The Debian GUI Installer provides multiple automated partitioning options. I've had no issues with "use entire disk and set up encrypted LVM" so far. But toady I had to install Debian on a disk that is preoccupied by multiple operating systems. In the beginning of the disk there is a Windows installation, and in the end of the disk there is an Ubuntu installation. There is one continuous space in the middle of the disk.

When I chose the "use the largest continuous free space" option it correctly selected the entire space but there was no automated process to encrypt the volume. So I have an unencrypted Debian installation in the middle of my disk. Is it possible to encrypt only the entire Debian portion of the disk after an unencrypted installation in the same way as the guided "use entire disk and set up encrypted LVM"? I chose to put "All files in one partition". If there are no native methods, can third party software such as Veracrypt help? If there is no solution but to reinstall, how should I partition next time to achieve what I want?

1 Answer 1


If you have just installed Debian 11 unencrypted, a reinstallation is probably easiest way to get it encrypted.

Since your system already has two operating systems and you are now installing a third one, you are clearly an advanced user. So you should not be afraid of the "manual/advanced partitioning" mode of the installer.

However, if you wish to be constructively lazy (a sysadmin virtue), you could first use the "use the largest continuous free space" option of the installer, then go back to the partitioning step (in manual/advanced mode) and change the type of the partition the installer created from "an ext4 filesystem mounted at /" to "a LUKS encrypted volume".

You will then be required to specify what will be inside that encrypted volume, with the default probably again being "an ext4 filesystem mounted at /". Change it to a "LVM physical volume".

You will need to define a LVM volume group name (you can set anything, but you might want to keep it short) and one or more LVM logical volumes that will go inside the LVM physical volume. You'll want at least one with a filesystem type of your choice, mounted at /, and perhaps another logical volume designated as swap.

Remember that if your system boots in UEFI style, you'll need to make sure the already existing EFI System Partition will not be initialized, but will be mounted at /boot/efi. This is where the UEFI bootloader will be installed; it needs to be a regular unencrypted partition because UEFI firmware won't be able to read encrypted partitions (unless you have a very special custom firmware?).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .