5

I have a machine with dual boot Windows 10 / Ubuntu 20.04. I would like to set up a new HDD (1 partition) dedicated for documents and other data - which I would like to have have encrypted, but accessible from both operating systems.

I presume that the preferred format for this partition is NTFS. But which way is currently most advisable for encryption, that is supported by both OS'es?

3
  • 1
    I would advice against this and follow the answer from C.S. Cameron it is about encrypting FILES and DIRs on a partition. bitlocker (used by windows by default) from inside windows will change the encryption key periodically and Ubuntu will not be informed about that requiring you to manually type the key ... "But which way is currently most advisable for encryption, that is supported by both OS'es?" None whatsoever.
    – Rinzwind
    Aug 23, 2021 at 8:22
  • 1
    @Rinzwind: Thank you, 7Zip is pretty simple to use and should do the job. AES-256 is AES-256 Aug 23, 2021 at 8:25
  • Have you considered WSL rather than dual-booting? It may be a lot more convenient for your workflows.
    – OrangeDog
    Aug 23, 2021 at 15:06

2 Answers 2

8

The only way I know of to encrypt a partition that is accesible both from Windows and Linux, without the need to constantly decrypt/encrypt your files manually, is VeraCrypt.

For a separate data disk with a single partition there should be no issues. As long as you're fine with unlocking/mounting the drive manually on each boot, it should be straightforward to set it up.

1
  • Thank you for this. Unlocking the drive manually on each boot is exactly what I want. The point is to keep the data inaccessible in case the computer/HDD comes into someone else's hands.
    – Rerun
    Aug 23, 2021 at 13:52
3

How to Make an Encrypted File / Directory

  • Install p7zip-full from universe repository

  • Right click file or folder and select Compress.

  • Confirm archive name and select .7z, then Create.

  • Right click .7z archive select open with Archive Manager.

  • Select three line icon upper right, click Password to create AES-256 encrypted archive.

Notes

You will need to install 7Zip to open archive on a Windows machine.

If Windows is involved I would use NTFS or exFAT, exFAT needs to be enabled in Ubuntu.

When opening a file in the encrypted archive a temporary file is created. In Windows, if the computer crashes or the archive is closed before the file, the temp file may remain in /AppData/Local/Temp/, (%TEMP&). Everything is okay if the file is closed before the archive. In Ubuntu the temp folder is /home/USER/cache/. The temp file seems to be deleted with a crash or when the archive is closed. The User should confirm this regularly.

The encrypted archive will expand as required.

Selecting and remembering a strong password is an important part of encryption security. There are many good articles about this topic on the internet.

HDD's, SSD's and flash drives can all brick without notice. SLC, (Single Level Cell) SSD's and flash drives have the longest life spans. It is a good idea to keep a backup drive and copy of the password in your safety deposit box.

A full tutorial on P7Zip-Desktop can be found at: https://www.how2shout.com/linux/how-to-install-p7zip-gui-on-ubuntu-20-04-lts/

7
  • I understand that "The Encrypting File System" is not very secure and does not work on Linux. The above is not very difficult. Enter a password to open the archive and close it when done. Aug 24, 2021 at 1:48
  • 1
    you cannot read or write anything in the archive without first extracting it to a different unencrypted file. It's fine for storage, but not for actual usage.
    – OrangeDog
    Aug 24, 2021 at 9:44
  • OrangeDog: Once p7zip-full is installed, I open the .7z archive with Archive Manager, it asks for password, then a "Files" style window is open and I can work on and save archive files just like with nautilus. It asks me to confirm Update when saving. Once the .7zip archive is open all seems normal to me. I am talking about p7zip-full not p7zip-desktop. Please give it a try. Aug 25, 2021 at 5:04
  • That may appear to work for desktop usage, because it is extracting things to temporary files and opening those for you via a Nautilus plugin. From the command-line, or anything else that doesn't have GUI file-browser integration, you have to do it manually. You should also audit whether it cleans up the temp files automatically, otherwise that's very insecure.
    – OrangeDog
    Aug 25, 2021 at 8:41
  • 1
    That's talking about temp files when you extract to a specific location. If you do what you are doing ("in-place" access) then it must first extract the content to a file. Please stop recommending things that you have no idea what they do.
    – OrangeDog
    Aug 25, 2021 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.