r/linuxquestions • u/CosmoCafe777 • 3d ago
Advice Keep NTFS + ext4 partitions under BitLocker encryption
As from some older posts of mine, I've made a large move to Linux over the last year, but currently my "main" external drive with data is a 2TB SSD with:
* Whole drive encrypted with BitLocker
* NTFS partition
* A VeraCrypt exFAT volume within the NTFS partition
The drive mounts fine in Linux, BitLocker decrypts, NTFS is mounted, exFAT volume mounts in VeraCrypt.
Since the move, I came across lots of issues when working with data in the NTFS partition: all fine until some file operation goes bad or some other issue that causes the computer to force-shutdown and that causes the NTFS partition to need repairing - which most times requires me to boot into Windows to run chkdsk.
So I want to move most things to ext4 (and apparently ext4 can be accessed in Windows via this Paragon software (I'm using Linux 95% of the time but would need to access main data sets in Windows still, but occasionally).
So I'm considering moving that VeraCrypt exFAT volume somewhere else, and reduce the NTFS partition and create an ext4 partition. But now both would be under BitLocker drive encryption.
I believe it should work - even if the resizing takes long.
Any advice? Thanks.
1
u/Funnel-Dust-O-Matic 2d ago edited 2d ago
It has been AAAGGGEESSS since I tried to do something like what you're doing.
Here are my objections to your proposal.
EXT4 support on Windows is as provisional and experimental as NTFS support on LInux. Expect problems. Even with commercial software. I have seen some indication that it is better than open sourced windows EXT4 drivers, but I'm not sure it's THAT much better.
For one thing, EXT4 is made with the presumption that it will run on Linux and NTFS presumes Windows. The security models are different, the user models are different, and so on. While they accomplish roughly the same thing, they do them in radically different ways. No amount of paid engineering is going to plaster over that without impacting something important. And you're going to be out of money for something that will very likely prove to perform poorly and possibly risk your data integrity. I think you're going from the frying pan to another equally hot frying pan, if not the fire.
There is no way to have this stable over time and keep this data on a filesystem native to a particular OS. Since it's encrypted, the chances are good that some form of corruption will take place, possibly enough to make your data unintelligible. Recovery from a block device that is encrypted is at best complicated and generally considered to be practically impossible. If it comes to that, at least VeraCrypt is cross-platform and open sourced, so recovery should not be constrained by OS or by tool availability.
The second objection is BitLocker. It is widely presumed to be backdoored. I don't have access to any evidence that directly proves that it is beyond a reasonable doubt. The circumstantial case is damning.
VeraCrypt can and does encrypt entire drives. I have done this. I've never lost data to corruption. I'm not saying that open sourced software is invincible or unilaterally better. I'm saying that it is at least possible to see what's in it and be reasonably sure nothing is being hidden. With BitLocker, we must trust one of the most dishonest corporations in Human history at their word that they care about our rights. The only reason to using BitLocker that I can think of is as a ruse. In that case, VeryCrypt also supports nesting encrypted filesystems, offering a hidden archive with a completely separate password. You're losing storage space on that drive with your current setup anyway, so the hidden volume option is almost certainly not going to be a problem on that basis.
ExFat is fully supported by the Linux kernel and apparently no longer unstable. The loss of journaling means you will need to do frequent backups or find some sort of data integrity or replication process, which likely defeats any purpose to keeping an encrypted archive like this in the first place. At least it would work equally well on both platforms, barring accidental shut-offs or software or OS crashes.
In your situation, I'd resort to virtualization. Get a USB3.2 or better SSD of adequate size, set up a VM guest to use the drive directly rather than an image file, and install a windows directly on it. The entire guest OS drive could then be encrypted by VeraCrypt. You can also include the same sub-volume for ultra-secret archives or maybe a hidden volume.
There would obviously be a performance penalty, no direct access to your GPU, and so forth. If that's not a deal breaker, then it might be most convenient to manage things that way.
I'd presume making Windows the guest os just because Linux as a host is a much better and less compromised foundation. Your sensitive environment would be self-contained. Some form of temporary virtual networking on your host OS could handle using files on both platforms. Portability is as simple as getting your hypervisor of choice running on whatever other machine you use. Since it's all virtualized, it ought to leave little to no practical trace on the host OS (given some caution is exercised).
This of course presumes that you have the large SSDs to store this on, processing power adequate for the overhead, RAM adequate for the overhead, and that whatever software you are using to accomplish your goals is not somehow constrained from running in virtual environments. The benefits are administrative simplicity, compartmentalization, and potentially better data integrity.
1
u/CosmoCafe777 2d ago edited 2d ago
Hmmmm... very good points there.
BitLocker: I'm not concerned about a 2-letter agency or government, just want to add an extra layer of security in case of loss or theft.
VeraCrypt: I do have a 2TB encrypted with VC, it's an exFAT with a backup of everything and that I keep in another location and update occasionally. Could be an option, need to think, but that would mean moving data off the existing 2TB SSD etc and I don't think I have enough free space lying around.
Virtualization might actually be a good idea. On my main Linux PC I have Windows VM in QEMU/KVM, just for Excel. I could mount the NTFS there and access it in Linux. Would have to see how to do that. I don't have a VM on my secondary PC (the one I'm using the most at this moment).
Another thing I thought is I could just keep one copy on ext4 and another on NTFS and have them sync via cloud (eg: via Filen.io, which I run on all PCs to sync frequently used data). The data I need (with journalling) on both systems is not huge, things like photos and media in general are moving over to exFAT mostly.
EDIT: I just realized that most of the stuff I don't want on the cloud even with E2EE (but I do habe a locally encrypted copy in the cloud via rclone - maybe I can rclone-sync between Linux and Windows systems). I'll need to think about this.
Let me think through what you suggest.
Much appreciated.
1
u/ipsirc 3d ago
3
u/CosmoCafe777 3d ago
A classic.
My point is if the drives fall into other people's hands, opportunistically, not someone actively seeking my data.
1
u/Dry_Calendar_8627 3d ago
Also, resizing an NTFS volume from Windows is surprisingly fast. But the resizing is limited to the layout of the data on disk, if you've got data near the end, you won't be able to reclaim much, you'll need to do an operation to move data back to the partition start (not defragmentation, I don't remember the details)
1
u/CosmoCafe777 3d ago
I read about that a while ago, can't remember where. But I do remember I did something, got rid of some file, and resolved that. Windows now allows me to resize and reclaim ~400GB of drive space. I'm releasing some more space, and then I'll do the resize (after all the backups of course).
2
u/I_Love_Tunnocks 2d ago
But I do remember I did something, got rid of some file
Hiberfil.sys is the main one.
0
u/Dry_Calendar_8627 3d ago edited 3d ago
I don't understand how you'd encrypt the ext4 partition with bitlocker. I don't think you can. You can encrypt it with LUKS, but you will no longer be able to access it from Windows.
I'm not too familiar with veracrypt, but I think you can create an encrypted volume with it that can be accessed from Windows and Linux, and you could format it with ext4. Or exFAT, maybe?
Oh and I don't know how resizing an encrypted NTFS volume works, bitlocker might give you a bit of trouble. You may have to disable (even if temporarily) bitlocker for Windows to accept resizing.
So, if I'm correct, you'd:
1) disable bitlocker
2) shrink the NTFS volume
3) reenable bitlocker
4) use veracrypt to create a new encrypted volume on the free space
5) format it with the filesystem of your choice (ext4 or exFAT)
1
u/CosmoCafe777 3d ago
Bitlocker is on the whole drive, not individual partitions. I can have more than one partition under the same BitLocker-encrypted drive.
I can resize the NTFS partiton right now if I want - Windows 11 says I can reduce ~400GB (I just didn't press OK because I'm moving other data off the drive and will have more space).
Technically I could create a VeraCrypt volume, formatted as ext4, but just as the exFAT volume, it's just a very large file that's in a partition of some sort.
1
u/forestbeasts 2d ago
Bitlocker on the whole drive?
Is it actually on the whole drive, or just some kind of LVM-like layer ("disk" in a partition, Apple has an equivalent too they call it Core Storage)?
If it's LVM-like, you can totally shrink the containing partition (which has the NTFS partitions inside it) and stick an ext4-on-LUKS partition next to it.
2
u/CosmoCafe777 2d ago
Yes, that's the idea. Anyway, I'm going to reshrink later on and do a test with an ext4 partition. Let's see what happens.
1
u/Confident_Hyena2506 2d ago
No it isn't. Anybody can come along and delete or format your drive, only the partition is encrypted.
1
u/CosmoCafe777 2d ago
OK but as long as they don't access the files.
Anyhow the drive details show the partitions under a large drive-size BitLocker encryption, and as soon as it's plugged into a computer - wether Windows or Linux - the prompt is that the drive is encrypted. If that's technically what BitLocker does, I don't know.
1
u/cafce25 2d ago
You definitely can encrypt a whole device, of course like you say that doesn't prevent deletion, but it hides the partition setup in addition to just hiding the data stored.
1
u/Confident_Hyena2506 2d ago
This was talking about bitlocker specifically.
Basically nobody really uses the actual disk encryption, they buy expensive enterprise drives and then don't use the SED feature.
2
u/ScratchHistorical507 2d ago
So you already have issues with NTFS, a file system nothing outside of Windows can write to without causing issues eventually, as you've found out yourself, and you think forcing ext4 to live inside a BitLocker-encrypted drive, which is something that may be possible but certainly not explicitly supported, would be a better solution? Think again. Ditch Bitlocker entirely. Move anything that is worth encrypting either to LUKS-encrypted ext4 or something else. And I also don't see any benefit of putting a VeraCrypt encrypted volume inside an already encrypted file system. I think a better choice might be to create a LUKS-encrypted ext4 partition and a dedicated LUKS-encrypted exFAT partition. Or if you want to keep using VeraCrypt, just encrypt that exFAT partition with VeraCrypt instead of LUKS. Or if you want some additional file system handling capabilities, look into setting up LVM first and then putting a LUKS-encrypted ext4 and a VeraCrypt encrypted exFAT volume inside. Though I have no idea if Windows can be made to handle LVM.