With TrueCrypt:
- Create a new file-based container.
- In the main window, Create volume
- Create an encrypted file container → Standard volume
- Select where you want to store it. (I have an
AppData.tc
in my user directory.)
- Accept the default encryption algorithm.
- Select how big do you want the volume to be.
- Enter a password, or pick a key file, or both.
- Format the volume. (I personally choose NTFS as filesystem, for some reliability.)
- Even though file-based, the container still has a standard filesystem.
- The Linux term is "loop mounting".
- Click Exit.
- In the main TrueCrypt window, open the freshly-created volume.
- Use Select File
- Pick an empty drive letter from the big list
- Click Mount
- You can make this step mostly-automatic through Favourites → Add Mounted Volume to Favourites.
- Move your Thunderbird profile.
- Copy the current profile from your AppData folder to the drive you chose in 2.2
- Usually it is in
%APPDATA%\Thunderbird\Profiles
and has a name similar to mbqbp1tq.default
- After copying, rename to
Thunderbird profile
or something, to avoid confusion later.
- Securely wipe the old profile.
- I used to like Eraser, until it received a complete rewrite and became inconvienent to use "but it's .NET now!"
- Now I stick with
sdelete
.
- Tell Thunderbird about the new location. It's kept in
%APPDATA%\Thunderbird\Profiles.ini
, but there's an easier way to update it:
- Start → Run → enter
thunderbird -profilemanager
- Delete your current profile. Click Don't delete files; you already nuked them in step 3.2.
- Click Create Profile, enter any name (such as
default
), and click Choose Folder.
- Pick the location of your encrypted profile from step 3.1.
- Start Thunderbird.
If you decide you do not like TrueCrypt, there is FreeOTFE, which works in mostly the same way.
With Windows' built-in Encrypting File System: Not to be confused with BitLocker.
You mentioned that you do not want to use filesystem-specific features, but they can be useful at times.
- Browse to your Thunderbird settings folder. Usually
%APPDATA%\Thunderbird
.
- Right-click on
Profiles
, choose Properties.
- Advanced → Encrypt contents → OK → OK
- Start Thunderbird.
- Backup the encryption key. You only need to do it once for your Windows account.
- Start → Run →
certmgr.msc
- Personal → Certificates
- Find the one with "Encrypting File System" in its "Intended Purposes" column.
- Right-click, All tasks → Export
- Click Yes, export the private key
- Enter the encryption password for the exported key, and choose where to put it.
- Oh, one more thing. You have to somehow wipe the old, unencrypted data. I use
cipher /w:C:
to wipe all unused space, but even one pass takes a long time...
The downside - EFS is only available in Windows * Professional and up.
From a comment:
The only other way (besides transparent encryption, as above) is to build crypto capabilities into Thunderbird itself. And considering the complexity of the program, it is not a solution.
4Your Thunderird profile consists of multiple files. Putting them all in a TrueCrypt container will be much easier than handling encryption/decryption on a per-file basis. You can use a TrueCrypt container file to avoid "file system-specific features." – Mike Fitzpatrick – 2011-01-05T02:46:37.177
But then I'd have to install TrueCrypt, which I specifically said doesn't suit my needs because I just want to encrypt one folder, not an entire partition... – user541686 – 2011-01-05T02:49:01.753
2If you read Mike's comments he did not state encrypting an entire partition. – Unfundednut – 2011-01-05T05:04:54.400
Oh shoot... sorry about that, my bad. Everywhere I'd looked on the internet, I'd read about how TrueCrypt encrypts entire partitions, and I missed that part... thanks, I'll look into it; +1 for both. – user541686 – 2011-01-05T07:04:40.147
Would you mind explaining how to do that? I installed the program, but everything is about encrypting volumes, not folders... – user541686 – 2011-01-05T07:52:24.410
3TrueCrypt creates a virtual encrypted disk within a single file and mounts it as though it was a real disk. This virtual volume will look like a whole drive to the OS and applications. You can then move Thunderbird's profile folder onto this new virtual drive (as described in some of the answers). – martineau – 2011-01-05T11:21:35.880
Huh... okay, so I misunderstood, but it's still the same problem: whether the new volume is virtual or physical, I'm still creating a new volume, which I wanted to avoid. – user541686 – 2011-01-06T04:38:54.813