ENCRYPT IN PLACE

It’s possible to encrypt an existing data drive without wiping it in VeraCrypt using “Encrypt in place.” But there are drawbacks. Unlike encrypting your Windows installation, the drive won’t be available while it’s being encrypted. Also, when done, you’re prompted to assign it a different drive letter—this isn’t necessary as we’ll explain shortly.

Choose “Encrypt in place,” click “Next,” read the warning, and click “Yes.” You’re prompted to set encryption and authentication options, then asked to move your mouse randomly to strengthen the encryption keys, before ending up at the “Wipe Screen.” This allows you to shred unencrypted files after the drive has been encrypted to prevent them from being recovered by undelete tools later. Only the most paranoid should consider anything other than “None (fastest)” or “1-pass (random data).”

Click “Next,” then “Encrypt.” Click “Yes” (you may need to click “Yes” again if the drive is in use, to dismount it), then wait for the drive to be encrypted. Once done, read any warnings, and click “Finish.” To keep the same drive letter, right-click “This PC” in File Explorer, and choose “Manage.” Identify your encrypted partition using its drive letter, right-click it, choose “Change Drive Letter and Paths,” select the current drive letter, and click “Remove,” then “OK.” You should now be able to select the drive letter in the main VeraCrypt window, and click “Auto-Mount Devices” to follow the advice in the main feature to access the drive. If you wish to decrypt the drive permanently, select it, and choose “Volumes > Permanently Decrypt.”