Howto: Truecrypt, Encryption on the fly - Easily Protect and Encrypt your private data with truecrypt

The Goal:

Real simple in fact, anyone should be interested in protecting its own private data, and this protection can only be achieved using encryption.

But as for many things, protecting and encrypting your data often means complicating access and modifications of your files.

This won't be the case with this great and opensource solution able to encrypt/decrypt on the fly.

Truecrypt is definitively the best and the easiest solution i know to protect and encrypt your data, it's just working out the box ^^

Finally, with the growing of cloud services, in my opinion using this kind of solution is definitively recommended...

Imagine you want to save important and private data to an external USB key because you need it, with this solution you will in a few steps create a secured and encrypted key, and easily accessible. (on any system)

Finally, choosing an opensource solution instead of other software is a guarantee of transparency and continuity.

What you need:

Well, nothing...just a computer (any os, Windows, Linux, OSX...) and data to protect :-)
And yes Truecrypt!

I will show 3 cases of uses:

1. Create a secure and encrypted container (some kind of image file, stored in local or not)
2. Create a secure and encrypted device (USB Key, Hard Drive partition...)
3. Create a secure, encrypted and hidden container or device (Container file, USB Key, Hard Drive partition...)

Note:
Step 3 will produce an hidden encrypted container or device, that means in a few words an invisible and undetectable encrypted volume inside the main volume.

That way, someone that gains access to your main volume (you may have to reveal your password or someone cracked it) won't be able to access to your real private data.

You would have 2 passwords sequences, one for the main volume (which is still encrypted) and one for the hidden device.

First, install Truecrypt

No matters the system you're running on, Truecrypt is available for all OS, go to:

http://www.truecrypt.org/downloads

I won't cover the installation which is really easy (even for Linux ^^, no need for external software or dependencies)

Now that Truecrypt is installed, let's see some use examples of use!


Method 1: Create a secure and encrypted container

This is one of the solution you can use with Truecrypt, if a few words, you will create a container (which is just a file, like an iso or dmg for Mac users) that will encrypted and protected.

This container will mounted in your system like any external drive, any file you will store in it will be accessible and encrypted on the fly, so can add, remove or modify files without having to deal with anything related to encryption.

Open Truecrypt:

Click on "Create Volume" to open the Truecrypt wizard:

Let's create our container, click next:

At this point, we will create a standard and non hidden volume.
If already you are interested by the hidden volume, please go directly to the Method 3 example.

For the explanation, an hidden volume is an invisible and undetectable secured and encrypted volume inside your secured volume, by this way you could always be forced to give access to the secured volume without having to reveal the existence of the hidden volume.

This is feature is very great and powerful but may be a little complicated for the first use, this is why i prefer to do it in the 3rt method.

So we choose a standard Volume:

Select the location and the file name you want, optionally you can leave "Never Save History" set, it will tell Truecrypt to never save history of volumes mount.
In other words the location of the your container will never be shown inside Truecrypt. (for more security)

Note:
Please note that you absolutely choose any file extension you want, Truecrypt won't care about that, so just choose something common that won't appear as something that could be special or protected. (img, rar, zip, doc...what you prefer)

In next screen, choose your encryption algorithm:

In this section, you have to an encryption and hash algorithm, the most secured method will be using combinated algorithm, such as "AES-Twofich-Serpent".

Note that using combinated method requires more operation and CPU, and so offers less read and write speeds.

You can click on "Benchmark" to see read and write speed you will get with different methods available:

Just choose your method, if you want the best security you can choose "AES-Twofish-Serpent" and "SHA-512".

Then select the container size and click next.
Please note a container can't be resized later. (but still you can create a new one and migrate your data if required)

Set the container password and optionally key files access:

Using key files is optional but depending on your needs could be something really interesting.
With this feature, getting the password won't be enough to gain access to protected data, getting the key files will also be required, but off course if you loose your key files, you loose your data access.

The password needs to be really secured and complex, you should think about using a password sentence (a citation, proverb, whatever you want) in combination with a password containing various characters  (standards, alpha numerical, specials)

Then, set the file format:

If you are using Windows (or plan to access to your container from Windows), then choose Fat.
Otherwise Ext4 if you are using Linux.

If you are creating you device on Linux, next screen will ask you to choose the option for system crossover support, if you plan to access to your container for both system, ensure to use the crossover support.

Then follow the instruction and format the device, final screen:

Exit the wizard, your container is ready.

Mounting your encrypted container:

In main Truecrypt screen, select your container, provide your password (and key files if required) and mount your volume:

You volume is now available to read and write ^^

To properly close your container, select your volume and select "Dismount". (you can also choose "Dismount All" if this is the only volume mounted)


Method 2: Create a secure and encrypted device (eg USB key...)

A real simple and comprehensive example of use will be creating a secured and encrypted USB Key.
But this can also be any partition of an internal or external Hard Drive or SSD, Flash memory, any storage you want.

Note:
Please note that any data present on your device will be lost!

To begin:

• Connect your device
• Ensure you have one partition to use (remember data will be lost)
• Note the device name

Connect your device, open Truecrypt and click on "Create Volume", then select the required option:

Select the Volume type, again we will create a standard volume.

Then, select your device (in this example my USB device is seen under Linux as /dev/sdc1) :

Valid any warning message and choose encryption / Hash algorithm (see details in method 1).

The only difference with Method 1 will come at the device formatting step:

As the device hasn't been yet used as an encrypted device, you can let the box "Quick Format" unchecked. (which will result in encrypting also free space)

Then follow instructions and proceed to creating the device. (same than Method 1)

If you plan to use it on Windows, remember to select FAT as the file system and system crossover support if you created it on Linux.

Mounting your encrypted device:

Open Truecrypt, if you don't want to specify the name of your device, you can also choose the option "Auto-Mount Devices", it will scan your system and automatically detect your secured USB key:

Your device will accessible as any Volume, and you can do any operation you want.

To properly close your device, go in Truecrypt and select "Dismount All"



Method 3: Create a secure, encrypted and hidden container or device

Open Truecrypt and start the Volume creation wizard (Create Volume):

For the example purpose, we will create an hidden container, you can off course also choose to create a secured hidden device.

Select the device name and location:

As usual, select your Encryption and Hash algorithm, example:

Select the Outer Volume size, it is specific to hidden volume and will represent the global Volume size.

For the example, we will create a 1GB Volume:

Set the Outer Volume password, this won't be the hidden Volume password (where you will store you real private data) but the visible Volume password:

Next screen, Outer volume creation done:

Click Next to configure the Hidden Volume:

As for the Outer Volume, configure Encryption:

Select the Hidden Volume Size, this will the maximum space usable by the Hidden Volume inside the main (Outer) Volume:

Configure the Hidden Volume password, the password must be different from the main (Outer) Volume!

Choose file system option, example:

Choose crossover support, in my example case i used Linux to create the Volume so Truecrypt asks if i plan to use it on other systems than Linux, example:

Then format the Volume:

And exit the Wizard.

Mounting your device:

When you are using an hidden device, things are not much more complicated than with standard devices.

In fact, Tryecrypt will automatically mount the Outer or the Hidden device, depending on the password (Outer volume password or Hidden volume password) you will provide.

The only thing you have to care about is protecting the hidden device from being damaged when you mount the Outer volume.

To mount the main (Outer) Volume:

Open Truecrypt, select your file and click on mount, put your password and select "Option" to protect the hidden volume from being damaged by data copied into the Outer Volume:

Now the Outer volume is mounted, copy some data that could seem sensitives and umount it.

Then, using he same way but without the hidden volume protection option mount your hidden volume providing your hidden volume password.

And finally, you can manage your real private data in your hidden space.

Real powerful!

Howto: Truecrypt, Encryption on the fly - Easily Protect and Encrypt your private data with truecrypt

The Goal:

Real simple in fact, anyone should be interested in protecting its own private data, and this protection can only be achieved using encryption.

But as for many things, protecting and encrypting your data often means complicating access and modifications of your files.

This won't be the case with this great and opensource solution able to encrypt/decrypt on the fly.

Truecrypt is definitively the best and the easiest solution i know to protect and encrypt your data, it's just working out the box ^^

Finally, with the growing of cloud services, in my opinion using this kind of solution is definitively recommended...

Imagine you want to save important and private data to an external USB key because you need it, with this solution you will in a few steps create a secured and encrypted key, and easily accessible. (on any system)

Finally, choosing an opensource solution instead of other software is a guarantee of transparency and continuity.

What you need:

Well, nothing...just a computer (any os, Windows, Linux, OSX...) and data to protect :-)
And yes Truecrypt!

I will show 3 cases of uses:

1. Create a secure and encrypted container (some kind of image file, stored in local or not)
2. Create a secure and encrypted device (USB Key, Hard Drive partition...)
3. Create a secure, encrypted and hidden container or device (Container file, USB Key, Hard Drive partition...)

Note:
Step 3 will produce an hidden encrypted container or device, that means in a few words an invisible and undetectable encrypted volume inside the main volume.

That way, someone that gains access to your main volume (you may have to reveal your password or someone cracked it) won't be able to access to your real private data.

You would have 2 passwords sequences, one for the main volume (which is still encrypted) and one for the hidden device.

First, install Truecrypt

No matters the system you're running on, Truecrypt is available for all OS, go to:

http://www.truecrypt.org/downloads

I won't cover the installation which is really easy (even for Linux ^^, no need for external software or dependencies)

Now that Truecrypt is installed, let's see some use examples of use!


Method 1: Create a secure and encrypted container

This is one of the solution you can use with Truecrypt, if a few words, you will create a container (which is just a file, like an iso or dmg for Mac users) that will encrypted and protected.

This container will mounted in your system like any external drive, any file you will store in it will be accessible and encrypted on the fly, so can add, remove or modify files without having to deal with anything related to encryption.

Open Truecrypt:

Click on "Create Volume" to open the Truecrypt wizard:

Let's create our container, click next:

At this point, we will create a standard and non hidden volume.
If already you are interested by the hidden volume, please go directly to the Method 3 example.

For the explanation, an hidden volume is an invisible and undetectable secured and encrypted volume inside your secured volume, by this way you could always be forced to give access to the secured volume without having to reveal the existence of the hidden volume.

This is feature is very great and powerful but may be a little complicated for the first use, this is why i prefer to do it in the 3rt method.

So we choose a standard Volume:

Select the location and the file name you want, optionally you can leave "Never Save History" set, it will tell Truecrypt to never save history of volumes mount.
In other words the location of the your container will never be shown inside Truecrypt. (for more security)

Note:
Please note that you absolutely choose any file extension you want, Truecrypt won't care about that, so just choose something common that won't appear as something that could be special or protected. (img, rar, zip, doc...what you prefer)

In next screen, choose your encryption algorithm:

In this section, you have to an encryption and hash algorithm, the most secured method will be using combinated algorithm, such as "AES-Twofich-Serpent".

Note that using combinated method requires more operation and CPU, and so offers less read and write speeds.

You can click on "Benchmark" to see read and write speed you will get with different methods available:

Just choose your method, if you want the best security you can choose "AES-Twofish-Serpent" and "SHA-512".

Then select the container size and click next.
Please note a container can't be resized later. (but still you can create a new one and migrate your data if required)

Set the container password and optionally key files access:

Using key files is optional but depending on your needs could be something really interesting.
With this feature, getting the password won't be enough to gain access to protected data, getting the key files will also be required, but off course if you loose your key files, you loose your data access.

The password needs to be really secured and complex, you should think about using a password sentence (a citation, proverb, whatever you want) in combination with a password containing various characters  (standards, alpha numerical, specials)

Then, set the file format:

If you are using Windows (or plan to access to your container from Windows), then choose Fat.
Otherwise Ext4 if you are using Linux.

If you are creating you device on Linux, next screen will ask you to choose the option for system crossover support, if you plan to access to your container for both system, ensure to use the crossover support.

Then follow the instruction and format the device, final screen:

Exit the wizard, your container is ready.

Mounting your encrypted container:

In main Truecrypt screen, select your container, provide your password (and key files if required) and mount your volume:

You volume is now available to read and write ^^

To properly close your container, select your volume and select "Dismount". (you can also choose "Dismount All" if this is the only volume mounted)


Method 2: Create a secure and encrypted device (eg USB key...)

A real simple and comprehensive example of use will be creating a secured and encrypted USB Key.
But this can also be any partition of an internal or external Hard Drive or SSD, Flash memory, any storage you want.

Note:
Please note that any data present on your device will be lost!

To begin:

• Connect your device
• Ensure you have one partition to use (remember data will be lost)
• Note the device name

Connect your device, open Truecrypt and click on "Create Volume", then select the required option:

Select the Volume type, again we will create a standard volume.

Then, select your device (in this example my USB device is seen under Linux as /dev/sdc1) :

Valid any warning message and choose encryption / Hash algorithm (see details in method 1).

The only difference with Method 1 will come at the device formatting step:

As the device hasn't been yet used as an encrypted device, you can let the box "Quick Format" unchecked. (which will result in encrypting also free space)

Then follow instructions and proceed to creating the device. (same than Method 1)

If you plan to use it on Windows, remember to select FAT as the file system and system crossover support if you created it on Linux.

Mounting your encrypted device:

Open Truecrypt, if you don't want to specify the name of your device, you can also choose the option "Auto-Mount Devices", it will scan your system and automatically detect your secured USB key:

Your device will accessible as any Volume, and you can do any operation you want.

To properly close your device, go in Truecrypt and select "Dismount All"



Method 3: Create a secure, encrypted and hidden container or device

Open Truecrypt and start the Volume creation wizard (Create Volume):

For the example purpose, we will create an hidden container, you can off course also choose to create a secured hidden device.

Select the device name and location:

As usual, select your Encryption and Hash algorithm, example:

Select the Outer Volume size, it is specific to hidden volume and will represent the global Volume size.

For the example, we will create a 1GB Volume:

Set the Outer Volume password, this won't be the hidden Volume password (where you will store you real private data) but the visible Volume password:

Next screen, Outer volume creation done:

Click Next to configure the Hidden Volume:

As for the Outer Volume, configure Encryption:

Select the Hidden Volume Size, this will the maximum space usable by the Hidden Volume inside the main (Outer) Volume:

Configure the Hidden Volume password, the password must be different from the main (Outer) Volume!

Choose file system option, example:

Choose crossover support, in my example case i used Linux to create the Volume so Truecrypt asks if i plan to use it on other systems than Linux, example:

Then format the Volume:

And exit the Wizard.

Mounting your device:

When you are using an hidden device, things are not much more complicated than with standard devices.

In fact, Tryecrypt will automatically mount the Outer or the Hidden device, depending on the password (Outer volume password or Hidden volume password) you will provide.

The only thing you have to care about is protecting the hidden device from being damaged when you mount the Outer volume.

To mount the main (Outer) Volume:

Open Truecrypt, select your file and click on mount, put your password and select "Option" to protect the hidden volume from being damaged by data copied into the Outer Volume:

Now the Outer volume is mounted, copy some data that could seem sensitives and umount it.

Then, using he same way but without the hidden volume protection option mount your hidden volume providing your hidden volume password.

And finally, you can manage your real private data in your hidden space.

Real powerful!

Linux Howto: Clone your active system to get a N-1 OS version available in case of update troubles or instability

If you are in the same situation as i am, your Linux XBMC Box became the Multimedia center for all the family, let's say it's now in "production" and as any client would, they won't accept any downtime due to system or application upgrade issue :-)

There is off course several solutions you may use to backup and restore your system if required, in my opinion the easiest is to have a secondary N-1 version system available and ready to run in case the last update you absolutely had to applied (because you're such a geek you cannot keep running an outdated system ^^) broke your nice and stable installation!

Naturally, this will be applicable for any Linux installation.


************************ CAUTION ***************************************************************

These operations may easily break your system if you don't pay attention, 
please follow this Howto with many cautions and very carefully!


*************************************************************************************************

Methods and requirements:

I recommend the following method using "partclone" to clone your system.

First and in any case, ensure you have a secondary partition with a size strictly identical to your base system. (obligatory for partclone)

This secondary partition will be uased by our cloned system.

Also, i would recommend you install "/home"' under a dedicated third partition.

So, let's say as an example you installation is partitioned that way (all formatted in ext4) :

• "/dev/sda1" is your main OS installation
• "/dev/sda2" will be your N-1 OS version
• "/dev/sda3" is your "/home" partition

Note: With partclone, your 2 system partitions must have strictly the same size, use Gparted when you are in your Live OS to modify your partitions as required, you resize, create move and so on.
But be careful, you can easily break everything if you don't pay attention ^^

Clone your system with partclone

Limitations and constraints:

You can't clone a partition being used and mounted, so the easiest method is to use a USB Live Distribution you will use to boot and clone your system.

This is very easy, just download any Linux distribution (i recommend Xubuntu) and use "Unetbootin" to create the Live USB key.

Also, ensure your live system will be able to access to Internet as you will need to install some packages.

Step 1: Boot to Live OS

Insert your Live USB Key and boot the system, when the system is ready install some requirements:

sudo apt-get install partclone

Notes: Ensure you are connected to Internet before the apt-get, no need to update first but you also can do it if you want

Step 2: Clone the system

Recommended:

I recommend to first backup the partition to an external image you may need later and after that restoring it to the secondary partition:

First check and correct the filesystem if required:

sudo fsck.ext4 -yf /dev/sda1

Clone sda1 to an external image:

sudo partclone.ext4 -c -d -s /dev/sda1 -o <MY DESTINATION FOLDER>/sda1_partclone_ext4_MMDDYYYY.img

Restore sda1 image to sda2 partition:

sudo partclone.ext4 -r -d -s <MY DESTINATION FOLDER>/sda1_partclone_ext4_MMDDYYYY.img -o /dev/sda2

Step 3: Update secondary partition UUID and Label

This a very important operation, i you don't update the secondary partition UUID, it will have the same than your first OS and you can be sure you're going into big troubles!

Install requirements:

sudo apt-get install uuid e2label

List actual UUID, sda1 and sda2 have the same UUID and same label which is really is bad thing:

sudo blkid

Note: You can also use the command "sudo tune2fs -l /dev/sda1 | grep UUID"

Output example before update:

/dev/sda1: LABEL="SYSTEM1" UUID="affe0f48-6b88-43a5-b131-20a58cd776b8" TYPE="ext4"                                                          
/dev/sda2: LABEL="SYSTEM1" UUID="affe0f48-6b88-43a5-b131-20a58cd776b8" TYPE="ext4"

Update "/dev/sda2" UUID:

sudo tune2fs -U `uuid` /dev/sda2

Update "/dev/sda2" Label:

sudo e2label /dev/sda2 SYSTEM2

Check and note the new configuration:

sudo blkid

/dev/sda1: LABEL="SYSTEM1" UUID="affe0f48-6b88-43a5-b131-20a58cd776b8" TYPE="ext4"                                                          
/dev/sda2: LABEL="SYSTEM2" UUID="8e1e225a-d51e-11e1-b5aa-00012e409020" TYPE="ext4"

Everything is fine, we have different UUID and Labels for both partitions, let's mount the secondary partition and update "/etc/fstab" with this new information:

Mount the partition:

sudo mkdir /mnt/sda2 && sudo mount -t ext4 /dev/sda2 /mnt/sda2

Edit "/mnt/sda2/etc/fstab" and replace initial UUID by the new one, in this example we replace:

UUID=affe0f48-6b88-43a5-b131-20a58cd776b8 /               ext4    errors=remount-ro,noatime 0       1                                       

By:

UUID=8e1e225a-d51e-11e1-b5aa-00012e409020 /               ext4    errors=remount-ro,noatime 0       1                                       

Save and umount the partition:

sudo umount /dev/sda2 && sudo rm -rf /mnt/sda2

Step 4: Reboot to main system and update grub

Notes: Os prober from Grub should be able to generate a functional boot configuration finding our cloned system in "/dev/sda2", for an unknown reason this doesn't work so i recommend a manual operation which will be more reliable.


Leave the Live USB system and reboot to the main system, then open "/boot/grub/grub.cfg" and copy main system boot lines to clipboard or a temporary text editor, in our example we will find the original kernel lines:

menuentry 'Ubuntu, avec Linux 3.2.0-26-generic' --class ubuntu --class gnu-linux --class gnu --class os {                                   
        recordfail                                                                                                                          
        gfxmode $linux_gfx_mode                                                                                                             
        insmod gzio                                                                                                                         
        insmod part_msdos                                                                                                                   
        insmod ext2                                                                                                                         
        set root='(hd0,msdos1)'                                                                                                             
        search --no-floppy --fs-uuid --set=root affe0f48-6b88-43a5-b131-20a58cd776b8                                                        
        linux   /boot/vmlinuz-3.2.0-26-generic root=UUID=affe0f48-6b88-43a5-b131-20a58cd776b8 ro   quiet splash $vt_handoff                 
        initrd  /boot/initrd.img-3.2.0-26-generic                                                                                           
}                                                                                                                                           
menuentry 'Ubuntu, avec Linux 3.2.0-26-generic (mode de dépannage)' --class ubuntu --class gnu-linux --class gnu --class os {               
        recordfail                                                                                                                          
        insmod gzio                                                                                                                         
        insmod part_msdos                                                                                                                   
        insmod ext2                                                                                                                         
        set root='(hd0,msdos1)'                                                                                                             
        search --no-floppy --fs-uuid --set=root affe0f48-6b88-43a5-b131-20a58cd776b8                                                        
        echo    'Chargement de Linux 3.2.0-26-generic ...'                                                                                  
        linux   /boot/vmlinuz-3.2.0-26-generic root=UUID=affe0f48-6b88-43a5-b131-20a58cd776b8 ro recovery nomodeset                         
        echo    'Chargement du disque mémoire initial ...'                                                                                  
        initrd  /boot/initrd.img-3.2.0-26-generic                                                                                           
} 

Add "(on /dev/sda2) behind the kernel version in "menuentry" and replace "msdos1" by "msdos2" and the old UUID by the new one and put these lines into "/etc/grub.d/40_custom", in our example our new lines will be:

menuentry "Ubuntu, avec Linux 3.2.0-26-generic (on /dev/sda2)" --class gnu-linux --class gnu --class os {                                   
        recordfail                                                                                                                          
        gfxmode $linux_gfx_mode                                                                                                             
        insmod gzio                                                                                                                         
        insmod part_msdos                                                                                                                   
        insmod ext2                                                                                                                         
        set root='(hd0,msdos2)'                                                                                                             
        search --no-floppy --fs-uuid --set=root 8e1e225a-d51e-11e1-b5aa-00012e409020                                                        
        linux /boot/vmlinuz-3.2.0-26-generic root=UUID=8e1e225a-d51e-11e1-b5aa-00012e409020 ro quiet splash $vt_handoff                     
        initrd /boot/initrd.img-3.2.0-26-generic                                                                                            
}                                                                                                                                           
menuentry "Ubuntu, avec Linux 3.2.0-26-generic (mode de dépannage) (on /dev/sda2)" --class gnu-linux --class gnu --class os {               
        recordfail                                                                                                                          
        insmod gzio                                                                                                                         
        insmod part_msdos                                                                                                                   
        insmod ext2                                                                                                                         
        set root='(hd0,msdos2)'                                                                                                             
        search --no-floppy --fs-uuid --set=root 8e1e225a-d51e-11e1-b5aa-00012e409020                                                        
        linux /boot/vmlinuz-3.2.0-26-generic root=UUID=8e1e225a-d51e-11e1-b5aa-00012e409020 ro recovery nomodeset                           
        initrd /boot/initrd.img-3.2.0-26-generic                                                                                            
}  

Update grub:

sudo update-grub 

Reboot from your main system and test booting to the secondary OS, it should boot with no problem and you will get exactly the same system than the main one.

You can test whatever you need in the secondary system such as important system and application upgrade without the risk of breaking down your main system.

Therefore, don't forget that if you have a third partition for "/home", any issue not related to the system partition but related to the home partition (such as deleting user's files) will off course exist in both systems!

So a best practice will always be to also backup the /home partition ^^

As now you have 2 systems available, if you want to update the secondary system, you don't have to boot again with a Live OS:

• Boot to secondary system
• Create the partclone image from primary system to an external image
• Boot to primary system
• Restore the external image to secondary partition
• Re do UUID change and fstab correction

Step 5: Optional - Home Directory

If you want to be completely independent of your first installation, you may also copy your initial main user home directory, example to "/home/user_system2".

Then just ensure to change the home directory in your second system by editing "/etc/passwd". (remember to adapt from where you edit it)

Feel free to comment :-)