So like a doofus, ive never really done encryption on any of my PCs/drives. With the way stuff is going, now I want all of it encrypted. The issue is I have so much data from over the years and everything ive read says it deletes everything when you encrypt.

For me it would mostly be my desktop and my nas.

Is it really a matter of, I’m gonna have to buy a whole bunch more HDDs to copy everything over to, encrypt, copy it all back? What’s the best (Linux) software for a mass copy task like that to be sure it works correctly?

  • monovergent@lemmy.ml
    2·
    9 hours ago

    If those are your only copies, do buy extra HDDs first thing so you have at least a backup. Preferably then a third copy since otherwise, for a moment, only one copy would exist as you copy encrypted data back to the original drives. Technically, there are ways to encrypt in-place, but don’t ever do that when it’s your only copy of the data.

    Overall, it would look like creating an empty partition on the new drive, creating an encrypted container on said partition (this intervening level differentiates it from an unencrypted data partition), creating the filesystem (formatting as ext4, btrfs, etc) within said container, and copying data into the encrypted filesystem.

    LUKS is the best-supported encryption system for Linux. As an avid user of LUKS on nearly all of my internal and external drives, I highly recommend reading the Arch wiki entry: https://wiki.archlinux.org/title/Dm-crypt/Device_encryption. Section 4 teaches setting up the encrypted partition. Once everything is in place, most graphical file managers can handle detecting and opening the encrypted drives as well.

    For non-boot drives, I’ve always used rsync to copy data over. If you use btrfs, then a btrfs scrub afterwards to double-check the copied files. I’ve never tried to see if I could rsync a root partition and leave it in a bootable state. Though I do have a way to migrate a non-encrypted root partition to encrypted without reinstalling, that’s a whole rabbit hole you are welcome to ask me about.

    Get a feel for LUKS before you set up the root partition with encryption though, perhaps by setting up an encrypted install in a virtual machine. Recovering a non-booting encrypted install of Linux takes only a few extra commands compared to a non-encrypted one, but if you mess up encryption and lose the key, no amount of commands will save you. So before doing anything I mention here, always have backups.