Basic concepts

This chapter gives a quick overview of all the major components that compose BestCrypt data encryption system and provides an introduction into a few basic concepts that are used throughout the rest of this guide.

BestCrypt System Overview

To achieve its goals in providing the best in data protection BestCrypt utilizes three major components:

Additionally, there is the section about container mounting describing how container data is appearing and disappearing in your operating system.

Lets take a closer look at each of these components.

Control Panel

Control Panel is the main BestCrypt command and control application. Most of the functions supported by BestCrypt are available through its functionality and dialogs which include:

BestCrypt Control Panel

Control Panel provides a wide variety of functions and there is a separate section of the guide called that describes all of its functionality in full detail.

You can launch control panel by locating BestCrypt in Applications->Accessories menu in your window manager or by executing bestcrypt-panel command from terminal emulator.

Control Panel also has an icon in system tray, which can be used for a quick mounting and ejecting of your containers.

BestCrypt Control Panel also has a desktop integration. It allows you to mount or unmount your containers within file manager by double-clicking them.

Console Tool

Console tool provides a console interface for BestCrypt users. All the functions available in BestCrypt, can be launched by console tool, but there is also a bit more flexibility in some commands, for example, using Console Tool you can pass additional parameters to Linux mount process. See BestCrypt Console Tool Guide for more information.

Container File

The main unit all BestCrypt components operate on is called BestCrypt Container File. True to its name it represents a file on your system with a specific default .jbc extension and an icon shown below:

This file contains all encrypted data stored on the virtual disk contained within it. Each container file stores at least one main virtual disk and can also store a number of additional hidden disks. You can imagine container file as a collection of encrypted disk images with all data required to verify passwords and perform all other operations.

BestCrypt container file has a well known format that exists in a variety of versions and is described in more detail in appendix section of this guide called Container file structure. You of course don't need to know all details of container file structure to fully and easily use all variety of BestCrypt functionality. Suffice it to say that container file consists of two main parts:

BestCrypt provides a number of operations that deal with container file's header specifically including backing up key data and header encryption. The detailed description of these operations can be found below.

Some versions of the container file format are declared deprecated and can't support newer functionality. Of course by default only latest format is used when creating new containers.

To create new container files refer to Create new container section of the Control Panel or Console Tool guide.

Creating header backup

BestCrypt generates and securely stores a set of encryption keys that all data in container file is encrypted with. Each correct container password is used to decode those keys and setup a virtual encrypted disk. All data needed to check each password and decode encryption keys is stored in a special section of the container file that you can back up and safely store in a separate file without copying entire container file with all its encrypted data inside.

To use key data backups effectively there is a key point to understand: backup file contains a copy of all information about container encryption keys and passwords. This is of course stored in a secure way but the point is that by creating a backup file you create a snapshot of all passwords and encryption keys used for this container. Keep that in mind when you restore key data backup because in the former case the previous snapshot of all container passwords is restored and in the latter case you are authenticating against this previous snapshot.

To create header backup, please see the Header Backup section of the Control Panel or Console Tool guides.

Container header encryption

BestCrypt container file consists of two different types of data:

Therefore BestCrypt container file has a well known structure that can be easily identified on your computer. Sometimes it is unacceptable for anyone to know and prove that you have a BestCrypt container file without actually knowing its password or even asking for it. Header encryption exists to avoid exactly this kind of threat.

Operation encrypts this well known container header to make it look like random garbage and entire container file becomes absolutely indistinguishable from noise and does not have any known structure anymore. Nobody can then unambiguously prove that this file is a BestCrypt container.

Two things should be noted here:

Container header encryption can be undone by decrypting container header.

To encrypt or decrypt container header, please refer to the section about container header encryption of Control Panel or Console Tool guide.

Reencryption

All data inside container file is encrypted using the algorithm specified when container was created. Each encryption algorithm needs a little piece of data called an encryption key. This key should always be kept secret and BestCrypt takes care of that for you.

However new faster and safer algorithms can appear or someone can crack existing container password. Changing existing container passwords does not change the key the data in container is encrypted with. This way if you have ever granted access to anyone by adding a password for your container and later decided to revoke that access just changing or removing that password is not enough because this person could have created a key data backup and can now just restore his password from it. Reencryption allows you to change container algorithm and encryption key while preserving all data inside the container to take advantage of the better encryption algorithm or protect all data against leaked passwords.

Being a powerful feature, reencryption also introduces some side effects which you should consider before using:


Virtual encrypted disk

Encrypted data stored inside container file can be mounted with the correct password and accessed from Virtual encrypted disk. This disk is emulated as an ordinary removable device (like a thumb drive) for the rest of your system with the exception that all files written on it will be stored encrypted in the container file this disk was mounted from. When reading existing files from the disk all data will be read from its container file and decrypted.

Every single application be it text editor or Terminal will work with virtual encrypted disk absolutely as usual. All encryption and decryption are performed transparently for every single bit of data located on each encrypted disk. This allows BestCrypt to easily and seamlessly integrate into your day to day workflow providing automatic and transparent data protection.

Mounting and ejecting containers

The process of container data becoming available in the system is called mounting. The opposite process is called ejecting. Let's describe them both in more detail.

Container mounting

The process of container data becoming available in the system can be divided into two parts - linking and mounting. The process is similar to things that happen when you insert an USB stick or external hard disk.

BestCrypt handles all the process of container appearing by itself. There are few cases when you need to complete only the first step, but these cases considered advanced. If you need to only link your container, please see the Linking Process part of Control Panel or Console Tool guide.

A few words should be said about mount location. On Linux all your mounted disks, real or virtual are attached one big filesystem hierarchy. New disks can be attached on any folder anywhere in this hierarchy as long as you are allowed to access this folder. After mounting any previous contents of that location will be "hidden"" under disk contents. Once you eject the disk mounted there previous folder contents will become visible again.

You can use this behavior to your advantage to intentionally hide previous folder contents under the contents of the BestCrypt container. One typical application of this trick is to mount BestCrypt container right on the folder where this very container file is located. This way actual container file will be hidden as long as it's virtual encrypted disk is mounted.

Container ejecting

When you have completed working with your data, you need to make it inaccessible by ejecting of a virtual drive. This process is also can be divided into two separate stages, umounting and unlinking. These terms are opposite to linking and mounting. As for container data appearing in the system, BestCrypt handles all the process of container ejecting for you.

For information about how to eject a container, please refer to the section about container ejecting in Control Panel or Console Tool guide.

Another thing you can do with real removable flash drives is to physically eject them from your computer's USB slot. This functionality is also provided by BestCrypt and is called Forced eject. To force eject your encrypted virtual disk use Control Panel "Force Eject" button.

Forcing an eject of BestCrypt container can lead to damage to any files currently open from this container or its file system in general. This is exactly the same precautions that exist when physically removing real flash drives without ejecting them first. Use forced eject as an emergency measure and try to perform ordinary non-forced eject whenever possible.

See also:

Quick start guide
BestCrypt Control Panel
BestCrypt Console Tool