Ubuntu – Decrypt LUKS partition without losing data

16.04decryptionencryptionluks

I have a LUKS encrypted hard drive consisting of one single partition for the whole hard drive and it's encrypted with LUKS, I was wondering if I wanted to decrypt the disk completely(remove the encryption scheme) but retain the data is that possible or do I have to back the data up first.

td;lr = decrypt a LUKS disk completely without losing data, possible? how? or do I need to back it up first.

Best Answer

You can either unlock the drive, copy all data to an external drive, reformat the encrypted drive and copy all your data back (I think this is what you mean by backup) or have your system enter your password at boot for you per this answer.

Add this at the end of the relevant line in /etc/crypttab:
```
,keyscript=/root/lukspw
```
Create the file /root/lukspw
```
# nano /root/luspw
```
with the content (replacing "password" with your actual password):
```
#!/bin/sh 
printf "password"
```
And make it executable:
```
# chmod +x /root/lukspw
```
And update the initrd:
```
# update-initramfs -u -k`uname -r`
```

Drive is still encrypted but now no password is needed

Related Solutions

Data Recovery – How to Recover Lost LUKS Partition with Backup Partitioning Data

To recreate the original partition scheme you will need to run a partitioning tool and create each partition with the start and end sectors from the backup data. That should restore the MBR exactly as it was. Try sfdisk:

sfdisk /dev/sdb -uM << EOF
2,114828,52
114830,19074,0
133904,585938,255
719842,1187896,7

You should check this for yourself. Each line is start,size,id with size in megabytes (-uM) based on your old partition data:

Start:        2048 End:   117585919 Size:   117583872 FsId: 52 Label:                      ClusterSize:   8 FreeSectors:   109144672 Primary: 1 Bootable: 0 BootVolume: 0 SystemVolume: 0
Start:   117585920 End:   137117695 Size:    19531776 FsId:  0 Label:                      ClusterSize:   1 FreeSectors:    19531776 Primary: 0 Bootable: 0 BootVolume: 0 SystemVolume: 0
Start:   137117696 End:   737118207 Size:   600000512 FsId: 255 Label:                      ClusterSize:  -1 FreeSectors:           0 Primary: 1 Bootable: 0 BootVolume: 0 SystemVolume: 0
Start:   737118208 End:  1953523711 Size:  1216405504 FsId:  7 Label:           Data-Drive ClusterSize:   8 FreeSectors:  1002478672 Primary: 1 Bootable: 0 BootVolume: 0 SystemVolume: 0

If you can not get the partition table recreated, have a look at this thread on recovering LUKS partitions.

Ubuntu – How to securely mount LUKS partition at login

If your home folder itself is encrypted by LUKS, there should be no way for the key to be read without the home folder being decrypted (which only happens when you're logged in).

As long as the keyfile is actually read from your user directory (/home/<whatever>) and not /root, you should be okay.

As for auto-mount on login, you can use a simple script in your Startup Applications list (run after login succeeds, so it will work as long as you're mounting this drive to userspace). For logout, you can set it up to unmount when you kill your X session.

In short, you would do the following:

Create a small script that will unmount the encrypted drive from wherever it's mounted
Add this to session-cleanup-script in /etc/lightdm/lightdm.conf. This will run whenever any session is killed, so this may not be the best option.

Caveats

As mentioned before, the auto-logout script runs when any X session is terminated, so it's likely that your drive may be accidentally unmounted when another user logs out of your concurrent session. However, this won't be an issue if you're an only user who keeps only a single X session running.
Similarly, you NEED to keep an X session open, even in a TTY, unless you want to manually mount/unmount the device.

Best Answer

Related Solutions

Data Recovery – How to Recover Lost LUKS Partition with Backup Partitioning Data

Ubuntu – How to securely mount LUKS partition at login

Caveats

Related Question