4

Possible Duplicate:
Is there a way to do full disk encryption after the install?

I have a ubuntu distribution (12.10) in my laptop, but i didn't encrypt my hard disk in the installation phase. It's possible that i could encrypt my hard disk without install everything again? And without loosing my files and programs already installed e configured? Thanks in advance.

Community
  • 1
João
  • 41

1 Answers1

2

The answer is probably no; full disk encryption (at least, using the native dm-crypt method) officially requires completely wiping the Ubuntu partition and reinstalling it inside an encrypted container. It is not possible to do this incrementally without employing third-party tools that come with a lot of disclaimers about the risks involved in this, e.g. LUKS In-Place

However, encrypting the whole disk tends to be unnecessary, since there is little security implication in having the standard parts of an Ubuntu system stored unencrypted. You may want to look at either encrypting your home directory (which should be possible without reinstalling, even if not easy), or just creating a single encrypted folder for sensitive files.

underscore_d
  • 293
chronitis
  • 12,367
  • 2
    ecryptfs is not used for full disk encryption, it's dm-crypt. – gertvdijk Dec 18 '12 at 12:18
  • 6
    Caveat: If the Ubuntu files are not encrypted, an attacker might be able to tamper with system files and thereby installing malicious code that spies on your files in /home once they've been decrypted by you on next boot up. – rmoestl May 15 '17 at 19:20
  • @rmoestl Isn't this true also with FDE? I am just a noob, but if I understand correctly /boot and the EFI partition must be unencrypted even in a FDE installation, leaving room for injecting code that steals the password at the next boot. – Federico Poloni May 23 '22 at 07:16
  • @FedericoPoloni I think that's why Secure-Boot was created; an attacker could tamper the boot binaries but then these won't be loaded, because they don't match anymore the original binary's GPG-signature. Only signed binaries can be executed in the boot chain. – Assuming that Secure-Boot is enabled... – Kamafeather Sep 23 '22 at 00:28