12

I have a 4TB Disk formatted as NTFS and some data has been written into it. I then tried to encrypt it and mapped it to /dev/mapper/volume_sde1 like this:

$ lsblk -io NAME,TYPE,SIZE,FSTYPE,UUID,MOUNTPOINT
sde                    disk   3.7T
`-sde1                 part   3.7T crypto_LUKS 485c6049-9e6c-4f4c-9b4d-9efe54a9497a
  `-volume_sde1 (dm-0) crypt  3.7T

Then I tried to mount it to some point:

$ mount /dev/mapper/volume_sde /up2s3

The mount command returns:

mount: you must specify the filesystem type

Next I add crypto_LUKS as the -t crypto_LUKS, mount again returns:

mount: unknown filesystem type 'crypto_LUKS'

How do I mount the encrypted disk?

devnull
  • 5,331
  • 21
  • 36
coanor
  • 353
  • 1
  • 3
  • 6

4 Answers4

15

luks - create a new block device encrypted over existing block device. Not filesystem - so you can't mount it directly after opening. But - all data are lost.

You can't encrypt existing ntfs partition.

If you wish - you can encrypt device over sda, then open it with

cryptsetup luksOpen /dev/sda1 crypted_sda1

and then 

mount /dev/mapper/crypted_sda1 /up2s3

But - note that:

  • ntfs in this situation is useless - you can't mount it under windows
  • you cant encrypt existing device without losing data - so create backup of data from your ntfs partition, encrypt device (cryptsetup create ...), open it, format (mkfs.ext4 /dev/mapper/crypted_sda1), and finally mount and restore from backup.

If you finish writing data to partition, umount, close(cryptsetup close).

undefine
  • 1,380
  • 10
  • 19
  • +1 for the last point. Need to emphasize this multiple times. – Wtower Jan 24 '17 at 12:26
  • 3
    When running command #2: `mount: unknown filesystem type 'crypto_LUKS'` – ajeh Apr 16 '18 at 19:55
  • This works as described; to clarify on undefine's data loss statement, I was able to encrypt an existing ext4 partition without losing any data by following the guide here: [link](https://superuser.com/questions/900881/full-disk-encryption-in-existing-linux-system-without-erasing-any-content-from-t) – user1330734 Nov 13 '19 at 11:49
2

If you had an NTFS with data, and then luksFormated it, the first 129KiB of the NTFS have been overwritten by the LUKS header (even more if you added more than one passphrase) and thus the NTFS is likely damaged.

If you don't have another copy of your data, you should stop everything at this point and go into a read-only recovery procedure. I'm not sure how easily NTFS can be recovered in this situation.

In-place encryption with LUKS is complicated. The standard luksFormat does not encrypt anything, it only writes the LUKS Header that allows you to luksOpen the device. Anything written to that device is then encrypted, that means you first mkfs it with a filesystem of your choice, then copy files to it.

If you need to get rid of old, unencrypted data (if it's not a new disk), you even have to overwrite the entire device once (shred -n 1 or similar) before the luksFormat. You can also overwrite free space in the filesystem you created, but it leaves some holes (192KiB-2MiB range in the LUKS header itself, for starters).

frostschutz
  • 47,228
  • 5
  • 112
  • 159
1

This should do it, you will have to use sudo if you are not running this as root.

cryptsetup openLuks /dev/mapper/sde /up2s3

You will be prompted for the password.

openLuks is an abbreviated way of writing open --type luks

When you are ready to unmount the drive, do cryptsetup close /up2s3. Doing this will erase the key from memory.

user99655
  • 13
  • 4
1

As far as I know you can't encrypt an existing partition with LUKS, so what you seem to have done is set the partition as encrypted, but you haven't mkfs'ed your new partition, reason for the mount: you must specify the filesystem type message.

YoMismo
  • 4,005
  • 1
  • 15
  • 31