Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I created a 200GB container to store files on my external USB drive. Can I just copy this (empty) container file to create another container of 200GB? I want to do this since it takes about 2 hours to create a 200GB container (NTFS formatted) and I want multiple containers of the same size. Thanks!

share|improve this question
Don't do that. It compromises security. – CodesInChaos Feb 4 '11 at 18:26
up vote 5 down vote accepted

If it's a container then it just behaves as any ordinary file, so yes, you can copy it, you can do just about anything with it.

share|improve this answer
It's possible, but but you SHOULD NOT do that. The encryption mode used by TC doesn't deal well with copying. See – CodesInChaos Feb 4 '11 at 18:25
@Code, yes it does. It's just A FILE, TrueCrypt doesn't store any absolute paths. – Mircea Chirea Feb 4 '11 at 18:59
By "doesn't deal well" I mean that the cryptography is weakened considerably by having several containers with the same master-key. For example they strongly discourage copying a container as backup even though that'd be just a convenient file copy. – CodesInChaos Feb 16 '11 at 15:01
@Code, sure, if the key is weak. Otherwise breaking a TC container is impossible - the FBI has tried it. – Mircea Chirea Feb 17 '11 at 4:24
Cryptographically if multiple containers exist with the same master key but different data it does make certain types of attacks possible that would not otherwise be possible. This still does not make cracking it easy though, and for many users the risk is acceptable for the convenience of being able to copy and otherwise treat the container as a normal file. – TimothyAWiseman Feb 13 '12 at 17:32

If you are talking about backing up a truecrypt container that has data?

share|improve this answer
what about empty containers? – n1kh1lp Dec 28 '10 at 13:23
Note that I just want to avoid the time it takes to format the containers. – n1kh1lp Dec 28 '10 at 13:29
It's certainly possible to copy TrueCrypt volumes. Most of the TrueCrypt manual is written assuming you have adversaries willing and able to use any known methods of attacking your data, your computer, or your person, and therefore is often a little over the top in it's recommendations. – Stephen Jennings Dec 28 '10 at 13:48
All I can suggest it to try it on an experimental basis, see if it works, use it for a while see if any problems crop up. – Moab Dec 28 '10 at 17:37

To create a new 200G TrueCrypt volume faster, try this:

  1. Create an uninitialized large file by seek:

    # dd bs=1048576 count=0 seek=200000
  2. Clone the header only,

    # truecrypt --backup-headers
    (... backup to file header.bak)
    # truecrypt --restore-headers
    (... restore from external file header.bak)
  3. Mount the new volume with no file system

    # truecrypt --filesystem none
  4. Find out which mapper device is used?

    # truecrypt -l
    4: /tmp/ /dev/mapper/truecrypt4 /tmp/oldfs
    5: /tmp/ /dev/mapper/truecrypt5 - 

    So, the is mapped by /dev/mapper/truecrypt5

  5. Format the uninitialized volume

    # mkfs.ext4 /dev/mapper/truecrypt5
    # e2label /dev/mapper/truecrypt5 "My second copy"
  6. Remount with the file system

    # truecrypt -d
    # truecrypt /tmp/newfs

Now, you get it.

share|improve this answer
thanks. Just copying the container file seems to work. I tried with small containers. Do you think there would be any problems with large containers? Copying the container file automatically copies the headers, right? – n1kh1lp Dec 28 '10 at 14:20
No problem! Just as you said, it took you 2 hours to create, so this maybe a bit faster to create very large volume. – Xiè Jìléi Dec 28 '10 at 14:45
And, dd could be slightly faster then file copy. – Xiè Jìléi Feb 28 '12 at 8:47

The TrueCrypt authors explicitly recommend not doing this. When you copy a container, all copies share the same master-key. While this doesn't allow an attacker to break the encryption itself, it leaks some information.

If you follow the above steps, you will help prevent adversaries from finding out:
Which sectors of the volumes are changing (because you always follow step 1). This is particularly important, for example, if you store the backup volume on a device kept in a bank's safe deposit box (or in any other location that an adversary can repeatedly access) and the volume contains a hidden volume (for more information, see the subsection Security Requirements and Precautions Pertaining to Hidden Volumes in the chapter Plausible Deniability).


And of course you can forget about plausible deniability if you use multiple containers with the same master key.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .