Ubuntu Security :: TrueCrypt Volume Is No Longer Bootable
Jul 16, 2010
I installed TrueCrypt in Microsoft Windows XP SP3 (no Linux installations present) and I stopped the TrueCrypt service in the Windows enviroment, and then, I restarted, and all the sudden it seemed the PC can not see the Hard Disk at all at startup, nada... I believe I dismounted it by stopping the TrueCrypt service... So the PC no longer understands there is a TrueCrypt volume in place, and I inserted the TrueCrypt recovery disk, and it can not do any thing, I restored the bootloaders, the true crypt loader, and once I finished this, I press ESC, and it says there are no bootable devices, so nothing. I even decrypted the disk, and it seemed that nothing happened with the restore disk...
Is there any way I can make this partition bootable again? because I have every thing in that partition, every single bit of life... I have used TestDisk under Linux right now, but I am unsure of this, and I also further complicated the boot proccess, and now the PC states at startup about missing partition tables. When I start truecrypt from this Kubuntu live CD, I am unable to see the encrypted hard disk even with root, there is no way to see this hard disk, only can be seen in the TestDisk app. I really I am desperate, at least, if I can not make Windows Boot again, maybe just suck all the files out of the hard disk and put them some where for now, I really need to get back to work, and I cant seem to find a solution...
I know here at Ubuntu forums, some one may have the solution. And I do know for sure all the files on this volume are there because of the TestDisk app, so they are there, they are just not reachable.... (I have posted this problem on a Linux forums instead of a Windows forum because the only way to try to recover the volume is with Linux Kubuntu Live CD
I installed TrueCrype 6.3a on my 8.1 Ubuntu. Everything went fine until I got to the part where I need to protect my hidden volume from damaged caused by writing to the outer volume (these instructions: [url] ). I can't find the checkbox to "Protect hidden volume from damaged caused by writing to outer volume". The closest thing I can find is an option to "Protect hidden volume when mounting outer volume". Intuitively these don't sound the same to me. There are 2 difference between my setup and the instructions; 1) the instructions appear to be written for Windows and not Linux. 2) I am using a file volume and not a partition volume.
Does anyone know where the option is to protect the hidden volume when writing to the outer volume?
I have a 2nd hard drive that I have encrypted using true crypt. Is it possible to set this up with key files (or some other way) to auto mount when linux boots. I need it in true crypt because there are some work programs I dual boot to use in windows, and need to have access to the drive in XP from time to time, and true crypt can mount there as well. But 90+% of my time is in linux and I would like to have it auto mount through fstab (or whatever way it needs to be). My entire linux setup has been set up with encryption through dm crypt and LUKS (except for /boot). So I would think having a key file stored on the computer and an auto mount fstab would be just as secure as however secure my LUKS setup is. So any way to auto mount a true crypt 2nd drive volume?
This one being Ubuntu 9.10 (yes, I know I really should upgrade). I keep a number of confidential files in a TrueCrypt container which is a standalone file in my Documents folder. I'd like to delete some of these, but I want to do it as securely as I can, but I believe if I simply hit 'Delete' with the file selected it'll move the file to the Deleted Items folder. This, I assume, means that the file is taken out of the encrypted volume and stored unencrypted in the Deleted folder.
I've been reading a little about the Shred command, and there seems to be some question about whether it works effectively with a journalled file system; and since I have no idea whether I'm using a journalled file system, or how to find out, I'm treating Shred and other over-writing secure deletion tools as ineffective for now.
With this in mind, can anyone advise me how I can protect the file stored in the TrueCrypt volume, and delete it in place, without taking it out of the encrypted area? And, further to that, can anyone tell me whether in fact the file is actually secured while it's in the encrypted volume? For all I know, just opening the volume may result in copies being made somewhere (apart from RAM).
If one uses a free ftp account to store private data such as bookmarks, they might prevent any eavesdropping by using ssh for the transfer (ftps), or alternatively sftp.
However, they would still have to trust the ftp hosting provider, because the data is stored unencrypted in the server.
Someone suggested putting all bookmarks in a small truecrypt volume instead and synchronizing this with the ftp server.
Performance issues aside, given that the plaintext only changes a little in each resync (only a bookmark is added usually), is the use of the truecrypt volume introducing a means for an eavesdropper to break the code?
I have an Ubuntu 10.04 machine at home and apache setup on it (files are located in a Truecrypt volume). The reason for the web server being that I wanted to access my files wherever I'm at (i.e. hotel, work, hotspots, etc...). So far, it's worked out great for me seeing as a I can http download my files (or stream media files). However, I am often on a public hotspot and I know it's a matter of time before someone finds the webserver on my computer. I have the machine firewalled and password protected (via .htaccess), but either way I don't want people looking in on my computer.
The problem: I have used Truecrypt for a long time and completely trust using the program to encrypt/unencrypt a volume container to store my files. Usually, I would remote desktop into my computer and mount/unmount the volume when I needed it. However, after time it get's really annoying to do this. So I eventually figured out how to setup a bash script to automatically do this for me (which I put on the usb part of my phone). What I wanted to do was to be able send the bash script to my Ubuntu machine (via ftp from my phone) and have Ubuntu automatically run the script. Is this possible? What programs do I need on Ubuntu?
I was thinking about using something like cron, but that is for scheduled times. I don't really have a set time in which I need my files, it's pretty sporadic depending on how much I travel. Thus the need for being able to remotely mount the volume when I need it.
Summary: I need a way for Ubuntu to read a folder every minute or so to check for bash scripts to run. I want to be able to send the bash script via ftp from my phone, have Ubuntu run the script, then delete itself (so as to not store the password). I already know the script in which to mount the Truecrypt volume and how to send the file via ftp from my phone. It's really a matter of what program to use in Ubuntu to find and run the script.
I mount truecrypt ntfs hidden volume in Slackware, i can read but i can't write to it. It shows "Operation not permitted". I can read and write from other distro without any problem.
I have a dd image of a full drive (as a file) that was using Truecrypt system encryption under windows. I want to mount the main partition from that image using Linux's Truecrypt. I am familiar with dd loopback devices and have the partition offset, but I don't know how I can mount it like this because I need to use the truecrypt command.
Is there perhaps some way to create a fake device file for the disk image that I can mount from within Truecrypt?
I have created a TrueCrypt volume, mounted it in Windows, and created an image file for my OS partition using Macrium Reflect (free version). I made a Rescue CD for Macrium, and the setup works great on unencrypted files, but I have no way to mount the TrueCrypt volume, while booted to the Macruim rescue CD. I have Puppy Linux 4.3.1 on a CD, and can boot to it. I'm a beginner's beginner, however, and I haven't figured out how to install TrueCrypt with Puppy Linux running. Getting the Macrium recovery program to run with the TrueCrypt volume mounted looks even more complicated, and I don't know if it's even possible. I want to be able to recover my laptop from a drive failure, as well as protect my OS from bad programs or malware. Macrium reflect does this job well, because it:
1. is free
2. only writes the used space of the system partition to the image file, and also compresses the data, resulting in a relatively small file. (~ 50 percent of the used space on the OS partition)
3. retains drive alignment for a pre-aligned partition.
However, I wish to keep my backup partitions encrypted to protect my privacy. TrueCrypt does an excellent job of this because it:
1. is free
2. encrypts the OS and all data on the computer.
3. protects all backup data.
I like the fact that Puppy Linux can be loaded into memory, so I only need to boot from removable media to work on my OS partition. I understand there is a portable Ubuntu OS, and perhaps this would be a better platform for my goal? Is there a way to combine Linux on removable media, with Macrium Reflect, and recover an image from a TrueCrypt volume?
I've been looking at setting up truecrypt on my laptop, but the guides on the truecrypt site and the ubuntu documentation seems to be incomplete or not address what i want to do.
What I have:
dual boot windows 7 / Ubuntu (lucid)
What I want is to dual boot with the hidden OS system:
Windows 7 (plausable) Ubuntu (plausable) Ubuntu (hidden install)
Is this possible? or is it better to make a hidden /home partition?
I work for a all-in-one IT company, basically businesses hire us and we will fix all their problems from servers to pencil sharpenersI want to get some background with UNIX so i wanted to multiboot linux on my laptop and use it for a few weeks. After a few hours of trial and error i managed to install it! So to the point: i used Truecrypt to encrypt my laptop and it used a special boot loader that made me input the password just after the post.My question is, can i use Truecrypt with a multiboot 7/ubuntu? After it took me hours to install this , running into and trouble shooting various problems that were probably just my ignorance, but Linux feels very fragile and i do not want to screw it up.
TrueCrypt offers 3 hashes for use: RIPEMD-160, SHA-512, WHIRLPOOL.What do most people use? How does one go about deciding which one is appropriate for them? Do they differ in security or performance?
When you are creating a TrueCrypt partition it asks what filesystem you will be using:
None FAT EXT2 EXT3
This is fine if you decide to create your partition on Linux but I am wondering what you would do if you wanted to create it on your XP partition and access it through the mounted drive. My XP is NTFS and that option does not appear.
my current plan is to create a truecrypt container with the whirlpool hash. This container will be located on a hdd that is not where my OS will be located (so a separate physical sata drive).My concern is when this container is accessed, that some of the password information could be stored in my swap partition (which is on the main drive where the OS "/" is located)
I would like to have a script or command I could run that after I unmount those drives (or just halt the system) that my swap (and ram too if possible) could be wiped (or like overwritten with the shred command). Also, am I going about this the right way, or should I just use truecrypts FDE on the entire drive? In addition, when Ubuntu does it's default install, does it create a swap file in addition to a swap partition? If it does, would that be another vulnerability? If it is, how do I prevent this from happening?
I welcome any input you have on this. I am aware that once the drive is mounted, it is vulnerable, but I want the data to be secure as possible once my computer is turned off. Also, I have read that there are ram exploits where it holds your passwords for up to a few minutes after you turn the machine off, does anyone know how long that it and is there a way to clear it, or will only time let it fade?
I'm simply interested in a more basic discussion of why one would choose one of these methods over the other. What do they offer that the other does not? I'll start with what I know:
- dm-crypt/LUKS --- included in a lot of install images already; in other words, perhaps easier to implement on a fresh install - TrueCrypt --- multiple encryption algorithms possible
[code]....
For me... I have no need for Windows compatibility, though I do use OS X on a dual booting MacBook. I believe TrueCrypt woks with OS X, so that could be a bonus, though I can simply encrypt my home folder on OS X with it's own FireVault and be fine.My setup (after wiping and starting over) will probably be like so:
- /boot on it's own primary partition - / on it's own primary partition with logical partitions within --- /usr, /var, /etc, /opt, and the like on a logical partition --- /home on a logical partition
/home will surely be encrypted and I'm leaning toward encrypting the rest as well, though perhaps it's not necessary. I'm open to input there as well -- is there anything the leaks from normal application use into /var or /tmp that would make one lean toward just encrypting the whole thing?
I opened up TrueCrypt just to look at it and since I can't encrypt a whole partition without losing data... I pretty much have to encrypt from what? A live CD? This could be a drawback -- I think since TrueCrypt isn't coming on install disks, I'd have to go with an unencrypted (or dm-crypt/LUKS) root partition and then use TrueCrypt to make a container (or partition) for /home only. I can't think of another way to do this since I can't encrypt the whole disk as one entity with my dual booting situation...
So what I want to do is encrypt my entire hard drive, but heres the thing.
I dual boot Ubuntu and windows 7, but I am afraid that if I use truecrypt to do the encrypting that it will wipe GRUB and not allow me to boot into any OS, is that a possibility and is there a way around it?
I have a Truecrypt-encrypted Windows [system] partition, that I want to be opened and mounted automatically (using a keyfile) when I log into Debian, since it is also encrypted and I don't want to type two passphrases. It think this could be done with LUKS. With TC I probably have to go with the CLI, but haven't figured it out yet. And I can't add a keyfile to the volume using the GUI. In order to mount the volume I have to tick the Mount partition using system encryption (preboot authentication) checkbox, or otherwise I get Incorrect password or no TrueCrypt volume found. And same when I try to add a keyfile.
I'm having problems getting TC to load grub2 1.97b4. When I hit ESC from the TC boot prompt, I get "no bootable partitions found".
I also booted into Ubuntu Live cd, mounted my LVM dm-crypted volume and tried to reinstall grub2 to my nonencrypted /boot under /dev/sda3 and TC still wont boot. Then I set the boot flag on /dev/sda3 and it still won't boot.
These are the commands I used to install grub2 to my /boot partition. Atleast that's what I think it did.
i got opensuse 11.2 (gnome) and created a hidden volume with truecrypt on it. i would like to install nicotine on the hidden volume now,an only run nicotine while it is mounted. i only know how to install stuff with yast, i have no idea how to handle the terminal. i tried but its more like stumbling around. yast always puts the program into the standard menu where i dont want it to be. and by the way,how to disable the autostandby on my monitor? i tried already, but it didnt work)
I have been trying for close to 7 hours now to create a working encrypted bootable usb key for debian now.
I start by running the debian installation dvd (1 of 3. I downloaded and burnt all three ISO's that I found here: [URL] .... (2015-06-06 17:33) to disk), and when I get to the partitioning part, I cannot get an encrypted volume that will hold the root filesystem.
Here is what I have tried:
I have tried the Guided partitioning option to use the entire disk and set up encrypted LVM, to no avail.
I am left with a primary boot partition of 254.8 MB, at ext2 with /boot mountpoint on it, and a logical partition of 15.8 GB, with crypto as it's file system that says it's "not active". This bit here seems to be a running theme as I keep coming back to this set up, (give or take some space arrangement). From what I've read and seen, I should be seeing an Encrypted Volume container similar to LVM, but called an "Encrypted Container" that I can create additional partitions in like / and /home, and what have you.
And I can't "activate" the partition either. I have tried both the Configure Logical Volume Manager, which changed the partition to an LVM partition that dosn't encrypt anything inherently (and I have checked), and I have tried the Configure encrypted volumes option, which leads to the same results basically.
I have tried manually creating the partitions, a 512 MB ext4 /boot partition and then partitioning the rest of the space as "physical volume for encryption" with aes encryption, 256 key size, xts-plain64, Passphrase encryption key, erase data flag, bootable flag off.
Same result, 1 primary boot partition, 1 logical (I later tried making it a primary partition to, with the same results) crypto volume that is "not active".
I also tried setting up the a logical volume manager, which created a container to create additional partitions in which I could encrypt, but it was either a partition dedicated to something (i.e. root (/) or /home, or /swap, etc) or it could be encrypted, but not both. I even tried creating a root partion, and then selecting Configure encrypted volumes, and then selecting the root partition, and here is where I thought I was getting somewhere, because then it comes up giving me all the same options above, but it also specifies mount point under encryption. Which is /, which is what I'm after. So I accept that, and it goes back to being crypto, "not active" and when I check the partition again, the mount point option is gone.
Last thing I tried was going back to having a 512 MB /boot partition, and an encrypted partition set up with Configure encrypted volumes option, and then specifying the encrypted partiton with the Logical Volume Manager as the place to create logical groups and volumes, to little avail. I can create more volumes that are either encrypted, or a useful non encrypted volumes like / (root), /home, /swap, and the like, but not both at the same time.
Following this guide: [URL] ....
This leads me to a useable system, but the system wasn't encrypted. When I booted, I wasn't asked for a passphrase, and I checked the stick with my old linux mint dristro, and I was able to mount the logical volume and look at the contents, /etc, /home, /var by activating the partition in GParted and mounting it.
A number of users seem to mark an encrypted partition as lvm and then create more logical volumes within that that either actually become encrypted, or they don't check. I'm not sure which after my testing.
[URL] .....
I have also read this: [URL] .... and this [URL] .....
I found this which shows the container I believe I should be seeing if I do this right, but I can't get it : [URL] ....
I have also watched movies on youtube about it : [URL] ....
Could the issue be that I'm using a Lexar JumpDrive? 16 GM USB 3.0.
I've gotten debian to run off of it on it's own so I kind of doubt it.
I found a way some times ago to mount a truecrypt volume when opening the session by insertion of the login password in the mounting script instead of putting it in clear in the script. I don't remember to command to read/transfer the password.
I have two questions regarding auto mount function of Truecrypt. First question:
I want to automatically mount my flash drive encrypted by Truecrypt using a keyfile whenever I plug the drive. How can I do this? I use Ubuntu 10.10.
Second question:
As I do not know the answer of my first question, I currently use following command in a startup script to mount my encrypted flash drive automatically at every system start-up.
My problem with this method is, Truecrypt always search for the drive in the same path saved in favorite drives list, e.g. /dev/sdb1. However sometimes there are more than one flash drive plugged to my computer and my encrypted drive's path changes. In such cases Truecrypt cannot mount my encrypted drive because it cannot find the drive in its path.
As a workaround I tried "auto-mount=devices" parameter. It is slow because it checks every mounted drive, and some of them external hard disk big in size. Moreover it does not recognize any mount point parameter. I'd like to mount the drive to the same mount point every time.
Now since 1TB 2,5" hard drives have been released and are payable I've thought about buying one. The most improtant issue for me when using a protable drive is security and data security. I found the "Western Digital My Passport Essential" with hardware encryption but the description says that only Windows and MAC operating systems are supported not Linux in anyway. My question is are there any significant diffetences between the WD hardware decryption or a truecrypt container/drive? And is there another program out there better for this job? I want to use the drive on Windows and Linux systems.
TrueCrypt hidden volume plausible deniability is documented at [URl]deniability but how plausible is it? there is no sign of the hidden volume's existence within the outer volume even if the user is forced to disclose the outer volume password. For this to be plausible the outer volume must be used or the user has no plausible reason for having it.
Quote:
If you mount a TrueCrypt volume within which there is a hidden volume, you may read data stored on the (outer) volume without any risk. However, if you (or the operating system) need to save data to the outer volume, there is a risk that the hidden volume will get damaged (overwritten). To prevent this, you should protect the hidden volume in a way described in this section.
The way described results in the outer volume properties including 'Hidden volume protected: Yes' which discloses the hidden volume's existence. The next section in the documentation has a diagram showing how the hidden volume is created at the top end of the outer volume space. Use of the outer volume must not write in the hidden volume space or the hidden volume will be corrupted. That limits the choice of outer volume file system to one of the FAT series because more sophisticated file systems do write in places across their whole space.How plausible is the choice of a FAT file system on Linux? Even on a dual boot system with the usual Windows versions NTFS is a better choice.
Installed Truecrypt onto openSUSE 11.3 (KDE) and noticed that Truecrypt needed to be started as root.Modified visudo using YAST asusername ALL = NOPASSWD: /usr/bin/truecryptHowever, when copying files from my backup drive into the Truecrypt partition, there is an access problem (couldn't remember actual error message)In Konsole , updated visudo to username ALL = (ALL) NOPASSWD: /usr/bin/truecrypt Copying is allowed and working fine.Question:1. What is the difference between the above two visudo setting?2. How to updated visudo to the second setting in YAST?3. How to change the editor for visudo in konsole using nano instead of vi?
Anyone know how device-mapper works, or can someone point me to any docco (other than the man page)?
Couple years ago I wrote a TrueCrypt wrapper script for use on Puppy Linux, and am reworking it for Ubuntu. Puppy sometimes didn't have the 'dmsetup' device-mapper utility available, but TrueCrypt still works without this when the '-m nokernelcrypto' option is used.
My script notices when dmsetup is available and skips this option. When the TC volume gets mounted (somehow using dmsetup), the Desktop icon is labled with the leaf name of the /media/mount_point -- so far, so good.
However, if I force the script to add the no-kernel-crypto option, and the TC volume is mounted without using dmsetup, the Desktop icon ls labled with the size of the volume. Say what?
Running df shows the difference between the two mounts is whether /dev/mapper is used. So *how is* dmsetup making this happen? The manpage isn't much help. Is it just the 'rename' sub-command? I am unable to find any details about this mechanism.
