6

I have an encrypted system disk pulled from a dead PC.

  • I do not have the rescue disk / ISO from when I encrypted the disk.
  • I do have the (working) password
  • The disk is fully functioning (i.e. not corrupt or broken)
  • I can plug the disk in to a USB enclosure and mount the individual partitions on another working PC and I can decrypt and read the data just fine.

However I would like to permanently decrypt all the partitions on the disk and it seems Veracrypt doesn't let you do that on a "foreign" system disk.

I don't care about the bootloader; I don't need the decrypted disk to be bootable, or if I do, I can add a regular MBR to it using something like Macrium Reflect.

So... does anyone know if it's possible to permanently decrypt a "foreign" system disk on another computer without using the original rescue disk?

I know I could simply mount the partitions individually on a working machine, copy the decrypted data to a third disk manually, then completely erase/format the encrypted disk and copy the unencrypted data back to it... but I'd rather avoid that since I don't have a third disk with enough free space to store all the unencrypted data.

2
  • 1
    There's no way to do what you want. Backup and format, that's it. – ChanganAuto Apr 18 at 15:15
  • 1
    @ChanganAuto Not true - I managed to get it working with a rescue disk created from another computer. See my answer. – Jeff Barnes Apr 18 at 18:07
5

I was able to do this in the end by following this procedure:

First you need a bootable Veracrypt rescue disk but this can be created from any unrelated computer running a Veracrypt-encrypted system disk:

  1. Boot a different computer which has a Veracrypt-encrypted system drive (annoying but necessary, apparently, since Veracrypt doesn't supply the rescue ISO as a download anywhere for some reason).

  2. Launch Veracrypt and choose System -> Create Rescue Disk and save it somewhere.

  3. Use Veracrypt's tool called VeraCryptUsbRescueDisk.zip to format a bootable USB drive. Alternatively you can probably use Rufus or something to do this.

  4. Place the EFI folder from your generated rescue disk on to that bootable USB drive.

  5. Boot the USB drive on your original computer with the encrypted disk attached (the one which you want to permanently decrypt).

    Note: I recommend you unplug all other disks from the system to make this process easier, although the program will apparently work just fine as long as you don't have more than one Veracrypt-encrypted disk plugged in with the same password. In that case I guess it would probably try to decrypt the wrong disk, or all the disks with that password.

  6. Choose the d decrypt option and enter your encrypted disk's password.

  7. The decryptor will find the disk matching the password and decrypt it permanently.

    Note: In my case it had a ridiculously long ETA (8 days) but it finished within an hour. Just watch the progress percentage.

It's interesting to see lots of people saying "this isn't possible", but it worked.

From my very limited knowledge of Veracrypt, I believe there is confusion arising from the fact that I was able to use a rescue disk created from one system to decrypt a system disk encrypted on a different system.

The reason it worked in this case - I think - is because I didn't need to restore the master key or the headers of the encrypted disk. So it didn't matter that the rescue disk was created on a completely different system - I knew the password, the disk wasn't damaged or corrupt - all I wanted to do was decrypt it permanently with the password. I guess the rescue environment allows you to do this whereas the GUI version doesn't.

Some suggestions for any Veracrypt devs reading this:

  1. Maybe offer a downloadable generic version / ISO of the rescue disk (without disk-specific embedded master keys) so that people in my situation can use the rescue environment to achieve stuff the GUI version can't achieve?

  2. Enable the GUI to permanently decrypt an encrypted system disk from a foreign system via in-place decryption?

Cheers

12
  • The question being "Does anyone know if it's possible to permanently decrypt a system disk on another computer without using the rescue disk?" this neither permanently decrypts it nor avoids using the rescue disk. – ChanganAuto Apr 18 at 18:45
  • ChanganAuto, I don't understand the message. Could you explain? – r2d3 Apr 18 at 19:35
  • 1
    @ChanganAuto It did permanently decrypt the disk. I'm using it right now, on a new machine. And yes, I had to use a Rescue Disk, however it was a rescue disk created from a completely different machine. – Jeff Barnes Apr 18 at 22:47
  • @JeffBarnes It isn't permanently decrypted because once you reboot you'll have to repeat the process. Encryption was NOT removed in any shape or form which was what your question, exactly as phrased by you, would have entailed. And, again, where the rescue disk was created is moot since your question explicitly mentions "... WITHOUT using the rescue disk". It seems that you don't understand your own question. That you did something that works for you as an workaround doesn't mean that's an answer... – ChanganAuto Apr 18 at 23:09
  • 1
    @ChanganAuto There might be some confusion. Have you read my edited/updated question and answer? It might clarify things. The disk is definitely permanently decrypted; it's been in and out of a machine and rebooted many times since. I stated that I don't have the rescue disk, i.e. the one containing the master key/header code specific to my original encrypted system disk. – Jeff Barnes Apr 19 at 2:13
2

I think that for an encrypted system disk, you need the Veracrypt boot loader to unlock the system encryption on that drive.

You may try to boot from that drive and remove the encryption, although this could take some time depending on the drive size.

If this doesn't work for you, then saving the data and reformatting the disk is the only solution.

1
  • 1
    Not quite true - I managed to get it working with a rescue disk created from another computer. See my answer. – Jeff Barnes Apr 18 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.