I would like to know exactly what gets encrypted at install. If it is a Full Disk Encryption (FDE), then why is there an option to encrypt the home folder also? Or does FDE mean only operating system gets encrypted?



Nothing gets encrypted unless you tell the installation to do so. The most common scenario (which i strongly recommend) is to use LVM/LUKS and encrypt everything except /boot. If for some reason you do not want to do that, you can still encrypt your home folder by using the option you mentioned. Both options work great no matter if you re using EFI/GPT or MBR.



Both Full Disk Encryption and Home Encryption come with 16.04. All personal items are found in the home directory. A lot of people don't care if others see what programs they are using, some people do care.


Only Full Disk Encryption is standard with 18.04, Home encryption is gone from the installer.

After making an fully encrypted install to USB I examined the results with both Disks and GParted.

enter image description here


The encrypted extended partition was fully encrypted. Swap is a file within this partition, (and not a partition on it's own), and thus is also encrypted.

The Boot partition is not encrypted. The disk must first be booted before it can be decrypted.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.