Create encrypted partition on existing drive with one primary partition while keeping data

Question

fdisk -l:

Disk /dev/sda: 931,5 GiB, 1000204886016 bytes, 1953525168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes`

parted -l:

Model: ATA WDC WD10EZEX-21W (scsi)
Disk /dev/sda: 1000GB
Sector size (logical/physical): 512B/4096B
Partition Table: loop
Disk Flags: 

Number  Start  End     Size    File system  Flags
 1      0,00B  1000GB  1000GB  ext4

goal: that drive should have 1 encrypted partition with all my data, but not operating system, and (not necessarily) 1 unencrypted partition

This drive has 200 GB of data on it. (only data, no system files - OS is on 250 GB SSD). I don't have any other storage where I can store the files while operating with that drive (my ssd has ~50 gb of free space).

I can resize that primary partition, but I can't create new partition in free space: gparted says only 1 primary partition can exist on this drive. help?

OS: Ubuntu 16.04

Answer 1

If you can have only one partition, then it suggests that you have no partition table: you are just using the raw disk. I looked up Partition Table: loop, and found a lot of stuff, that seems to confirm that you are using the raw device.

It should be possible to move the file-system, and insert a partition table that points points to it as partition one. You could then proceed to add another partition etc.

However I suspect the probability of you not trashing your data to be close to zero. If you have another small device you could practice a few times, but if reality turns out to be different from the practice then, your data may disappear.

I did this once, and was in hot sweats, with it broken for hours, before getting it working. Another time I accidentally wrote over the data.

Answer 2

As identified by richard, the filesystem starts on the very first sector of the disk: you have no partitions. To create an encrypted partition, you will need to create a partition table first. And you do need to have two partitions if you want to have an encrypted partition, because you need some non-encrypted space for the bootloader.

You can create a partition table without losing your data. It's a delicate task, so double-check that your backups are up-to-date, but it can be done.

The ext4 filesystem leaves the first 512 bytes unused, and an MBR partition table fits within the first 512 bytes of the disk, so you have room for an MBR partition table. (Note that it has to be MBR, not GPT.)

First, boot some rescue media. Do not attempt to do any of this while the filesystem is mounted. SystemRescueCd is good for this kind of things.

If more than half the disk space is free, then you can create a partition in the second half of the disk as follows:

1. Determine the path to the disk device. Note that a rescue system might name the disks differently from your normal system. Here I'll assume that the path is /dev/sda.
2. resize2fs /dev/sda to shrink the filesystem about as much as it'll go. You can see how much space is free with tune2fs -l /dev/sda.
3. Run fdisk /dev/sda. Fdisk will create a “dos disklabel”, i.e. an MBR partition table, in memory. Enter n and create a new primary partition that starts after the end of the filesystem. Enter w to write the new partition table and exit fdisk.
4. Copy the filesystem to the new partition with head -c SIZE /dev/sda1 where SIZE is the size of the filesystem after shrinking.
5. Verify that the data new partition is safe.
6. You can now create partitions to span the first half of the disk, where the old copy of the filesystem is located.

If more than half the disk is in use then you're in for quite some pain. I think you can do it by first converting the data to an LVM volume with blocks, then shrinking the filesystem, the logical volume and the physical volume, and using gparted to move the start of the physical volume. But I've never done anything like this, so triple-check your backups.

Answer 3

It may be possible to boot up a portable distro, resize the partition as small as possible with parted, create another, encrypt it, move the data over to the new encrypted partition. This now leaves multiple options: keep the old partition to be used as /boot (which may be necessary to run GRUB, then unlock the encrypted drive), or delete the old partition, resize the encrypted partition to use the entire disk, and use GRUB's built-in crypto module to unlock the new LUKS volume without need for a /boot partition (which personally I have found to be terribly slow at unlocking drives).