3

I have a full-disk encryption applied on an external drive. Here's what I did:

  1. Make sure disk is empty and there are no partitions on drive.
  2. Create Volume > Encrypt a non-system partition/drive. I selected a the device: \Device\Harddisk1\Partition0 - 931 GB.
  3. After the formatting is done then I mount the hard disk.
  4. The size of mounted drive comes as 931 GB as expected.

Here's my question:

Now, how do I create partitions of this drive? Is it even possible to do that with full external disk encryption?

  • more of a tool use question than a security question – schroeder Aug 31 '16 at 17:16
  • 1
    In order to do this properly, you will have to decrypt the drive, create partitions and encrypt each partition individually. – Ramhound Aug 31 '16 at 19:30
  • @Ramhound: And then encrypt all partitions as single one? – user10232 Aug 31 '16 at 19:38
  • Please read my comment again.....and some more....just for good measure.... – Ramhound Aug 31 '16 at 20:04
  • @user10232 It looks like you have created a second account user12132, which will also interfere with your ability to comment within your thread and to accept an answer. See How can one link/merge/combine/associate two accounts/users? and/or I accidentally created two accounts; how do I merge them? for guidance on how to merge your accounts. – DavidPostill Aug 31 '16 at 22:04
3

We might know what OS you're using, but not any other random community member that may have this question / problem, so I'll make a guide for each!


Windows

First, decrypt the drive using VeraCrypt.

Next, press enter image description here+R to open "Run". Type in diskmgmt.msc.

In order to partition the drive, you need to first shrink your main volume / partition.

Right click on the main partition, click "Shrink Volume", and lower it's size to your liking.

Next, right click on the new 'Unallocated' storage. Click "Create Simple Volume" and size it to your liking.

Now encrypt \Device\Harddisk1\Partition0 and \Device\Harddisk1\Partition1 separately.


OS X (Mac)

First, decrypt the drive using VeraCrypt.

Press ⌘+Space in order to open Spotlight Search. Type Disk Utility and hit enter / return.

After selecting your external hard drive in the left bar, click partition in the top list of buttons.

Size your partition however you'd like, wash, rinse, and repeat!


Linux (coming soon)

I will update this answer after testing what I believe is the answer, to avoid messing up your computer.

| improve this answer | |
  • It's taken you a year and a half to test the Linux answer? – flith Mar 19 '18 at 8:45
0

On Windows VeraCrypt only:

  • Encrypts "containers"
  • Mount one "container" as a "volume" (assigning it a letter)
  • Containers can be: The whole disk as one large block, a partition, or a file

On Windows you will not be able to create partitions inside a mounted container, neither access them (see Linux to know how to create them).

On Linux, VeraCrypt can encrypt the same as Windows, but when mounting on Linux there is a very bib difference than on windows... on Linux the mountd is seen as a pure block device, so you can create partitions inside it (warning: Windows will not be able to access them).

Long HowTo (Linux) for a container with partitions:

  1. Create a Big file with VeraCrypt as a file container, or encrypt a partition or the whole disk (seen as one large block without partitioning).
  2. Mount it with VeraCrypt (let's say on /Path)
  3. Use fdisk, gdisk, etc on (let's say on /Path)
  4. Create partitions

That can be done on Linux, so you can encrypt a partition and put partitions on it.

Windows is much less restricted... containers (whatever they are) can only hold a filesystem (FAT type or NTFS file type) to be able to access them (in native mode).

So on Windows you can not have multiple partitions inside a VeraCrypt container, no matter if it is a File, Partition or the whole disk.

Side note: When you 'encrypt' with the VeraCrypt the whole disk you are not encrypting all partitions on it, you are destroying all partitioning... in other words... you are using all the whole disk as one contiguos area where is stored a FileSystem.

Bad Windows effefct of having whole disk encrypted (aka, not having at least one partition and so encrypt the partition) is when windows look at that disk, it will see the disk as not initialized (without a partition scheme) so it will ask you if you want to initialize it... and if you let do it, you will loose all data (better have a VeraCrypt header backup and a way to restore it)... sometimes i had seen Windows not asking and auto-initializing the disk.

So conclusions (for Windows):

  • Never ever, encrypt the whole disk, allways select a partition (or a file) as the container
  • Think that any container will be seen as a fileSystem, not as a block device, so it can not be partitioned
  • If you need more than one partition (with the same key) partition the disk before encrypt, then encrypt each partition with the same key (remember if you want to mount them all at once, create a script that asks for passphrase, etc and mount one by one by scripting... i do not remember if veracrypt favorites can be used for that, without depending upon system-encription mount)

So conclusions (for Linux):

  • Any VeraCrypt container mounted is seen as a full block device
  • You can put there directly a filesystem (without partitioning it), this is also Windows way
  • Also you can create a partitioning scheme MBR / GPT, and use LVM, LUKs, etc (this can not be done on windows, so if done on Linux, from Windows will not be possible to access).

Sample for a HardDrive0 with only Partition1 being encrypted with VeraCrypt (also aplies to any VeraCrypt encrypted file container):

  • Windows will hold inside only a FAT or NTFS filesystem (not a block device)
  • Linux can see that as a filesystem as well as a full block device

Hope now you have 'concepts' quite more clear.

P.D.: Yes, i do not know why TrueCrypt/VeraCrypt people did not do it as emulating a full Device on Windows, but remember that on Linux anything seen as a R/W block list can be partitioned (so it is not VeraCrypt, it is Linux the one that let you create partitions inside, also more, on Linux you can see a normal partition as a whole disk and so create a partition scheme inside a partition, and use a long chain of them, etc).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy