13

I want to dual boot Windows 10 alongside Arch Linux on 1 SSD. The SSD is 465GB and I want to use Veracrypt to encrypt the hard drive and enable pre-boot authentication.

I haven't attempted to do this as of yet as I cannot find any information about this on the Veracrypt website.

Would I have to wipe the drive, split it in to two partitions then install the respective operating systems on to their partitions? What about after that? I can encrypt the system using Veracrypt when I'm logged in to my Windows OS for example but would this encrypt the Linux partition as well?

Would they use the same pre-boot password and would I be able to choose which operating system to boot in to from Veracrypt's boot loader?

Furthermore, if I encrypt a non-system partition that is part of a different hard drive than which the operating systems are installed on, would I be able to access the encrypted partition from both operating systems without any trouble?

  • It works identically to how Truecrypt works. You really should just try to do it, when you run into problems, ask us specific questions then – Ramhound Sep 8 '15 at 11:17
  • 1
    Similar question on Veracrypt Ubuntu/Windows" askubuntu.com/questions/572793/… – StackAbstraction Sep 8 '15 at 23:26
2

No wipe needed. OSes are always on their own partition. Veracrypt can only encrypt a Windows system and only if using BIOS vs UEFI. The dev has stated that there are no plans for *nix systems support. If you want your Linux system encrypted, look into dm-crypt and LUKS. Also, you seem to misunderstand Veracrypt's system encryption capability. It doesn't support full-disk encryption; only the Windows system partition itself. The restore and recovery partitions are not encrypted.

If you have multiple Windows partitions (normal or hidden and normal), the bootloader should only show a password input field. It's your responsibility to remember the password and know which OS it unlocks. Each bootable partition would use it's own password. No idea what happens if you choose to put the same password for different systems.

As long as you have Veracrypt installed on both, you will be able to access Veracrypt-encrypted partitions on any drive connected.

  • Hi @Veranon, are you sure, Veracrypt cannot do a system encrypt for Linux? ( I searched extensively, finding neither a yes or no, just nothing in this regard). – Frank Nocke Dec 4 '15 at 8:36
  • Can somebody confirm, if I have (no Linux involed) a C (Windows) and D data partition (NTFS, used from Windows) partition, D isn't covered by system encryption?! – Frank Nocke Dec 4 '15 at 8:38
1

I did something like that with truecrypt and it should be possible with veracrypt too.

  1. Install windows
  2. give it the whole disk
  3. after installation encrypt with veracrypt telling it, that windows "is the only one" on the drive.
  4. After that restart your pc with windows, shrink your drive, make an additional partition
  5. restart again and install linux alongside windows
  6. make sure that the windows boot loader survives, so place the linux bootloader into the new partition and not into the mbr!
  7. Only thing remaining should be an entry in the windows bootloader pointing to linux bootloader.

It worked last time I did this with truecrypt. If veracrypt is the successor it should work, too.

But please be aware that there both systems can and will be seen in the bootloader. So no "plausible deniabilty" possible. So depending on your country, this might not be the solution you are looking for.

  • Tried it but failed,EasyBCD to add an entry in Windows Bootloader doesn't see the Linux partition. This is Win10 and Linux mint 18.3 – Zurd Jan 23 '18 at 5:10
0

VeraCrypt system partituon is just for Windows system partition.

That does not mean other partitions can be also encrypted, search for favorites in VeraCrypt for mounting your DATA partition automatically whith a system encrypted partition.

Also VeraCrypt can encrypt Windows & Linux partitions, and mount them, but with some points in mind:

-Windows version does not like well having partitions inside a container file -Windows version wants FAT32 or NTFS as the format for the encrypted (inside container file or partition) -Linux version can encrypt a partition and wih file containers you can also do fdisk inside them and divide into more than just one partition and format each of them with any linux filesystem -Linux version does not have pre-boot and so it can not encrypt (to be true can not boot) system partition

Concepts: -Pre-Boot is only availabe for Windows System Partition -Mounting a container (file or partition) on Windows supose the it will contain only one filesystem formated as FAT32 or NTFS. -Mounting a container (file or partition) on Linux is just as having a new block device where you can crwate partitions with fdisk when mounted Yes, on Linux you can have a physical partition of type encrypted by VeraCrupt and when you mount it for example on /mny/MyVeraCryptPartition/ you can do a fdisk to that path and create partitions inside it

To clarify this point better: VeraCrypt on Linux mount a container as if is a block device, most people do a mkfs on than mount point, but some of us do a full fdisk to divide it into partitions as well.

I did not test using command line on Windows, but i am afraid in Windows it is very limited.

To explain it more: On Linux you can do mkfs to /dev/sdb/ but it is not so common, most users also do not think such would be possible, but Linux let you do it. That is exactly what most users does after mounting encrypted containers (files and partition), create a filesystem on the whole block device, but Linux also lets you partition if by using fdisk.

I need help with: How to protect multi windows, i mean /dev/sda1 WindowsA, /dev/sda2 WindowsB /dev/sdaX Grub2 etc using VeraCrypt ! I find nothing about how to do it.

Other thing about 'private data', if you do not encrtpt 100% of all HDDs on the PC you can not be sure having private data not saved in 'plain' somewhere... SoureCode is not allways available for all apps, so where and what saves some apps? More memory dumps? SWAP? ALL must be encrypted, else you will let data be saved in plain text.

Worst, more and more moder disk (most in SSDs) use an internal translation sector to male sectors be re-writted the less as possible, so after a write you can not overwrite it becaise the hardware of the disk will save the data on another part less used, etc.

For a 100% secured system only one solution: -Put Grub2 on a USB, boot from it, then mount /dev/sda/ (yes the whole block device) as an on the fly encrypted volume, then mount from inside it the partitions, let the USB to be ejected, and do a boot from that partitions encrypted on the fly... so all bytes of the disk are encrypted. -Step 2: Fill all the free space with a random file, then delete it, this is to write all the rest of the data, so no plain part still resides (need to full fill it so be root and force no % for reserved)

Yes, i may be seen as a paranoid! But not, it is just the main idea of: i do not know where all applications saves the data and neither what data they save, and on windows it is impossible to be sure of anything, it is allways usimg pagefile no matter if there is free ram, some apps resufe to run if no virtual memory. Some apps saves data directly on first cylinder bypassing the filesystems.

Example: A word processing app, that crash and when re run pressent you what you had written and you did not ever saved, where does it save that data? Some of them save thar on temp foldrs, others on the folder where the app is installed, etc, it only depends on what the author had coded.

Just see LUCKs with negability!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.