VERACRYPT WHOLE DISK HOW TO

Most of the modern distributions installers offer the option to encrypt the disk grephically, so why do it from CLI? Well, the answer is in two words: more control. Using the LVM partitioning we won’t even need to create a partition table, we will use the raw disk instead. The only partition that must be unencrypted is the boot partition, so for the most secure setup, we will use an external device for it. The solution is to use LVM partitioning: we will encrypt the whole disk with LUKS, then we will use the disk as phisical volume and make it part of a volume group which will contain as much logical volumes as we need, each for every partitions we want. You could decide to avoid the use of swap partition or to use a random generated key, but in both cases you would lost the ability to hibernate (actually to resume from hibernation). You could encrypt them separately but then 2 passwords will be asked during boot time, and this is really annoying. Imagine you have your hard drive divided in at least two partitions: one for the root of your system and the other used as a swap partition.

VERACRYPT WHOLE DISK HOW TO

In this tutorial i will show you how to full encrypt your system using two linux native tools: LVM (for partitioning) and LUKS (for the actual encryption). Here is when system encryption comes in handy. You carry your device with you and don’t want to loose all your precious data in case it is stolen or lost.

While you can consider pretty safe your data on a home computer, on a laptop (or any portable device) the situation is a lot different. Security and privacy are two very important subjects, and everyone of us, in a way or another, has sensitive data stored on his computer.

Veracrypt whole disk