My laptop has a 500 GB system SSD encrypted with VeraCrypt using AES-256, but I recently added a 2 TB SSD for programs and games. I would like both drives to remain encrypted and ideally unlock automatically with one password when the computer starts. VeraCrypt only seems to offer boot-time system encryption for the drive containing Windows. Is there a way to encrypt both SSDs as a single setup, unlock them at the same time, or customize the password prompts? I'm using Windows Home, so BitLocker may not be available.
2 Answers
You may be able to configure the second encrypted volume to mount more easily after startup, but be careful about storing passwords or keyfiles in a way that defeats the security goal. Also keep reliable backups before changing disk encryption. Full-disk encryption protects a stolen drive while it is powered off; once the computer is unlocked, an attacker or malware running in the operating system may still be able to access mounted volumes.
VeraCrypt system encryption normally protects the Windows boot drive. The second SSD can still be encrypted separately as a VeraCrypt volume, but it generally won’t be part of the same pre-boot system-encryption process. After Windows starts, you can mount the second drive with its own password. VeraCrypt also supports saved volume configurations and keyfiles, which can make mounting additional volumes more convenient, but that isn’t the same as encrypting both physical disks as one boot volume.
So the practical setup would be system encryption on the Windows SSD and a separate encrypted volume on the 2 TB SSD, with the second one mounted after logging in?
If the goal is simply protecting games, school files, and virtual machines from someone removing the SSD, a separately encrypted data volume should be enough. It doesn’t need to be combined with the Windows drive.