DiskCryptor

DiskCryptor encrypts whole partitions and whole drives, including the one your system boots from, and it asks for the password before the system starts rather than after. Everything behind that prompt is ciphertext. Pull the drive out, put it in another machine, and you get a partition the operating system offers to format because it cannot read a single byte of it.

The encryption itself runs transparently once mounted. Files open and save normally, with no container to mount and no virtual drive letter, because the partition is the encrypted object. Three ciphers are available in DiskCryptor, AES, Twofish and Serpent, along with cascades that chain two or three of them, and hardware acceleration is used where the processor offers it.

On a machine with AES instructions the slowdown is small enough that most people stop noticing within a day. What sets the application apart is breadth of boot support and a much smaller feature set everywhere else.

No hidden volumes, no plausible deniability, no encrypted file containers. It encrypts disks, and it is unusually flexible about how those disks boot.

Choosing a cipher, and when cascades earn their slowdown

The DiskCryptor dialog offers each cipher alone or in combination, in XTS mode. AES with hardware acceleration is the sensible default for almost everyone, since it is fast and no practical attack exists against it. Serpent is the conservative choice and slower. Twofish sits between them.

Cascades encrypt with one cipher then encrypt the result with another, which protects against a break in a single algorithm and reduces throughput proportionally. On a modern processor with AES acceleration, a cascade throws that acceleration away for the other layers, so the drop is noticeable on large file operations. For a laptop that might be stolen, single AES is enough. For an archive that must stay secret for decades, the cascades are there.

Key files can be used alongside or instead of a password, which turns a USB stick written with a bootable media creator into part of the key. Lose the stick and the data is gone, so treat that choice with the seriousness it deserves.

Pre-boot authentication and unusual boot setups

This is the area where DiskCryptor leads outright. The bootloader can go on the system drive, or on a separate USB stick, so the encrypted machine will not even begin to boot without the stick present. That is a two-factor arrangement using hardware you already own.

Multi-boot configurations are handled properly, including chainloading from third-party boot managers, so a machine that boots more than one system can still have its partitions encrypted. Both MBR and UEFI with GPT are supported, the UEFI bootloader having been added specifically to keep the tool usable on current hardware.

There is a catch, and it is the one thing to know before encrypting a system partition on a UEFI machine. The tool installs its own boot file in place of the system’s, and a system update can restore the original one, which breaks the boot chain and leaves you staring at an unencrypted boot manager that cannot find anything.

The fix is documented as a short sequence of commands run from the recovery environment, renaming files back into place. Keep that script somewhere other than the encrypted drive.

Drives, removable media and dynamic disks

Beyond the system partition, DiskCryptor encrypts data partitions, whole external drives and USB sticks, with automatic mounting so a stick you plug in prompts for its password and appears as usual. Dynamic disks are fully supported, which is unusual enough that partition managers often reserve the conversion for their paid tiers, and so are drives with large sector sizes, which matters on hardware RAID arrays where most consumer encryption tools simply refuse.

SSD TRIM is supported, so an encrypted solid state drive keeps its performance and its lifespan, though enabling TRIM leaks a small amount of information about which blocks are in use. That trade-off is the same in every disk encryption tool.

Encrypted optical media can be created too, which still has uses for archival copies.

Before you encrypt anything

The preparation matters more than any setting in the interface, and skipping it is how people lose everything.

Back up the data before letting DiskCryptor touch anything. Encryption rewrites every sector, and a power cut or a failing drive during that pass can leave a partition that neither the tool nor a recovery utility can read. Check the drive’s health with a S.M.A.R.T. monitor before starting, because a disk with reallocated sectors is not a candidate for this.

Then make the rescue media. The bootable image the tool creates carries the bootloader and lets you unlock and repair a machine whose boot sector has been damaged, and you cannot make it after the fact if the machine will not boot. Write it to a stick and keep it somewhere safe.

Finally, back up the volume header. It holds the encrypted master key, and if those sectors are damaged the data is unrecoverable no matter how good your password is. The header backup is a small file and it is the single most important thing you will create during this process.

Where it sits against the alternatives

VeraCrypt is the obvious comparison and the more complete product, with encrypted containers, hidden volumes and a long history of external review behind it. It is what most people should use. DiskCryptor answers a narrower question, which is how to encrypt a system partition on a machine with an awkward boot arrangement, a hardware RAID array, dynamic disks, or a requirement that the bootloader live on removable media.

Development has been sporadic, with long quiet stretches followed by bursts of compatibility work, and no independent audit has been published. That is the honest weight on the other side of the scale. For file-level encryption rather than disks, AxCrypt covers a different need entirely.

Conclusion

DiskCryptor suits someone with an encryption requirement that the mainstream tools handle badly. A hardware RAID array, dynamic disks, a multi-boot machine, or a policy that says the bootloader must travel separately from the computer. In those situations it does things its rivals cannot, and it does them with fast, transparent partition encryption that you stop noticing.

Everyone else should think twice. The intermittent development, the absent audit and the UEFI boot fragility all count against it, and the more mature alternative covers ordinary full-disk encryption with a larger safety net. If you do use it, the rescue media and the header backup are not optional extras. They are the difference between an inconvenience and the permanent loss of everything on the drive.