Windows – Mounting truecrypt system partition copied to USB drive

If you use Windows' Encrypted File System you can Encrypt your sensitive document folders, however BE SURE TO BACKUP THE DECRYPTION CERTIFICATE and store it on something outside of the computer (a USB key or other computer). There is a very good reason it is called the Delayed Recycling Bin, if you do not backup the certificate and your password is not changed using the normal change password methods (type in the old one, type in the new one twice) you will never be able to get to the files.

If you re-install windows (even if you use the same username and password) you will need the backup of the cert to get your files back, if you did not backup the cert before doing the re-install THERE WILL BE NO WAY FOR YOU TO GET YOUR FILES BACK).

I use the all caps-bold because I know you will think "I am careful, I will never need it" DO IT ANYWAY!!!

Fix for Hosts File Issue:
You can fix the Hosts file issue by using windows Automatic Proxy settings. Create a .pac file, encrypt it using EFS, then tell your web browser to use the auto-config settings from the file.

Here is a example of what to put in the file

function FindProxyForURL(url, host)
{
    if (0
    || dnsDomainIs(host, ".cn")
    || dnsDomainIs(host, ".doubleclick.com")
    || dnsDomainIs(host, ".doubleclick.net")
    || shExpMatch(host, "205.180.85.*")
    || shExpMatch(host, "66.40.16.*")
    || (dnsDomainIs(host, ".overstock.com") && shExpMatch(url, "*/linkshare/*"))
    || (dnsDomainIs(host, ".amazonaws.com") && shExpMatch(url, "*/udm_img/mid*"))
    || dnsDomainIs(host, ".gator.com")
    ) {
        return "PROXY 127.0.0.1:80";
    }
    else
    {
    return "DIRECT";
    }
}

The example is fairly self explanatory. it will redirect all of those listed items to localhost port 80.

Original Answer, talking about TrueCrypt and TPM. No longer my recommended solution

What you want is possible through a TPM, but TrueCrypt does not support a TPM. If the hash was not stored in hardware tied to a computer how would the drive know that it was in a different computer and happily auto-decrypt the data?

Also you need to ask your self, what are you protecting your self against. Pre-boot encryption only protects you from some very specific things:

• someone waling up to your computer and start using it from a powered down state
• taking the drive out of the computer and using it on another computer, or copying the drive then replacing your drive back.
• A OS running on a non encrypted portion seeing the shutdown OS in the encrypted portion.

What it does not do is protect you from someone using seeing/copying your files if the OS is already running (think virus/sister snooping around).

Remember:Once you are inside the encrypted envelope everything looks like normal unencrypted data to the OS and anyone using the OS. Explain what you are trying to protect, and who you are trying to protect it from and we may be able to give you a better solution.

EDIT: when you say I just want to make it a little harder to be able to browse through my files who are you trying to make it harder for and in what way are they going to be performing the browsing?