The following commands will create a TrueCrypt volume with a random key file on the device $DEVPATH
, * completely overwriting any information on that disk/device!!!* It will then attach the TrueCrypt container, create an HFS+ format volume on this device, and destroy the key it used to create it:
#!/bin/bash
# Source for random data. Use /dev/random for more secure but slower random data""
RAND=/dev/urandom
# Create a random keyfile:
KEYFILE=/tmp/scratch.key
dd if=$RAND of=$KEYFILE bs=1 count=4096
# Create a TrueCrypt volume on $DEVPATH using $KEYFIlE as the keyfile:
/Applications/TrueCrypt.app/Contents/MacOS/TrueCrypt -t -c \
-k $KEYFILE --volume-type=normal --quick --encryption=AES \
--hash=RIPEMD-160 --filesystem="none" --password="" \
--random-source=$RAND $DEVPATH
# Attach the TrueCrypt volume as a device:
/Applications/TrueCrypt.app/Contents/MacOS/TrueCrypt -t --mount \
-k $KEYFILE --password="" --protect-hidden=no \
--filesystem=none $DEVPATH
# Find the TrueCrypt device:
TCDEV=$(/Applications/TrueCrypt.app/Contents/MacOS/TrueCrypt -t -l | grep $DEVPATH | cut -d ' ' -f 3)
# Create a filesystem on the TrueCrypt device:
diskutil eraseVolume JHFS+ Scratch $TCDEV
# And destroy the key so this is a one-time use volume:
srm $KEYFILE
Note that:
- The TrueCrypt volume that is created uses a random key file with no password. The random key file is created by
dd if=$RAND of=$KEYFILE bs=1 count=4096
. Remove that line and point KEYFILE=
at a static file if you want a reusable container. BE SURE TO ALSO REMOVE THE LINE: srm $KEYFILE
if you do, because that file line SECURELY ERASES THE KEY FILE!!!*
- The random data for this script comes from the non-blocking random source
/dev/urandom
. Change to RAND=/dev/random
for more security but slowdowns.
- The device
$DEVPATH
WILL BE OVERWRITTEN BY THIS COMMAND!!!! Be absolutely sure you know what you're doing. To be safe, set DEVPATH
to a file, like /tmp/some_file
and append a --size=nnnn
to the TrueCrypt line which creates the volume, where nnnn
is the byte size of the file to create. Remove the --quick
option. This will be much slower.
- This works on Mac OS X. For Linux, use
mkfs.ext3
rather than diskutil eraseVolume
. Or just use mount -t tmpfs
and encrypted swap ;-)
dd if=/dev/urandom of=temp_keyfile bs=1 count=2048
would work.