1

When employing full disk encryption, should hard drives be encrypted prior or post the installation of an operating system?

If the former, is this supported by operating systems such as Microsoft Windows and Linux?

Does this or can this improve the security of the device? If yes, how?

Is there a particular method of encryption that should be considered?

  • @kelakala - Yes and the intent is to store sensitive data. – Motivated Dec 29 '18 at 17:54
  • @kelalaka - I have updated the question as to provide a view on the method on achieving the outcome as opposed to presuming a method. – Motivated Dec 29 '18 at 17:59
  • As an example, Ubuntu 18.04 supports its own disk encryption during OS installation: askubuntu.com/questions/1029285/ubuntu-18-04-disk-encryption – Filipe dos Santos Dec 29 '18 at 20:40
  • @FilipedosSantos - I assume that this isn't different to Microsoft Bitlocker. – Motivated Dec 30 '18 at 0:13
  • @Motivated If you mean 1:1 equal, no, nothing of these Linux things is Bitlocker. LUKS (and any other dm_crypt usage) and Veracrypt are conceptually similar to Bitlocker, but each of them can't work with the other two formats ... (And then, in the link and its own links, there are still other things mentioned that are not disk/partition encryption but rather file-per-file-encryption, which are better not mentioned at all, because then we'd have to talk about MS EFS too :D) – deviantfan Dec 30 '18 at 1:25
2

In principle, it can be done both ways, just one is more complicated.
Namely, directly:

  • Wiping if there was sensitive data before (eg. with dd on a spinning HDD, or the builtin Erase feature of SSDs)
  • Installing the OS and choosing to encrypt the partitions there
  • Done

or

  • Installing the OS
  • Making a full backup to another medium
  • Using a LiveCD etc. to wipe the first hard disk
  • Create encrypted partitions there
  • copy the files back to the new encrypted partitions
  • Fix bootloader etc.
  • Wipe the second hard disk (the one that was used temporarly for storing the backup)

And it depends on the specific software that is used.

  • LUKS on Linux can be used during the installation already (depending on the distribution at least)
  • (not sure about Bitlocker on Windows right now)
  • Veracrypt (I don't recommend it for such things): neither Windows nor Linux support it out of the box, and of course it's not supported in their installer either. Still, encrypting the OS partition manually later appears to be possible now (at least for cases that are not too complicated), with some third-party tools.
  • ...

For "method of encryption", the default settings of LUKS etc. are fine (nowadays it's AES-XTS and so on).

And for the benefits on hard disk encryption, there are probably more complete answers out there, but in short: If the laptop is stolen and turned off, nobody can see your secret files. It does not help if the laptop is turned on. And if it was stolen and you get it back, you can't trust it even if it was encrypted.

  • Can you please elaborate on "Veracrypt (I don't recommend it for such things): either Windows nor Linux support it out of the box, and it's supported not in their installer either."? What is not supported natively? What isn't supported using Veracrypt's installer? – Motivated Dec 30 '18 at 0:11
  • @Motivated Sorry, that sentence was mixed up somehow, making it even harder to understand. ... Basically, Windows/Linux by themselves can't do anything with Veracrypt-encrypted disks. Veracrypt is a separate software that can be installed later. Then it works fine for things like external drives that are encrypted with it. ... However, this userland software won't help anything if someone wants to encrypt the partition with the operationg system - the OS kernel doesn't understand it, Grub etc. don't understand it, and anything else neither.... – deviantfan Dec 30 '18 at 1:36
  • ... Because fo this, until some while ago, it just was not possible to use Veracrypt for such cases. Now there seems to be a third-party software that adds another layer to the whole thing, so that the OS can work with decrypted data already and doesn't need to know anything from Veracrypt. However, judging from experiences from other people, it's a lottery if it works or not, and non-tivial things like multiple OS etc. are completely impossible with it. So, better not. And I can't think of any benefit of using Veracrypt for OS partitions either. – deviantfan Dec 30 '18 at 1:37
  • Thanks for clearing that up. Why does it matter if the operating system is unable to interact with Veracrypt once the drive is decrypted? – Motivated Dec 30 '18 at 2:25
  • @Motivated If this works, then it would not matter and everything would be fine. However, as said, "if" it works, and if it always reliably works, is not sure. ... LUKS/Bitlocker are much more reliable. – deviantfan Dec 30 '18 at 2:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.