a drive (such as a former employee's encrypted drive).
In these cases, there are several things you can do:
1
Use a recovery disk. If a recovery disk was created before the disk or partition was
encrypted, you can use it to decrypt the disk. For more information, see Creating
and Using Recovery Disks (see "Creating and Using Recovery Discs" on page 24).
2
Use another system to decrypt the drive. If your Macintosh has a FireWire port
and supports FireWire Target Disk Mode, you can connect your Macintosh to
another system that has Symantec Endpoint Encryption Full Disk or PGP Desktop
for Mac OS X installed on it.
3
Use the Whole Disk Recovery Token. Use the Whole Disk Recovery Token. The
recovery token is created automatically when the disk is encrypted. For more
information, see Working with Whole Disk Recovery Tokens (on page 23).
For more information on how to recover data, or use target disk mode, see the
Symantec Knowledge Base at www.symantec.com/business/support/.
Creating and Using Recovery Discs
While the chances are extremely low that a boot.efi file could become corrupt on a boot
disk or partition protected by PGP Desktop, it is possible. If this occurs, it could prevent
your system from booting. Prepare for this unlikely event by creating a recovery CD
before you encrypt a boot disk or partition using Symantec Endpoint Encryption Full
Disk.
Caution: Note that recovery discs work only with the version of Symantec Endpoint
Encryption Full Disk that created the recovery disk. Using a recovery disc that is not
intended for the version you are using will make the disk inoperable.
This section includes procedures for creating a recovery compact disc. It also discusses
their use.
Maintaining the Security of Your Disk
Decrypting an Encrypted Disk
To create a recovery CD
1
Save the recovery iso image to your system. The recovery iso was included in the
Symantec Endpoint Encryption Full Disk download package.
2
Burn the image to a CD-ROM using the Mac OS X Disk Utility. For information on
how to do this, see the Apple Support article HT2087
(http://support.apple.com/kb/HT2087).
3
Remove the recovery CD from the drive and label it appropriately.
To use a recovery disc or diskette
Caution: Once you have started to decrypt a disk or partition using a recovery disc or
diskette, do not stop the decryption process. Depending on the size of the disk being
decrypted, this process can take a long time. A faster way to decrypt the drive is to
use another system that has the same version of Symantec Endpoint Encryption Full
Disk installed on it. For more information, see Decrypting an Encrypted Disk (on page
25).
1
Boot the Macintosh system with the disc. To boot with the disc, hold down the
Option key when rebooting the system and select the option to boot from the
recovery disc. The PGP BootGuard screen is displayed.
2
Enter your user name and password when prompted and press Enter.
3
To decrypt the disk, press D then press Enter.
Decrypting an Encrypted Disk
As a best practice, if you need to perform any disk recovery activities on a disk
protected with PGP Desktop, Symantec Corporation recommends that you first decrypt
the disk. Decrypt a disk by doing one of the following:
•
Use the Disk > Decrypt option in PGP Desktop (see the following procedure for
information on how to use this option to decrypt a disk).
•
Connect a removable disk to a second system and decrypt from that system's
software. If the removable disk is formatted as a FAT drive, you can decrypt it
using PGP Desktop version 10.1 for Windows or Mac OS X, or Symantec Endpoint
Encryption Full Disk 8.2 for Mac OS X. If the disk is formatted as an HFS drive, you
must use Symantec Endpoint Encryption Full Disk for Mac OS X.
Once the disk is decrypted, proceed with your recovery activities.
To decrypt a disk
1
Open PGP Desktop, and select Disk > Decrypt.
2
Enter the password to unlock the disk and click OK.
The time it will take to decrypt the disk is displayed in the PGP Desktop window.
To pause or cancel the decryption process, click Stop.
25
26
Maintaining the Security of Your Disk
Special Security Precautions Taken by Symantec Endpoint Encryption Full Disk
Special Security Precautions Taken by Symantec Endpoint
Encryption Full Disk
Symantec Endpoint Encryption Full Disk has features that help avoid security problems
when you use PGP Desktop.
Passphrase Erasure
When you enter a password, PGP Desktop uses it only for a brief time, then erases it
from memory. PGP Desktop also avoids making copies of the password. The result is
that your password typically remains in memory for only a fraction of a second.
Without this critically important feature, someone could search for your password in
your computer memory while you were away from the system. You would not know it,
but they would then have full access to data protected by this password.
Virtual Memory Protection
Your password could be written to disk as part of the virtual memory system swapping
memory to disk. PGP Desktop takes care that the password is never written to disk. This
feature prevents a potential intruder from scanning the virtual memory file looking for
password.
Memory Static Ion Migration Protection
When you protect a disk with PGP Desktop, your password is turned into a key. This key
is used to encrypt and decrypt the data on the encrypted disk or partition. While the
password is erased from memory immediately, the key (from which your password
cannot be derived) remains in memory.
This key is protected from virtual memory; however, if a certain section of memory
stores the exact same data for extremely long periods of time without being turned off
or reset, that memory tends to retain a static charge, which could be read by attackers.
If your encrypted disk is decrypted for long periods, over time, detectable traces of your
key could be retained in memory. Devices exist that could recover the key. You won’t
find such devices at your neighborhood electronics shop, but major governments are
likely to have a few.
PGP Desktop protects against this by keeping two copies of the key in RAM, one normal
copy and one bit-inverted copy, and inverting both copies every few seconds.
Other Security Considerations
In general, the ability to protect your data depends on the precautions you take, and no
encryption program can protect you from sloppy security practices. For instance, if you
leave your computer on with sensitive files open when you leave your desk, anyone can
access that information—even if the disk is protected using PGP Whole Disk Encryption.
Here are some tips for maintaining optimal security:
Maintaining the Security of Your Disk
Technical Details About Encrypting Boot Disks
•
When you are away from your desk, use a screen saver with a password to deter
others from accessing your computer or viewing your screen.
•
Make sure that your encrypted disks are not available to other computers on a
network. You may need to arrange this with the network management staff within
your organization. Once you have decrypted your disk, PGP Whole Disk
Encryption can no longer protect the files. They can be seen by anyone with
network access to them.
•
Never write down your password. Pick something you can remember. If you have
trouble remembering your password, use something to jog your memory, such as a
poster, a song, a poem, or a joke—just do not write it down.
•
If you use Symantec Endpoint Encryption Full Disk and share your computer with
other people, they will probably be able to see your open files on a disk that is
protected using PGP Whole Disk Encryption. As long as you shut down a system
with a whole disk encrypted disk, or if you remove an encrypted removable disk
from the system, all files on the disk or partition remain encrypted and fully
protected.
•
When you leave your computer for any length of time, Symantec Corporation
recommends that you shut down your Macintosh system, rather than putting the
system to Sleep. This ensures that no one can access your encrypted system when
returned from Sleep mode.
Technical Details About Encrypting Boot Disks
To support the encryption of boot disks on Mac OS X, Symantec Endpoint Encryption
Full Disk creates a new partition (using GUID Partition Table) and puts a new boot
loader onto the new partition. PGP Desktop uses the GUID Partition Table (GPT)
partitioning method.
The boot loader that is installed by Symantec Endpoint Encryption Full Disk does
several things: it authenticates users attempting to boot the disk and (when
authentication is successful) it calls the Mac OS X boot loader and decrypts the files
needed for normal booting of the disk. If authentication is not successful, it does not
call the Mac OS X boot loader or decrypt the necessary files, and thus the disk does not
boot.
27
Index
B
boot disks, encrypting • 12, 27 BootGuard • See PGP BootGuard screen C
characters, supported • 15 characters, supported in PGP WDE • 15 D
decrypting • 25 deleting • 21 disk read/write error • 15 disk types, supported • 13 disks encrypting • 15 dock icon • 8, See PGP Dock icon E
encrypt • 12, 15
encryption calculate duration of in PGP WDE • 14 pilot test • 15 re-encrypting disk or partition • 22 encryption disk read/write error • 15 F
basic steps for using • 6 described • 1, 5, 11 dock icon, using • 8 icon in Menu Bar • 8 main screen • 7 PGP Dock icon • 8 PGP Whole Disk Encryption adding users • 21 automatic backup software • 23 backing up encrypted disks • 23 changing a passphrase • 22 decrypting a disk • 25 decrypting an encrypted disk • 25 deleting users • 21 disk read/write error • 15, 18
disk types, supported • 13 disk, maintaining security of • 21 encrypting a disk • 12, 15 encryption duration, calculating • 14 prepare disk for • 12 preparing to encrypt • 12 recovery disc • 24 recovery tokens • 20, 23 re-encrypting • 22 re-encrypting an encrypted disk • 22 removable drives • 23 security precautions • 26 R
keyboard, supported in PGP WDE • 13 keyboards, supported • 13 read/write error • 15 recovering data, encrypted disks • 24 recovery tokens, for whole disk • 20, 23 re-encrypting • 22 re-encrypting a disk • 22 removable disks • 23 L
S
log, messaging • 9 support, contacting • 2 system partition, modifying • 21 forgotten passphrase • 20 K
M
Menu Bar icon • 8 P
partitions, encrypting • 21 passphrases supported characters in PGP WDE • 15 password • 15, 20 PGP BootGuard screen • 15, 18 PGP Desktop • 7 T
technical support • 2 terminology • 5 U
user names • 16, 18, 20 users • 21, 22 W
whole disk recovery tokens • 20, 23 ">