0

I have to use LUKS to encrypt my entire hard disk, and in doing so, it will erase all data, so I must backup my disk first. I believe LUKS allows me to encrypt my entire disk, or do it by each partition. However, the former would be much easier, as I could just set up one LUKS encryption on the entire hard disk, then backup my entire hard drive, run LUKS, then just copy my entire backup to the now encrypted hard disk. The alternative is to setup LUKS separately for each partition, and backup each partition separately, which is a more tedious process and prone to more errors.

However, I'm worried that by setting up LUKS and/or backing up the entire disk, that the partition data will be erased, and all I'll have is just one single fat partition with all my data. Is this what happens when backing up? Or does backing up "remember" your specific partitions? Can I just forget about partitions, and trust that they will be restored on the LUKS-encrypted disk?

More details: My disk has 7 partitions. What makes matters a bit more complicated is that 3 of those partitions are windows, the rest are ubuntu. Is it still fine if I copy my entire drive with LUKS, even though its linux specific (I think)?

3
  • How do you intend to back up? I would not suggest that you attempt to back up an entire disk or partition, especially if it's encrypted. There are too many things that can go wrong. Instead, back up the contents of the disk and encrypt the backup.
    – Nmath
    Jul 10 at 2:51
  • I plan to just backup using the disk utility tool ubuntu has. This creates an image for the entire disk. I'm not sure how to go about doing what you said, I need the disk itself to be encrypted, per policy standards.
    – vw1262
    Jul 10 at 12:59
  • I never suggested that you shouldn't use encryption. If you are part of some organization that has "policy standards" for data, then you really need to be asking them how they want you to do this. There are lots of ways to back up sensitive data and encrypt the backups too. The method you're describing is unwieldy, inefficient, and has a huge surface area for potential problems. Please ask your organization for their best practices for handling and backing up sensitive data.
    – Nmath
    Jul 10 at 18:34

1 Answer 1

1

Edit: This is not technically an answer to the question itself, but rather an answer that this particular user needs. To everyone else who sees this: If you're looking for info about how full disk backups work, ignore this answer. If you're looking for info on this particular complicated disk encryption setup, here you go.

TL;DR: You cannot LUKS the entire drive in this setup. That's not how full drive encryption works. While it might be possible to set up multiple operating systems on the same drive, each one with its own encrypted partition, this could be very tricky, and you should have total backups of all your data before modifying your partitions in any way. Be prepared to have to start from scratch should things go wrong.

Long answer:

"Full drive encryption" is actually a misnomer. Unless you have a specialized setup or specialized hardware, you can't encrypt an entire disk and expect it to work, since there's vital data on most drives that must be available in a decrypted state for the drive to be usable. If you encrypted the entirety of a system's boot drive, you'd encrypt the partition table and bootloader, rendering the drive inaccessible and unbootable.

In order to achieve what looks like full drive encryption, an operating system will leave the partition table and bootloader unencrypted, then create a large encrypted partition. The majority of the system's data is then placed into this encrypted partition. Now that the system can load software from an unencrypted area of the drive, the software can handle the encrypted partition properly.

So when you use "full drive encryption", you're probably actually using this partition-level encryption. While there may be scenarios where an entire drive would be encrypted (partition table and all), they would not be scenarios that an end-user would be likely to run into due to the limitations those techniques carry.

The problem is further compounded by the fact that you have Windows and Ubuntu on the same drive. AFAIK, Windows cannot be installed directly onto a LUKS partition, nor can you encrypt a bootable Windows partition with LUKS. Windows uses BitLocker to do the same thing, which has the reverse problem - Ubuntu cannot be installed directly onto a BitLocker partition, nor can you encrypt a bootable Ubuntu partition with BitLocker. So in order to achieve total encryption in this rather sticky situation, you would need to use BitLocker on the Windows partition(s), and LUKS on the Ubuntu partition(s). As for how exactly one would do this, I'm not sure. This setup may also make it very difficult to troubleshoot problems in the future.

One last idea for you. Perhaps you can install Ubuntu as the sole OS on the system, then install Windows as a virtual machine? That would permit you to use LUKS on the whole drive, and would greatly simplify your setup, while also making it far, far easier to troubleshoot and fix should something go wrong.

Whatever you do, I strongly recommend that you back up everything first. You can set up an external drive with LUKS, then copy all of the files from your system onto the LUKS-encrypted external drive to back them up and encrypt them at the same time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.