This project has moved and is read-only. For the latest updates, please go here.

Constant disk writes to non-veracrypt primary drive?


I only recently converted from Truecrypt to Veracrypt after the audit results came out. I'm seeing constant disk writes from Veracrypt that I don't remember seeing from Truecrypt before. I use Bitlocker to encrypt my C drive for SSD performance reasons, and Veracrypt encrypts a second data HDD. The attached screenshot shows Veracrypt constantly writing to various log, temp, and prefetch files on C even though, as stated, Veracrypt doesn't touch my C drive. Notice the "SNIPPINGTOOL.EXE" prefetch line? I launched snipping tool to take that screenshot. Veracrypt also seems to like writing my Chrome session and logs to C drive, as well as various windows 10 telemetry logs (remind me to disable those services... again... -_-) and other windows component logs. And why is it constantly reading 15kB/s from \Device\Harddisk*, even one that isn't mounted (Harddisk2)?

What's going on here?

file attachments


tricolor_broccoli wrote Nov 28, 2016 at 1:12 AM

I toyed around and may have figured out what's going on, but it still doesn't make sense to me:

I realized that the reason Veracrypt was probably reading 15kB/s from the various drives is that I had my backup drive configured in favorites to "mount when its host device gets connected". I disabled this option to see if the reads would go away. After a couple minutes, the reads did go away and, unexpectedly, all of the veracrypt writes disappeared as well. All the writes were replaced with the actual name of the service or app doing the writes instead of being masked behind the Veracrypt service.

Why would asking Veracrypt to automount a drive cause these apps and services to mask their disk activity behind Veracrypt?