BestCrypt Control Panel is a central BestCrypt user interaction application. It allows to perform container operations and management (adding, changing and removing passwords for example) as well some advanced operations.
The following sections describe BestCrypt Control Panel functions grouped together by the task they perform starting with the general overview of the main Control Panel window.
BestCrypt Control Panel window is divided into the toolbar and a number of control sections. Lets take a closer look at the main window:
Control Panel toolbar provides a set of items to access main BestCrypt functions. Some of the functions apply only to selected container. The default set of toolbar items is as follows:
The leftmost area of the control panel main window is called My Container list. Each element in the list corresponds to each container file known to be located on your system. There are several ways to get one's containers to the list:
By left-clicking any container in the list its information and preferences will be displayed on the right pane of the control panel. Container's preferences can also be changed here.
This section displays basic information about currently selected container:
This section allows to modify mounting behaviour for the container selected. All following options specify default behaviour that can be changed for each particular mount request in container mount dialog.
Containers' operations are grouped under easily accessible menus on the taskbar. Each of these groups is discussed separetely in the following sections of this guide, each group brief description is as follows:
To create new BestCrypt container click Create on the welcome screen or on the toolbar. The following dialog will appear to guide you through the process:
After you have set all preferred properties of your new container click Create. Choose a location and a name for your new container file in popup sheet dialog and provide an initial password for it.
The new container will be added to My containers list with
its properties displayed on the right pane
Although created with only one initial password many more can be assigned to each container. Total number of additional passwords depends on container file format version and password type but for default setting is limited to 64 entries total including any hidden part passwords.
BestCrypt allows you to add, change and remove passwords for existing containers and hidden parts:
There is a pattern how password management works for different volume types (main or hidden). All password management operations will first ask you to enter existing container password. If that password is for main password then, for example, newly added password will be added for main part and the other way around for each possible hidden part.
Any symbols are accepted as a new password. That is anything you can type on your keyboard is a valid password symbol. However due to security consideration the minimum password length is always at least 8 symbols. Maximum size is restricted to 256 symbols.
All container passwords should be unique. This includes passwords for main part and all possible hidden parts. For example, if you are adding a new password for your hidden part but the same password is already used for main part then this new password is considered a duplicate and will be rejected.
BestCrypt generates and securely stores a set of encryption keys. Each correct container password is used to decode those keys and setup a virtual encrypted disk. All data needed to check each password and decode encryption keys is stored in a special section of the container file that you can back up and safely store in a separate file without copying entire container file with all its encrypted data inside.
BestCrypt allows you to create these key data backup files with the ".kbb" extension by default, restore previous container state from them and use them to mount your container. You can use these functions just as you would use most other control panel functions: from the Backup menu in selected container view:
To use key data backups effectively there is a key point to understand: backup file contains a copy of all information about container encryption keys and passwords. This is of course stored in a secure way but the point is that by creating a backup file you create a snapshot of all passwords and encryption keys used for this container. Keep that in mind when you restore key data backup or mount a container using it because in the former case the previous snapshot of all container passwords is restored and in the latter case you are authenticating against this previous snapshot.
You can use this to your advantage by backing up all container passwords in separate backup file to safely store it on a remote device and erase or encrypt this very same information in actual container file. This way the only means to mount such a container is by providing a key data backup file stored separetly.
BestCrypt provides many advanced functions to keep your data safe. However many of these functions require some familiarity with concepts they represent. They are easy to learn and will provide you with a better level of understanding to perform these operations correctly and effectively and employ them to your maximum advantage.
As always you can easily find all advanced functionality in the Advanced menu on the toolbar:
Let us describe each operation in more detail
Reencryption is a powerful feature, when used with caution. See the description of how the reencryption works in this guide.
When you choose to reencrypt your container you will be greeted by the reencryption dialog shown below:
Reencrypt button starts the process. As described above all existing passwords and hidden parts will be lost from this point and BestCrypt will ask you for your new initial container password. It can take some time to reencrypt entire container file and a progress indicator will show up to report the current progress of the operation.
You can interrupt the running process by pressing the Cancel button. However, as explained above, reencryption cannot really be cancelled - only paused. If you really want to interrupt the process or if a power failure has occured you can resume reencryption later easily by selecting this container and using the same menu command you used to start the process before. You will be greeted with the same reencryption dialog showing you where it was interrupted and resume from this point forward.
BestCrypt container file consists of two different types of data:
Therefore BestCrypt container file has a well known structure that can be easily identified on your computer. Sometimes it is unacceptable for anyone to know and prove that you have a BestCrypt container file without actually knowing its password or even asking for it. Header encryption exists to avoid exactly this kind of threat.
Operation encrypts this well known container header to make it look like random garbage and entire container file becomes absolutely indistinguishable from noise and does not have any known structure anymore. Nobody can then unambiguously prove that this file is a BestCrypt container.
However it also means that even BestCrypt itself will not be able to identify this file as a container. Therefore when you encrypt container header and select it in My container list, BestCrypt will not be able to display any information about it. Take a look at the example on the screenshot below. Here we have selected a container with an encrypted header:
You can see a red warning text where container description should be and most general information and users table set to undefined values. However, you can still use this container as always and it will still support all operations. All you need to do is provide a correct password and everything will work as usual.
To further reinforce your privacy Control Panel also treats these containers differently to remove any traces of their usage. For example, when you add this container using Locate it will be removed from container list when you close Control Panel to hide the fact that you even tried to use this file filled with seemingly random data as a BestCrypt container.
To decrypt container header and make it again visible to BestCrypt use the same menu entry only this time it will be called "Decrypt header".
All encrypted data stored inside container looks like a random garbage until correct encryption key is provided to properly read it. BestCrypt takes care of all this for you and only asks you for a password. However there can be more than one correct interpretation of this encrypted noise provided you know beforehand where to look for it and have the correct encryption key. And that is the best part - when all your data looks like random garbage nobody can prove that you have more than one interpretation of it in another subset of data hidden amongst this random noise.
This is precisely what the hidden part is - a secret subset of encrypted data hidden inside existing encrypted (or random) data that can be made sense out of only if you know where to look and have the correct password. Nobody else can prove it really exists and force you to submit any passwords for it.
In cryptography this is something called "Plausible deniability" or "Deniable encryption" and is best explained by an example. Imagine a situation when you are pressed hard to reveal your container password. If you store all your really important data inside a hidden part and fill main part with seemingly and convincingly important (but really just a decoy) data you can, after some hesitation, reveal the password for the main decoy part of your container and convincingly deny the existence of any other encrypted data besides the one that you've just revealed to your interrogators. And BestCrypt of course makes sure that it is impossible to prove you have anything else besides the main decoy part.
Since BestCrypt does not know about any hidden parts you might have when mounting the main part of your container any changes you do to the mounted main part can overwrite and damage the hidden part. It is strongly advised to fill your main part with all decoy data before creating any hidden parts.
Reencryption changes the whole main part and thus leads to complete loss of all hidden part data.
Because of the exactly same reasons adding new passwords to main part after you have created a hidden part can possibly damage hidden part passwords.
When you choose to create new hidden part you will be greeted by the New Hidden Part dialog shown below:
Press the Create button to add and format new hidden part once you've set all preferences and protected any and all existing hidden parts. You will be asked to supply an initial password for your new hidden part.
After creation completes you can work with your new hidden part as usual, all container operations described in this guide apply to the hidden parts in the same way they apply to the main part with a few exceptions:
From the user side, the process of container linking is similar to the process of mounting, but without mount points. You need to open Advanced menu and click Link container. A BestCrypt virtual disk will be created and container becomes linked to it. In the container information, such container will have "Linked only." string in the label describing mount point:
BestCrypt Control Panel settings can be found under the File menu. Below the General tab of the Settings window:
Keep BestCrypt settings in config file option can be used to prevent BestCrypt from storing any of it's settings, except this one, in a configuration file.
Save container list in config option can be used to disable container list storing only. All other settings will be stored as usual.
Minimize to system tray option specifies, whether BestCrypt should minimize to panel or it should hide to system tray area.
The second tab of the Settings dialog contains a set of option to control Eject All action behavior:
Use forced eject on 'Eject All' button - if enabled, and also if combined with the next option, Eject All button becomes some type of 'panic button': it does forced eject for all currently mounted or linked containers.
Use global hot-key option can be used to enable global hot-key for 'Eject All' button.
From this window you can also change the global key itself by clicking on Change button. A new window will appear and you will be asked to press the desired hot key:
BestCrypt Console Tool
Basic concepts
Strong password guidelines