Operation Manual

93
you mount a VeraCrypt volume. To do so in Windows XP or later, right-click the ‘Computer’ (or ‘My
Computer’) icon on the desktop or in the Start Menu, and then select Properties -> (on Windows
Vista or later: -> Advanced System Settings ->) Advanced tab -> section Startup and Recovery ->
Settings -> section Write debugging information -> select (none) -> OK.
Note for users of Windows XP/2003: As Windows XP and Windows 2003 do not provide any API
for encryption of memory dump files, if the system partition/drive is encrypted by VeraCrypt and
your Windows XP system is configured to write memory dump files to the system drive, the
VeraCrypt driver automatically prevents Windows from writing any data to memory dump files.
Hibernation File
Note: The issue described below does not affect you if the system partition or system drive is
encrypted
*
(for more information, see the chapter System Encryption) and if the hibernation file is
located on one the partitions within the key scope of system encryption (which it typically is, by
default), for example, on the partition where Windows is installed. When the computer hibernates,
data are encrypted on the fly before they are written to the hibernation file.
When a computer hibernates (or enters a power-saving mode), the content of its system memory is
written to a so-called hibernation file on the hard drive. You can configure VeraCrypt (Settings >
Preferences > Dismount all when: Entering power saving mode) to automatically dismount all
mounted VeraCrypt volumes, erase their master keys stored in RAM, and cached passwords
(stored in RAM), if there are any, before a computer hibernates (or enters a power-saving mode).
However, keep in mind, that if you do not use system encryption (see the chapter System
Encryption), VeraCrypt still cannot reliably prevent the contents of sensitive files opened in RAM
from being saved unencrypted to a hibernation file. Note that when you open a file stored on a
VeraCrypt volume, for example, in a text editor, then the content of the file is stored unencrypted in
RAM (and it may remain unencrypted in RAM until the computer is turned off).
Note that when Windows enters Sleep mode, it may be actually configured to enter so-called
Hybrid Sleep mode, which involves hibernation. Also note that the operating system may be
configured to hibernate or enter the Hybrid Sleep mode when you click or select "Shut down" (for
more information, please see the documentation for your operating system).
To prevent the issues described above, encrypt the system partition/drive (for information on
how to do so, see the chapter System Encryption) and make sure that the hibernation file is
located on one of the partitions within the key scope of system encryption (which it typically is, by
default), for example, on the partition where Windows is installed. When the computer hibernates,
data will be encrypted on the fly before they are written to the hibernation file.
Note: You may also want to consider creating a hidden operating system (for more information,
see the section Hidden Operating System).
Alternatively, if you cannot use system encryption, disable or prevent hibernation on your computer
at least for each session during which you work with any sensitive data and during which you
mount a VeraCrypt volume.
*
Disclaimer: As Windows XP and Windows 2003 do not provide any API for encryption of hibernation files, VeraCrypt
has to modify undocumented components of Windows XP/2003 in order to allow users to encrypt hibernation files.
Therefore, VeraCrypt cannot guarantee that Windows XP/2003 hibernation files will always be encrypted. In response to
our public complaint regarding the missing API, Microsoft began providing a public API for encryption of hibernation files
on Windows Vista and later versions of Windows. Therefore, if you use Windows XP/2003 and want the hibernation file
to be safely encrypted, we strongly recommend that you upgrade to Windows Vista or later.