Introduction

Let’s say that you get a brand new 2TB/4TB/8TB/xTB HDD, and you want to use it as a safe backup device.
That means you want to encrypt everything you put in it.

So, assuming you’ve already installed the drive on your computer; let’s prepare it for FDE (Full Disk Encryption).

Correctly identify the drive name

Open a terminal and type:

sudo fdisk -l

You’ll see a list of storage devices connected to your computer and their partitions —if any.

You need to identify the one you just connected. It’s very easy if your devices are of different sizes, since that can easily indicate the drive you want to work with.

You can also use the lsblk command to see a list of all block devices and their partitions:

lsblk

Example output:

NAME  MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINT
sda     8:0    0   1.8T  0 disk

PLEASE MAKE SURE you identify the drive correctly, as the following procedure will wipe EVERYTHING on it with NO RECOVERY chance.

You’ve been warned!

I have an old 2TB drive.
For me, the data for this device using sudo fdisk -l looks like this:

Disk /dev/sda: 1.8 TiB, 2000398934016 bytes, 3907029168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes

So, my drive is /dev/sda. Yours could be /dev/sdb, /dev/sdc or something else entirely.
It depends on your drive’s connection interface: Is it a SATA, IDE or an NVMe drive?

Pay careful attention.

Write zeros to the drive

For security reasons, and to verify that there are no outstanding problems with your drive, first, it’s recommended to write zeros all over it.

We’ll use the venerable dd command for that:

sudo dd if=/dev/zero of=/dev/sda bs=32M status=progress conv=fdatasync oflag=direct

When finished, you’ll see something like this:

2000368435200 bytes (2.0 TB, 1.8 TiB) copied, 12140 s, 165 MB/s
dd: error writing '/dev/sda': No space left on device
19078+0 records in
19077+0 records out
2000398934016 bytes (2.0 TB, 1.8 TiB) copied, 12259.6 s, 163 MB/s

The write speed varies a lot depending on the type of drive you have.

For my 2TB drive, it took 12259.6 seconds == 204.32 minutes == 3.4 hours to be filled with 0s.

Create the partition table

Let’s open the disk with fdisk.

sudo fdisk /dev/sda

You’ll see something along these lines:

Welcome to fdisk (util-linux 2.34).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.

Device does not contain a recognized partition table.
Created a new DOS disklabel with disk identifier 0xed42f188.

Command (m for help):

As you can see, it automatically created a DOS partition table for us.

Let’s change that to a GPT partition table, if you want to see the available options enter m for help:

Command (m for help): m

Help:

  DOS (MBR)
   a   toggle a bootable flag
   b   edit nested BSD disklabel
   c   toggle the dos compatibility flag

  Generic
   d   delete a partition
   F   list free unpartitioned space
   l   list known partition types
   n   add a new partition
   p   print the partition table
   t   change a partition type
   v   verify the partition table
   i   print information about a partition

  Misc
   m   print this menu
   u   change display/entry units
   x   extra functionality (experts only)

  Script
   I   load disk layout from sfdisk script file
   O   dump disk layout to sfdisk script file

  Save & Exit
   w   write table to disk and exit
   q   quit without saving changes

  Create a new label
   g   create a new empty GPT partition table
   G   create a new empty SGI (IRIX) partition table
   o   create a new empty DOS partition table
   s   create a new empty Sun partition table

We can see we need to enter g for a GPT partition table.
Let’s do that and then w to write the partition table to the /dev/sda disk:

Command (m for help): g
Created a new GPT disklabel (GUID: D12345B9-D963-44A4-448812B7...).

Command (m for help): w
The partition table has been altered.
Calling ioctl() to re-read partition table.
Syncing disks.

After the operation takes place, it’ll exit automatically.
Re-open the drive, and enter the following sequence of commands:

sudo fdisk /dev/sda
n
<accept all defaults>
p
w

1. n => New partition —accept all defaults, so it takes all the space available on the device
2. p => Show partition info
3. w => Write changes and exit

This is the output from the commands above:

Welcome to fdisk (util-linux 2.34).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.


Command (m for help): n
Partition number (1-128, default 1):
First sector (2048-3907029134, default 2048):
Last sector (2048-3907029134, default 3907029134):

Created a new partition 1 of type 'Linux filesystem' of size 1.8 TiB.

Command (m for help): p
Disk /dev/sda: 1.8 TiB, 2000398934016 bytes, 3907029168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: gpt
Disk identifier: D12345B9-D963-44A4-448812B7...

Device     Start        End    Sectors  Size Type
/dev/sda1   2048 3907029134 3907027087  1.8T Linux filesystem

Command (m for help): w
The partition table has been altered.
Calling ioctl() to re-read partition table.
Syncing disks.

Now, if you look at your drive info with sudo fdisk -l you’ll see something like this:

Disk /dev/sda: 1.8 TiB, 2000398934016 bytes, 3907029168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: gpt
Disk identifier: D12345B9-D963-44A4-448812B7...

Device     Start        End    Sectors  Size Type
/dev/sda1   2048 3907029134 3907027087  1.8T Linux filesystem

All right! At this point you could format and use the drive if you don’t want it encrypted.
But, I guess you are here for the FDE stuff, right?

Encrypt the drive

It’s encryption time for the /dev/sda1 partition:

sudo cryptsetup -v -y luksFormat /dev/sda1

Type YES when asked to do so, then type in a passphrase and confirm it.

Please take-note/make-sure you DO NOT forget this, else you’ll never have access to your data again.
You’ve been warned —again, I know. But, it’s that important.

Obliged xkcd reference about passwords/passphrases: Password Strength.

Output from command above:

WARNING!
========
This will overwrite data on /dev/sda1 irrevocably.

Are you sure? (Type uppercase yes): YES
Enter passphrase for /dev/sda1:
Verify passphrase:
Command successful.

Create a new ext4 filesystem

Let’s unlock the partition:

sudo cryptsetup open /dev/sda1 encrypteddrive

You can change encrypteddrive to whatever name you fancy.

It’ll ask you for your passphrase —you have it handy, don’t you?

If everything is OK, you’ll see the drive listed at /dev/mapper, like this:

total 0
lrwxrwxrwx 1 root root       7 Jan 25 15:01 encrypteddrive -> ../dm-2

Now, let’s create an ext4 filesystem on it:

sudo mkfs.ext4 /dev/mapper/encrypteddrive

Output is like:

mke2fs 1.43.8 (1-Jan-2018)
Creating filesystem with 488377873 4k blocks and 122101760 inodes
Filesystem UUID: e227bc87-b2e4-44f4-bf8f-240e4d16bcc1
Superblock backups stored on blocks:
  32768, 98304, 163840, 229376, 294912, 819200, 884736...

Allocating group tables: done
Writing inode tables: done
Creating journal (262144 blocks): done
Writing superblocks and filesystem accounting information: done

Mount the partition

Create the directory that you are going to use to interact with the drive:

mkdir ~/mynewdrive
sudo mount /dev/mapper/encrypteddrive ~/mynewdrive/
sudo chown -R $USER:$USER ~/mynewdrive/

That’s it!
Whatever you copy to ~/mynewdrive will be encrypted and safe once you close and unmount the drive.

Which leads us to…

Unmount and secure your data

To cleanly close and secure your data you do this:

# Make sure you are not inside the drive directory,
# this will take you to your $HOME
cd

sudo umount /dev/mapper/encrypteddrive
sudo cryptsetup close /dev/mapper/encrypteddrive

Cannot unmount

umount: /home/yolo/mynewdrive: target is busy.

If you cannot unmount the drive make sure you aren’t inside it whether on a terminal or a file browser.

Should also make sure you don’t have any running operations on it —like unfinished file copying, etc.

Remount the encrypted partition

How do you remount your drive at a later time?

sudo cryptsetup luksOpen /dev/sda1 encrypteddrive
sudo mount /dev/mapper/encrypteddrive ~/mynewdrive

Don’t forget to unmount and close it after you are finished with your backups!