Encrypted dual boot install tutorial - Linux Mint and OEM Windows

You got a laptop preinstalled with Windows, and you are forced to use that system sometimes. It's time to install your encrypted Linux system with dual boot, but the installers don't support this out of the box. This is a tutorial how to do it properly. The following steps and commands were used during my install:
[shrink windows partition]
[create boot partition]
[create encrypted partition]
sudo cryptsetup luksFormat /dev/[partition-to-encrypt]
sudo cryptsetup luksOpen /dev/[partition-encrypted] [encrypted-name]
ls -la /dev/mapper
sudo pvcreate /dev/mapper/[encrypted-name]
sudo vgcreate [vgname] /dev/mapper/[encrypted-name]
sudo lvcreate -n lvswap -L 1g [vgname]
sudo lvcreate -n lvroot -L 64g [vgname]
sudo lvcreate -n lvhome -l 100%FREE [vgname]
sudo mkswap /dev/mapper/[vgname]-lvswap
sudo mkfs.ext4 /dev/mapper/[vgname]-lvroot
sudo tune2fs -l /dev/mapper/[vgname]-lvroot | grep "Reserved"
sudo tune2fs -m 1 /dev/mapper/[vgname]-lvroot
sudo mkfs.ext4 /dev/mapper/[vgname]-lvhome
sudo tune2fs -m 0.1 /dev/mapper/[vgname]-lvhome
sudo lvdisplay
[install with gui]
[continue testing]
sudo blkid
sudo mount /dev/mapper/[vgname]-lvroot /mnt
sudo mount /dev/mapper/[vgname]-lvhome /mnt/home
sudo mount /dev/[boot-partition] /mnt/boot
sudo mount --bind /dev /mnt/dev
sudo chroot /mnt
mount -t proc proc /proc
mount -t sysfs sys /sys
mount -t devpts devpts /dev/pts
nano /etc/crypttab
[target name] [source device] [key file] [options]
update-initramfs -k all -c

[@AvalonNexus]

Thank you for this walk-through! As a first-time Linux user, you made it very approachable to install for dual boot.

[@williamguides8284]

I hope you will enjoy your Linux distro of choice!

[@marshallhyasi6213]

Great video, btw guys on the last step when editing the file just do as he does and to save, press ctrl+x to close and then it will ask ykuif you want to save just press Y then enter. Works thx !!

[@TheImpactus]

The best guide on the web, it's been two years, I hope you are okay mate!

[@awvalenti]

Many thanks for such a detailed tutorial! Never thought Mint did so much stuff behind the scenes when "Encrypt my whole disk" was selected. For my current situation, just encrypting my /home dir will do.

[@sargentjanthony]

Thank you!!! Worked a treat on mint 20.3 dual booting with an older version of mint.

[@privateagent]

Terrific tutorial, many thanks !

[@oni2ink]

It worked, thanks!

[@moiseslodeiro]

Worked like a charm ❤️

[@dpferguson1]

This is an excellent walk through and worked as shown, is there a way to customize this process for Debian distros with the Calmares installer ? specifically since Calamares does not allow you to select the bootloader device ?

[@yn5061]

Very good! Works - Thank you

[@hiei90]

Thank you very much, great guide. I was trying this with Ubuntu 23.04 and had to download the version with the legacy desktop installer because the new one doesn't show lvm partitons.

[@williamguides8284]

Thx for the info, good to know!

[@AndreyZloy]

awesome! thank you!

[@mahadevgouda1949]

Thanks buddy😊

[@watchyoutube7826]

Great video

[@kristianjones8701]

Super useful

[@stopkillingkidsdotinfo]

Nice video... Wish I'd found this before I reinstalled Mint 20.1 and Win10 so I could encrypt my duelboot with this vid! Question... can I encrypt the Grub 2 way after the original install with this same method, or would it mess up Grub 2 for dual booting ???
Again than you for your fine video!

[@williamguides8284]

The key is that /boot is a separate unencrypted partition (that is where grub2 lives). To encrypt the rest of the Mint system you are probably better off making a backup and reinstalling/restoring Mint completely. But that's much faster than reinstalling Windows, so you can save that time at least.

[@utubepunk]

So I wiped the laptop, installed Linux Mint with LVM & encryption, but then I couldn't resize the partition to create a new partition for Windows 10. Hopefully your video will steer me in the right direction.

[@utubepunk]

If my laptop has 32 GBs of RAM do I need to create a 32 GB swap file?? I read somewhere swap needs to match the RAM footprint to support hibernation.

[@williamguides8284]

That is usually the rule of thumb, but less is enough if you do not run anything mission critical. Be warned though, your system or memory hamster program will crash when you run out of RAM+swap space.

[@luizhp]

Thanks

[@huseyinturkcan1925]

Hello, thanks for the video. Can I follow same steps for Fedora?

[@williamguides8284]

Unfortunately I cannot really say, but I assume the tools are generic enough to give it a shot. But first I would google around LVM, LUKS and grub on Fedora to double-check if the tools work similarly as in the video.

[@matthiascami4002]

I followed your steps to install dual boot linux ubuntu (but everything worked just the same), but the only problem I have now is when I boot, it indeed asks for a password ("please unlock disk cryptmint" (yes I still choose cryptmin as name)) but as far as I know we chose no password as you type "none"?

[@yungfabio420]

he did in fact write a password, it's just that linux terminal stays blank when it prompts you to type a password

[@williamguides8284]

Indeed. The "none" means there is no keyfile, so it will ask for a password. Otherwise the encryption would not make much sense. (Alternatively you could carry around your keyfile on a usb stick, etc.)

[@alvnbn]

ALERT! /dev/mapper/vgmint-lvroot does not exist. Dropping to a shell!
That's what i get when trying to boot ububtu after installing

[@williamguides8284]

Did that happen before or after the encryption password was asked during boot? I suspect that before, so something is not right in the encryption configuration, i.e. /etc/crypttab and/or the update-initramfs was not called or with wrong chroot. Can you provide more info?

[@ucsbhien]

Your /etc/crypttab probably is incorrect. For example, my encrypted volume is /dev/mapper/sda6_crypt, and my /etc/crypttab has this line:
sda6_crypt UUID= none luks
Thanks to Williamguides. I used the steps below to install a dual-boot Linux Mint 21.2 Cinnamon and Windows 11 with encryption.
In Windows, resize your hard drive by using Disk Manager
Restart and boot from the USB Linux Mint
Click Install Linux Mint
Select your language
Keyboard layout:
Select your keyboard
Multimedia codes:
Select to Install multimedia codecs
Install Type:
Select Something else
Select the free space
Click + to create a new partition
500MB
Type Primary
Chose ext4
mount to /boot
Select the free space
Click + to create a new partition
size is default (all available free space)
Type: Primary
Use as: physical volume for encryption
Security key: type in your passphrase for the encrypted volume
#Note the name of the newly encypted volume
#Mine is /dev/mapper/sda6_crypt
open a terminal:
sudo pvcreate /dev/mapper/sda6_crypt
#change "mint" to your desirable volume group name
sudo vgcreate mint /dev/mapper/sda6_crypt
#2G for swap space is probably enough
sudo lvcreate -L 2G mint -n swap
#root partition should be around 15G to 30G
sudo lvcreate -L 30G mint -n root
#use all of the availabe space left
sudo lvcreate -l +100%FREE mint -n home
sudo blkid
#copy the UUID of the encrypted volume (TYPE="crypto_LUKS"
sudo mount /dev/mapper/mint-root /mnt
sudo mount /dev/mapper/mint-home /mnt/home
#mount the partition created for /boot above
sudo mount /dev/sda5 /mnt/boot
sudo mount --bind /dev /mnt/dev
sudo chroot /mnt
mount -t proc proc /proc
mount -t sysfs sys /sys
mount devpts devpts /dev/pts
sudo nano /etc/crypttab
#add the line below; paste in the UUID of the encrypted volume:
sda6_crypt UUID= none luks
#Crtl-X to save
update-initramfs -k all -c