Creating a "Master Key File" in Truecrypt?

Question

I have a few dozen employee thumbdrives that carry sensitive information. We'll be using TrueCrypt to lock down these drives.

Each thumbdrive will typically be in a single employee's possession, and I would like for them to be able to change their own password at will. However, I would also like to make the encryption process as transparent as possible, by having a sort of 'master' keyfile for each drive placed on trusted machines. These trusted machines are secured with BitLocker, so I'm not worried about a third party getting their hands on them.

In essence, I'd like to be able to open the volume using EITHER:

• A password-protected keyfile that travels with the volume,

OR:

• A keyfile located in a known directory on a trusted machine, which will not require a password.

Is this doable without purchasing fobs for each employee?

Answer 1

There is a way to create a masterpassword that an admin can use if the user has changed and forgotten their password.

in general you create the volume, set your master password, and extract the volume header to a file that you will keep safe (right?). then you can make a copy of the volume for each users thumg. they will be able to change the password if they like.

when they forget it, you just take their volume, reapply your original header, and login.

see instructions here: http://www.experts123.com/q/we-use-truecrypt-in-a-corporate-enterprise-environment-is-there-a-way-for-an-administrator-to-reset-a-volume-password-or-pre-boot-authentication-password-when-a-user-forgets-it-or-loses-a-keyfile.html