Nerding It Up Tinfoil Hat Style

So, a few months back I was thinking about an upcoming trip to Boston. A trip not unlike the one I’m on right now, albeit shorter and without the 9 day, all-day meeting marathon.

Anyway, I was thinking about this trip with particular reference to the USA’s apparent new policy of having border guards copy data on laptops people bring across the border. I consulted the office, and apparently they were unworried about the potential for confidential work IP being copied.

I, however, also keep my personal email on my laptop. I, paranoid tinfoil-hat type that I am, was much more concerned about this data than work was about theirs. No, there’s nothing in there that would get me in trouble, but it’s just nobody else’s business, you know?

Anyway, the solution was obvious. It was time for me to start using Truecrypt. Truecrypt is awesome, free, open source software for we tinfoil types. It does a lot of things, but the most simple thing it does is let you create a file that contains an encrypted filesystem. In other words, you can treat this file like a new hard drive, with everything that you put in there becoming encrypted. And if the file isn’t “mounted” as a drive, with your password, then it’s just a block of encrypted data–just another file on the drive.

So, if you wanted to reserve a few Gb of space for files that need to be protected, you create a large file, and when it’s mounted Truecrypt lets you treat it like a drive the size of the file. If you make a really big file, you have lots of ways to make it inconspicuous, like making it look like a swap file or hibernation file, or like a large temporary internet download file, or even doing something really tricky like using alternative data streams to make it look like a not very big file. (Of course, if you really need a big encrypted volume, Truecrypt has much smarter, and better hidden, ways of doing that, but they’re not as a simple as the “filesystem hidden in a file” approach.)

Anyway, I created my hidden filesystem, and moved all my Outlook data files in there. This isn’t NSA grade protection, since it’s obvious that Truecrypt is on my system, and further it’s obvious from looking at Outlook that it expects there to be a volume around that isn’t apparent. Of course they can’t tell what file it might be hidden in… but if they were trying hard they could probably figure it out. I’m not trying to stop them if they’re trying hard. I’m just keeping snoopy border guards out of my business. (Although the idea of some poor NSA flack spending time and effort to crack my encrypted filesystem just to find an email archive that includes the bad poetry I wrote in my late teens, and some really terrible fiction I wrote in my early 20s, does kind of crack me up.)

So, that’s been working great for me for a couple of months. It was ridiculously easy to set up, with no perceptible performance drag, and it’s been quite reliable over the intervening months.

Recently, though, I’ve noticed that when I closed Outlook the window would close, but that I couldn’t “unmount” my Truecrypt volumes–the system would claim that programs still had handles open on the encrypted volume.

Using Process Explorer, I could see that the Outlook process was still running–it had no windows, and the stack traces on most of the threads showed it was trying to shutdown, but seemed to be in some kind of deadlock state waiting for some event. No matter how long I waited the process never seemed to end, to actually complete shutting down. And, obviously, since the process had handles on the email storage files, which were on the encrypted volume, that would prevent the volume from being “unmounted”. I had to manually kill the process before I could “unmount”.

I thought this was weird, but honestly it didn’t bother me too much–I rarely mount/unmount the drives, and I generally have Outlook running all the time.

However, it became apparent that this behaviour was now consistent. It happened every time.

This was starting to bother me. But I put it off for a while. I kind of assumed that this was a Truecrypt related problem, since I had never seen it before, and it didn’t seem unreasonable that Outlook was having a problem releasing a handle to the encrypted files or something…

During this trip, though, I was unmounting the volumes each morning before going to the office, and mounting them again each night, and it really started to be annoying.

So I did some research, and to make an already long story shorter, I eventually discovered that Outlook has a common problem with COM Add-ins that aren’t perfectly written, where the Add-ins keep the Outlook process from shutting down. This seemed to match the symptoms I was seeing, but I was skeptical–primarily because I had never installed any COM Add-ins.

Turns out though, that iTunes secretly installs one. And I recently put iTunes on the laptop.

So, I disabled this Add-in, and suddenly everything worked right again. Yay!

Then I grabbed some scripts I found during my Googling for the problem, and set them up, so that I have icons to click to mount the volume (prompting for my password, of course) and automatically start Outlook, and to unmount the volumes.

I got the scripts working, and then rewrote parts of them to do just what I wanted them to do.

Everything was working fine. This was some time on the weekend.

Then, last night, iTunes updated.

And guess what I noticed today. Yup, the Outlook problem was back. And sure enough, the iTunes update had turned the COM Add-In back on. So not only does Apple sneak in an Add-in without telling you, and not only does that Add-in break Outlook, but they even turn it on if you have explicitly turned it off in the past. Good one, guys.

So, it’s off again, and everything is happy on my machine. And yes, I am that big of a nerd.