Encrypting a multi-boot USB drive

First, for using bootable CDs you don't need multiboot, so this is a part that I don't understand.

Second, why not put all the sensitive data in one encrypted truecrypt partition that you can open from whichever OS that you boot from.

Third, if this is company data you are protecting, you could maybe justify buying hardware encryption such as Apricorn Aegis Secure Key, or Imation Defender F200 Biometric Flash Drive.

image


If you want to use software encryption, you will not be able to boot most Linux ISOs if ISO files are encrypted. The only ISOs which could boot in this case are those which load everything into initramfs (one example is RIPLinux; unfortunately, seems that its development is stopped), or those that you modified to add encryption support to their initramfs.

The problem is that the bootloader used by TrueCrypt (or any other software encryption program) can set up a BIOS INT 13h handler to provide the next bootloader with access to the encrypted data, but this INT 13h handler cannot be used after the Linux kernel has started. However, most Linux ISOs need to have access to the ISO contents after starting Linux, and everything needed to get such access must be present in the initramfs image (which is loaded by the bootloader using BIOS INT 13h calls before starting the Linux kernel). Of course, you won't find TrueCrypt support in initramfs of any usual Linux ISOs.

In fact, even making the initramfs code from a Linux ISO find the ISO contents when booting from USB requires some hacks. If you read the description of ISO boot process used by Easy2Boot, you will notice that it modifies the partition table of the USB drive to add a partition which corresponds to the sector range used by the ISO image file (which is required to be contiguous — i.e., not fragmented); the initramfs code then should mount this partition to get access to the ISO contents. Obviously, this will not work if the ISO image is encrypted, unless the initramfs code is modified to support the used encryption.

So you have these options:

  1. Avoid including any sensitive data into ISO images. Create two partitions on the USB drive — one for sensitive data (encrypted by TrueCrypt or whatever you choose), another for booting (unencrypted).

  2. Figure out how to install a usable bootloader inside a TrueCrypt partition, then either use only initramfs-based ISOs, or modify initramfs images to add TrueCrypt support. If you choose this way, I would suggest to try using SYSLINUX first, because, unlike GRUB, it does not attempt to install into MBR (and you need to avoid using MBR and the embedding area before the first partition, because the TrueCrypt bootloader will be installed there).

  3. Buy an USB drive with hardware encryption which can be unlocked without any software — e.g., one of drives suggested in the other answer. However, check carefully before you buy, or you may run into some problems — e.g., for the Apricorn Aegis Secure Key one of reviews on Amazon says:

    It seems to dislike even the slightest power interruptions. If I connect it before starting an OS, during the boot of Windows or Linux when it detects USB devices, it will disconnect it due to the brief interruption in USB connectivity. I will have to reach down and enter the PIN again.

    Note: This is not a scenario that it is advertised to work in or anything, but I was able to do this on my previous pin-pad-having USB drive without issues... I installed Linux on the drive so that it was bootable, but when I try to boot Linux, it disconnects it during the phase where it detects USB devices. It continues booting if I reach down and re-unlock the drive, but it's a pain.

    And the Imation Defender F200 Biometric drive might turn out to be not usable for booting if it also resets in such cases, and turns out to be too slow to unlock during BIOS initialization. The support article confirms its compatibility with Linux if only biometric authentication is enabled, so there is some chance of success, but…