Contents

Data encryption (SynQaiCrypt)

With SynQaiCrypt you protect confidential files in encrypted vaults. You open a vault with your password, work with it like an ordinary drive and disconnect it afterwards — the contents cannot be read without the password. SynQaiCrypt offers two routes: the own vault and the connection to Windows’ own BitLocker.

14.1 Opening

In the header bar, the button with the padlock symbol 🔐 (“Open SynQaiCrypt — encrypt drives & containers”) opens the SynQaiCrypt window. On the left are the two groups Vault and BitLocker, on the right the list of your vaults with their status.

ℹ️ Prerequisites

For own vaults the WinFsp driver is needed once; if it is missing, the window offers “Download WinFsp” and “Check again”. BitLocker actions require administrator rights and a BitLocker-capable Windows edition (Pro/Enterprise) — otherwise the window can be reopened via “Start as administrator”.

ℹ️ A little patience on first opening

The window appears immediately and checks the encryption status in the background — a loading overlay covers it while it does (“Checking encryption status…”). After a Windows restart this first check takes noticeably longer, because Windows first has to load its encryption tools; the second time it is much faster. The title bar stays operable throughout, so the window can be closed at any time.

Screenshot 59: SynQaiCrypt window: the groups “Vault” and “BitLocker” on the left, the vault list on the right with one mounted entry (status “Mounted”) and one locked entry — Fig. 59 — SynQaiCrypt window: the groups “Vault” and “BitLocker” on the left, the vault list on the right with one mounted entry (status “Mounted”) and one locked entry

14.2 Own vault or BitLocker?

	Own vault	BitLocker
Mounting	as a write-protected drive; the decrypted content exists only in memory	as a fully-fledged, writable drive
After the program ends	is disconnected	stays active (a Windows function)
Prerequisite	WinFsp driver	administrator + Windows Pro/Enterprise
Safeguard	header backup (see 14.5)	recovery key (see 14.6)

14.3 Creating your own vault

The Vault group offers two routes:

Button	Creates…
Create container	a single encrypted container file (`.sqv`)
Create drive	an entire folder or a data drive as a vault — names and contents are encrypted

Click Create container and choose a location for the .sqv file (default: Documents\SynQaiCrypt).
In the password dialogue, assign a name and a password and confirm it. Optionally the password can be remembered on this Windows account or protected with Windows Hello (PIN/fingerprint/face).
Confirm with Create.

Screenshot 60: Password dialogue when creating: the fields name, password and confirm password as well as the options “Remember …” and “Protect with Windows Hello” — Fig. 60 — Password dialogue when creating: the fields name, password and confirm password as well as the options “Remember …” and “Protect with Windows Hello”

ℹ️ Strong, proven encryption

SynQaiCrypt derives the key from your password using Argon2id and encrypts the content with authenticated XChaCha20-Poly1305 in small blocks — tampering with the container is detected as a result. There is deliberately no algorithm choice: you do not have to configure anything, it is secure out of the box.

14.4 Opening, working, disconnecting

A click on Mount in the vault row (or on Open … for a vault file) mounts the vault as a drive letter. SynQaiCrypt first tries Windows Hello, then a remembered password, and otherwise asks for the password. The prompt dialogue also lets you choose the drive letter — “Automatic” or a specific free letter; the ↻ symbol next to it re-reads the free letters in case something has changed in the meantime. The status changes to Mounted. Unlock all opens several locked vaults at once with one master password. To close, click Disconnect.

ℹ️ Plain text never on the disk

An own vault is mounted write-protected; the decrypted data exists only in memory, never unencrypted on the storage medium.

14.5 The header backup

The header of every own vault holds the wrapped key. If this header is damaged, the vault is lost — which is why SynQaiCrypt offers the header backup (icon in the vault row). There you can restore a backup, export … it (as a .sqhdr file) or import it from a file.

⚠️ No recovery key with own vaults

Unlike BitLocker, an own vault has no recovery key. Your safeguard is the exported header backup plus your password — keep both in a safe place. Nobody can recover a forgotten password.

14.6 Using BitLocker

The BitLocker group uses the encryption built into Windows, which stays active even after SynQaiPro is closed:

Button	Function
Create container …	create an encrypted container file of a size you choose
Encrypt drive …	encrypt an existing data drive directly with BitLocker
Open container …	mount an existing BitLocker container

When creating a container you set the Maximum container size with the slider, assign a password and then receive the recovery key. For each drive row you can pause/resume the encryption, follow the progress or switch BitLocker off again. With the option Unlock automatically at Windows start-up, remembered drives are unlocked via Windows Hello when you log in from then on (the small window for this is described in chapter 13).

ℹ️ The container size is an upper limit

The container grows with its contents up to the value you set — it does not occupy the whole space right away. An empty 10 GB container needs only about 300 MB on disk (file system and BitLocker administration data). The value you set therefore determines how much fits in, not the initial file size. A container cannot be enlarged afterwards — when in doubt choose generously, it costs no disk space.

⚠️ Save the recovery key immediately

If the password is lost, the recovery key is the only rescue — without it the data is gone. Save it to a file straight away or copy it to a safe place (USB stick, password manager) before you continue.

Screenshot 61: Recovery key dialogue with the key and the warning “… the ONLY rescue — without it the data is lost” as well as the buttons for saving/copying — Fig. 61 — Recovery key dialogue with the key and the warning “… the ONLY rescue — without it the data is lost” as well as the buttons for saving/copying

⚠️ Decrypting makes the data open again

If you switch BitLocker off for a drive, the data becomes readable unencrypted again. SynQaiPro asks explicitly beforehand.

14.7 Encrypting a drive — completely or used space only?

If you choose Encrypt drive …, the list of eligible data drives appears (system and network drives stay excluded). If a drive was connected only after opening, the ↻ symbol above the list fetches them anew. Before starting you decide on the scope:

Setting	What is encrypted	When suitable
Complete (default)	every sector of the drive — including the free space	When unencrypted data has been on the drive before. Deleted files are still physically present and would otherwise remain readable.
Used space only	only the area actually in use; everything newly written is encrypted anyway	With new or freshly formatted drives — there is no old data to protect there.

Beneath the selection the concrete amount is always given, e.g. “0.1 GB of 931.5 GB will be encrypted.” — so the magnitude is visible before you start.

⚠️ The difference is enormous

Encrypting an empty 1 TB drive completely means overwriting around 950 GB of empty space: with a typical external disk (~33 MB/s) that is about eight hours. The same operation with “Used space only” is done in seconds — with identical protection for everything you put on it in future. So choose “complete” deliberately, not out of habit.

Screenshot 62: Drive selection with a warning, refresh symbol, the scope option “Encrypt used space only” including the amount, and the risk confirmation — Fig. 62 — Drive selection with a warning, refresh symbol, the scope option “Encrypt used space only” including the amount, and the risk confirmation

The progress

BitLocker keeps encrypting in the background even if you close the window — the drive is perfectly usable in the meantime. During the operation SynQaiPro shows the progress as a percentage; with Continue in the background you put the display aside without stopping the operation. After that the state stays visible in the drive row, where you can also pause and resume it.

ℹ️ Why it stalls again at 99 %

At the end BitLocker writes its administration data — this takes a moment regardless of the amount of data. The display then changes to “Completing encryption…”. That is normal, not a freeze.

14.8 In trial mode

ℹ️ Fully usable

Encryption is not restricted in trial mode — vaults and BitLocker are fully available without a licence too.