I have an external USB disk with ext4 unencrypted:

/dev/sda1       3.6T  2.9T  613G  83% /data

I wish to encrypt this disk without losing data. I migrated this disk from Raspberry3 to Raspberry4, because of better performance I now wish to encrypt.

I read about Filesystem stacked level encryption and Block device-level encryption, but it seems LUKS the most secure and the Debian standard.

I read this guide:

WARNING! The following command will remove all data on the partition that you are encrypting. You WILL lose all your information! So make sure you backup your data to an external source such as NAS or hard disk before typing any one of the following commands.

# cryptsetup -y -v luksFormat /dev/xvdc

I can't copy the 4 TB data to another disk, because I have no disk with that much capacity.

How to encrypt this disk without backup/restore the existing data? Is it possible?


It's possible, but with all in-place conversions, there is a certain risk of data loss.

To make room for the LUKS header, unless you intend to use an external header, you must first shrink the filesystem (with resize2fs if it's ext4). For LUKS1, you should shrink it by 2MiB. For LUKS2, you can shrink it by 4M, 16M or up to 64M. If you intend to use advanced features (dm-integrity) you might have to shrink it even more.

Alternatively to shrinking, you could also make the partition larger, if the disk partition layout allows for that.

Encrypt existing data using the offline cryptsetup-reencrypt utility: (not installed by all distributions, might be in a separate package, otherwise grab from source)

# cryptsetup-reencrypt --new --type luks1 --reduce-device-size 2M /dev/sdXn
Enter new passphrase: 
Verify passphrase: 
[A wild progress bar appears.]

Using the online cryptsetup reencrypt for LUKS2:

# cryptsetup reencrypt --new --reduce-device-size 16M /dev/sdXn

This will overwrite data on LUKS2-temp-2c9761be-a765-4349-aa0a-553203e534f1.new irrevocably.

Are you sure? (Type uppercase yes): 

Enter passphrase for LUKS2-temp-2c9761be-a765-4349-aa0a-553203e534f1.new: 
Verify passphrase: 
[A wild progress bar appears.]

So this works, provided no power or cable blips happened during the entire process.

As the cryptsetup-reencrypt man page puts it:


| improve this answer | |
  • Do I need to use resize2fs and --reduce-device-size together, or is --reduce-device-size an alternative to using resize2fs? – Mathew Paret May 9 at 0:50
  • Also, is there a way I can move the headers out of the encrypted disk (so that if the HDD falls into the wrong drive they can't prove it is encrypted at all)? – Mathew Paret May 9 at 1:39
  • cryptsetup does not do filesystem resize, you have to do that beforehand. migrating to an external luks header sounds like a separate question. you can do that as is (keeping the data offset, making the change reversible) or move all data (set data offset to 0, to reverse you'd have to move all data again) – frostschutz May 9 at 9:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.