On Windows VeraCrypt only:
- Encrypts "containers"
- Mount one "container" as a "volume" (assigning it a letter)
- Containers can be: The whole disk as one large block, a partition, or a file
On Windows you will not be able to create partitions inside a mounted container, neither access them (see Linux to know how to create them).
On Linux, VeraCrypt can encrypt the same as Windows, but when mounting on Linux there is a very bib difference than on windows... on Linux the mountd is seen as a pure block device, so you can create partitions inside it (warning: Windows will not be able to access them).
Long HowTo (Linux) for a container with partitions:
- Create a Big file with VeraCrypt as a file container, or encrypt a partition or the whole disk (seen as one large block without partitioning).
- Mount it with VeraCrypt (let's say on /Path)
- Use fdisk, gdisk, etc on (let's say on /Path)
- Create partitions
That can be done on Linux, so you can encrypt a partition and put partitions on it.
Windows is much less restricted... containers (whatever they are) can only hold a filesystem (FAT type or NTFS file type) to be able to access them (in native mode).
So on Windows you can not have multiple partitions inside a VeraCrypt container, no matter if it is a File, Partition or the whole disk.
Side note: When you 'encrypt' with the VeraCrypt the whole disk you are not encrypting all partitions on it, you are destroying all partitioning... in other words... you are using all the whole disk as one contiguos area where is stored a FileSystem.
Bad Windows effefct of having whole disk encrypted (aka, not having at least one partition and so encrypt the partition) is when windows look at that disk, it will see the disk as not initialized (without a partition scheme) so it will ask you if you want to initialize it... and if you let do it, you will loose all data (better have a VeraCrypt header backup and a way to restore it)... sometimes i had seen Windows not asking and auto-initializing the disk.
So conclusions (for Windows):
- Never ever, encrypt the whole disk, allways select a partition (or a file) as the container
- Think that any container will be seen as a fileSystem, not as a block device, so it can not be partitioned
- If you need more than one partition (with the same key) partition the disk before encrypt, then encrypt each partition with the same key (remember if you want to mount them all at once, create a script that asks for passphrase, etc and mount one by one by scripting... i do not remember if veracrypt favorites can be used for that, without depending upon system-encription mount)
So conclusions (for Linux):
- Any VeraCrypt container mounted is seen as a full block device
- You can put there directly a filesystem (without partitioning it), this is also Windows way
- Also you can create a partitioning scheme MBR / GPT, and use LVM, LUKs, etc (this can not be done on windows, so if done on Linux, from Windows will not be possible to access).
Sample for a HardDrive0 with only Partition1 being encrypted with VeraCrypt (also aplies to any VeraCrypt encrypted file container):
- Windows will hold inside only a FAT or NTFS filesystem (not a block device)
- Linux can see that as a filesystem as well as a full block device
Hope now you have 'concepts' quite more clear.
P.D.: Yes, i do not know why TrueCrypt/VeraCrypt people did not do it as emulating a full Device on Windows, but remember that on Linux anything seen as a R/W block list can be partitioned (so it is not VeraCrypt, it is Linux the one that let you create partitions inside, also more, on Linux you can see a normal partition as a whole disk and so create a partition scheme inside a partition, and use a long chain of them, etc).