4 ms·

Full-disk encryption usually means encryption at the block layer below the filesystem. It doesn't actually have to cover the full disk. There is almost always

Full-disk encryption usually means encryption at the block layer below the filesystem. It doesn't actually have to cover the full disk. There is almost always at least one unencrypted partition on machines with full-disk encryption, since the boot loader and then the decryption routine have to be launched from somewhere. And yes, OEM recovery partitions or similar laptop-specific needs are another case. Full-partition would be a more accurate term than full-disk.

wereHamster 8y ago
I use full-disk encryption on my old thinkpad. As in, the whole disk is encrypted, from first sector to last. There isn't even a MBR or a partition table on it! I boot the laptop from my USB stick which contains the kernel and initrd. That's what I call full-disk encryption ;)
- CodeXs 8y ago
  I would love to see a post on how to set that up!
  - icelancer 8y ago
    DiskCryptor does it in Windows fairly easily and lets you install the bootloader to USB.
  - wereHamster 8y ago
    If you've ever installed gentoo, then it shouldn't be too difficult. Follow the installation steps but instead of partitioning the harddrive and installing into one partition, make the filesystem across the whole harddrive (eg. `mkfs.ext4 /dev/sda`) and install into that. The system on the laptop (Lenovo X61) is really old (like 8 years at least), back then I needed to perform some manual steps to ensure the initrd has the necessary tools so it can mount an decrypt the root partition, this is probably not necessary anymore. Upgrading kernels has to be done carefully, because I must make sure the USB stick contains a compatible kernel. I also need to configure the UEFI boot menu so that it knows where to find the kernels. Fun stuff. I wouldn't know where to start if you want to use ubuntu or another more user friendly distribution though.
  - dpg23 8y ago
    You _can_ do it with libreboot on ancient thinkpads, but it requires a decent time (or money) investment and some know-how. https://libreboot.org/docs/gnulinux/encrypted_trisquel.html https://libreboot.org/docs/gnulinux/encrypted_trisquel.html
- jkaplowitz 8y ago
  Cool. :) Even there, you do have some disk or partition unencrypted, it just happens to be on removable media. Good counterexample, though uncommon.
- btown 8y ago
  Just make sure nobody swaps out your stick :)

wereHamster 8y ago

I use full-disk encryption on my old thinkpad. As in, the whole disk is encrypted, from first sector to last. There isn't even a MBR or a partition table on it! I boot the laptop from my USB stick which contains the kernel and initrd. That's what I call full-disk encryption ;)

CodeXs 8y ago
I would love to see a post on how to set that up!
- icelancer 8y ago
  DiskCryptor does it in Windows fairly easily and lets you install the bootloader to USB.
- wereHamster 8y ago
  If you've ever installed gentoo, then it shouldn't be too difficult. Follow the installation steps but instead of partitioning the harddrive and installing into one partition, make the filesystem across the whole harddrive (eg. `mkfs.ext4 /dev/sda`) and install into that. The system on the laptop (Lenovo X61) is really old (like 8 years at least), back then I needed to perform some manual steps to ensure the initrd has the necessary tools so it can mount an decrypt the root partition, this is probably not necessary anymore. Upgrading kernels has to be done carefully, because I must make sure the USB stick contains a compatible kernel. I also need to configure the UEFI boot menu so that it knows where to find the kernels. Fun stuff. I wouldn't know where to start if you want to use ubuntu or another more user friendly distribution though.
- dpg23 8y ago
  You _can_ do it with libreboot on ancient thinkpads, but it requires a decent time (or money) investment and some know-how. https://libreboot.org/docs/gnulinux/encrypted_trisquel.html https://libreboot.org/docs/gnulinux/encrypted_trisquel.html
jkaplowitz 8y ago
Cool. :) Even there, you do have some disk or partition unencrypted, it just happens to be on removable media. Good counterexample, though uncommon.
btown 8y ago
Just make sure nobody swaps out your stick :)