The windows client also supports attach and detach handler scripts, located at c:\Program Files\hcs\handlers. These run at the same times as the Linux client scripts. The attach handlers will be called immediately after a successful attach. Detach handling scripts will be called immediately before detaching disks.

You can create a handler script for each disk that is encrypted. The format of the name will be:

DRIVE_LETTER.attach.cmd and DRIVE_LETTER.detach.cmd

Individual disk handler scripts are not required. If not specified, then the default script will be called instead. Those are named default.attach.cmd and default.detach.cmd.

Each script invocation will be passed the following parameters:

  1. The drive letter of the disk being attached or detached. This parameter will be an empty string if the encrypted partition does not have a drive letter assigned.
  2. The device name of the volume that is being attached or detached.
  3. The index into the list of encrypted drives. The index values start at 0. For example, if there are 4 encrypted drives, the index values will go from 0 to 3 as each drive is attached or detached.
  4. The total number of encrypted drives. If this value is 0, it indicates that only a single disk has been attached or detached from the command line (for example, by an administrator issuing the hcl attach or hcl detach command or by revoking or restoring a disk with the Cryptographic Security Platform Vault webGUI).

The script can determine if all disks are attached or detached by comparing parameters 3 and 4. If parameter 3 (plus 1 because it is offset from 0) is equal to parameter 4, then the script can assume that all of the disks in the system have been handled. If the total number of disks passed in is 0, that indicates that only a single disk is being operated on at that time.

If you have a disk that already contains data that you want to be encrypted, you can run the hcl encrypt command. All encryption, whether encrypting a new disk or removing and decrypting an existing disk, makes use of dynamic rekey. In the case of encrypting a disk, we do the conversion in the background, thus allowing you access the disk while the encryption process is taking place. This allows you to have no downtime for your applications and data.

Note: If Windows disks are sparse, we will only encrypt allocated blocks ensuring that only the allocated blocks are encrypted and the sparseness remains. This is not currently available for Windows C: drives.

To demonstrate how rekey works, let's first look at the contents of the unencrypted G::

C:\>dir g:
				
 Volume in drive G is New Volume
 Volume Serial Number is 44A1-E6A7

 Directory of G:\

10/25/2022  01:48 PM           346,454 HCS_BreachWhitepaper_v1.5.pdf
10/25/2022  01:48 PM           303,179 HCS_CSP_Whitepaper.pdf
10/25/2022  01:48 PM         2,278,559 HCS_Encryption_Use_Cases.pdf
10/25/2022  01:48 PM           883,773 HCS_HIPAA_Compliance.pdf
10/25/2022  01:48 PM         1,006,858 HCS_PCI_Compliance.pdf
10/25/2022  01:48 PM           310,103 HCS_Shack-P1.pdf
10/25/2022  01:48 PM           495,492 HCS_Shack-P2.pdf
               7 File(s)      5,624,418 bytes
               0 Dir(s)   2,098,798,592 bytes free

Now let's start the encryption process:

C:\>hcl encrypt g:
All the data on G: will be encrypted. This operation may take a long time.
Do you want to proceed? (y/n) y

registering drive G:, guid FF2A17F2-D7DE-404B-B977-018ADC611BCC

Encrypted device G: has been added.

You can view the progress of the rekey operation by running hcl rekey as follows:

C:>\hcl rekey status g:
				
device: \Device\Harddisk3\Partition1
drive: G
state: in progress
begin: 65536
end: 2144403456
current: 725794816
sector offset (from 0): 1417568
total sectors: 4188160
total size: 2144337920
pct done: 33.85%
elapsed time (seconds): 27

Even though the drive is only partially encrypted, we can still view the contents:

C:\>dir g:
			
  Volume in drive G is New Volume
  Serial Number is 44A1-E6A7

 Directory of G:\

10/25/2022  01:48 PM           346,454 HCS_BreachWhitepaper_v1.5.pdf
10/25/2022  01:48 PM           303,179 HCS_CSP_Whitepaper.pdf
10/25/2022  01:48 PM         2,278,559 HCS_Encryption_Use_Cases.pdf
10/25/2022  01:48 PM           883,773 HCS_HIPAA_Compliance.pdf
10/25/2022  01:48 PM         1,006,858 HCS_PCI_Compliance.pdf
10/25/2022  01:48 PM           310,103 HCS_Shack-P1.pdf
10/25/2022  01:48 PM           495,492 HCS_Shack-P2.pdf
               7 File(s)      5,624,418 bytes
               0 Dir(s)   2,098,798,592 bytes free