Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Given the following system:

/dev/sda1 Windows, encrypted using TrueCrypt
/dev/sda2 /boot
/dev/sda3 /, encrypted (LUKS or how it is called)

I now need GRUB2 to boot my truecrypt mbr ): Any hint on this? I found some guides for GRUB2 and TrueCrypt, but they all assume that the linux root partition is not encrypted, which is the case in my situation ):

share|improve this question
What is your current bootloader? How are you booting Linux/Windows now? – izx Jul 9 '12 at 23:14
Linux not at all as time of writing, but see my answer below for more details ;-) – Jul 10 '12 at 13:19 can your sollution be used after encrypting windows? and what do you mean "make windows partition active"? – genek Apr 16 '15 at 14:35's solution is the one recommended all over the Internet. It would not work for me. At all. But I found another solution, which did work for me.

Essentially, you chain-load GRUB2 to load SYSLINUX, which in turn boots the TrueCrypt Rescue ISO image, which allows you to boot into Windows.

I have documented the full details here. The summary version, though, would be:

  1. Install syslinux:

    sudo aptitude install syslinux
  2. Copy files into place:

    sudo cp /usr/lib/syslinux/memdisk /boot/
    sudo cp TrueCrypt\ Rescue\ Disk.iso /boot/truecrypt-rescue-disk.iso
  3. Determine the UUID of your boot partition:

    sudo blkid /dev/sda2

    Output should look something like this:

    /dev/sda3: UUID="12345678-1234-1234-1234567890"

  4. Configure GRUB2:

    Add the following to /etc/grub.d/40_custom:

    menuentry "TrueCrypt ISO boot" {
        insmod part_msdos
        insmod fat
        insmod ext2
        insmod search_fs_uuid
        search --fs-uuid --no-floppy --set=boot [UUID without quotes]
        linux16 ($boot)/memdisk iso raw
        initrd16 ($boot)/truecrypt-rescue-disk.iso
  5. Re-load GRUB2 configuration

    sudo update-grub

Note that this will show you the [F8] Repair options every time you boot into Windows, as we're fooling the system booting the TrueCrypt Rescue CD image from the hard drive, rather than the "normal" TrueCrypt boot method. But it seems like a small drawback to me (and might even be considered an added feature!)

share|improve this answer

Solution: Before encrypting windows, install GRUB2 to /boot using

grub-install /dev/sda2 --force

Ignore the warning. Then install Truecrypt, make Windows partition active (e.g. using diskpart on windows 7 setup cd). ESC in TC bootloader now leads to grub - all fine :-) Mounting the encrypted root using luks from a live cd and instal grub2 using chroot should also be possible, I forgot this simple solution.

share|improve this answer

Flimzy's answer didn't work for me, and I did not feel like spending hours decrypting and re-encrypting Windows to try's suggestion. Out of desperation, I tried fiddling around in the Grub command line, gave up and typed exit to go do something else, and was presented with the TrueCrypt bootloader.

I was stunned.

I edited my /etc/grub.d/40_custom file to read

menuentry "Windows 7" { exit }

And it totally works.

Obviously YMMV, but here's my set up: TrueCrypt-encrypted-Windows owning the entirety of one disk, and Linux and Grub 2.02~beta2-29ubuntu0.1 owning the entirety of another disk. My Dell BIOS is set to boot from USB, then CD, then the Linux disk, then finally the Windows disk. I'm not sure how or why this works, but I'm happy it does.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.