The CryptoExpert system mounts a volume file to create a "virtual drive" that appears to applications and users like any other physical drive. Any data that the user attempts to write to this drive is intercepted by CryptoExpert, encrypted, and written to the volume file. Attempts to read from this volume are also intercepted, and the relevant data is read by CryptoExpert from the volume file, decrypted, and presented to the application.