Encrypting the search index(es) - any advice?

Question

I have read up on how to configure SQL Server TDE to encrypt SharePoint content that resides in databases, but what about encrypting the search indexes (which reside on the file system)?

Does anyone have any experience with this, and can you offer some advice / tips?

Questions I have are:

• BitLocker or something else (like TrueCrypt?) - from my understanding of BitLocker, in order to use it to encrypt a non-OS volume, you must first encrypt the OS volume. Is that really necessary?
• What accounts need to have access to the encrypted files so that the Search Service App can function properly? I'm guessing the crawl account needs to have access so it can write to the index, but what account is running the queries and reading the index?
• Any other advice?

Answer 1

For the files being stored on the hard drive, your only way to encrypt that data would be through file system encryption. The only accounts that would really need access to that data would be the Farm Service and Search Service accounts. If you want to be absolutely certain that nothing else accesses that data, you could use a tool like SysInternals Process Monitor (http://technet.microsoft.com/en-us/sysinternals/bb896645) to monitor what processes access that data.