#REMOVE TRUECRYPT BOOTLOADER HOW TO#
#REMOVE TRUECRYPT BOOTLOADER INSTALL#
#REMOVE TRUECRYPT BOOTLOADER UPDATE#
#REMOVE TRUECRYPT BOOTLOADER WINDOWS#

# echo 'include bt5-64.cfg' > /mnt/usb/boot/syslinux/additional.cfgĬreate bt5-64.cfg based on Backtrack's bt5-64/isolinux/isolinux.cfg. Include a dedicated config file for bt5-64: Example with Backtrack 5 R2 Gnome 64 edition.ĭownload the ISO, mount them and copy the contents on the USB key: What if you want to add your favourite live CD? Just extract its content, add them to the USB key and create a syslinux menu for it.

#REMOVE TRUECRYPT BOOTLOADER WINDOWS#

The disk now has the original Windows loader (not suspicious), then some garbage (the encrypted data) which makes it unbootable without the rescue disk. Based on this post: boot on the rescue disk, choose repair, choose restore original system loader, say yes when it asks if the partition is decrypted (which is not true), choose restore key data and done. You can go further and remove the TrueCrypt bootloader from your hard disk. From the grub4dos menu, choose TrueCrypt and you should be presented with the usual TrueCrypt boot menu asking for the password. Power off your Windows with TrueCrypt system encryption, boot on USB.

#REMOVE TRUECRYPT BOOTLOADER UPDATE#

Of course, you can add as many TrueCrypt rescue disks as you want: copy the ISO files and update menu.lst. Based on this blog post, you can add something like:įinally, copy your TrueCrypt rescue disk: Menu label Run Grub^4dos (TrueCrypt Rescue Disks) Add grub4dos to boot TrueCrypt rescue disksīooting a TrueCrypt rescue disk ISO requires a bootloader able to boot ISO files, such as grub4dos. Now keeping this up to date after kernel upgrades is a bit annoying, so I made a little script script to automate synchronization of /boot. You can add as many machines /boot as you want: just copy the kernel/initrd and edit syslinux configuration. # cat > /mnt/usb/boot/syslinux/additional.cfgĪppend initrd=/linux/initrd.img-3.3.6 root=/dev/mapper/vg-root ro quiet splash I agree you just move the problem to the security of the USB key, which can be increased with a hardware encrypted USB key.Īssuming the machine is named linux and using a 3.3.6 Linux kernel: If you use a fully encrypted Linux setup, with a plain /boot (with grub, kernel and initrd) and an encrypted LVM (with the system), you can move the /boot on this USB key to prevent tampering of the hard disk /boot. To do this edit boot/syslinux/grml64_full_default.cfg then append ssh=PASSWORD toram=grml64-full.squashfs to the append line. I like to configure the default to run from RAM, have network and ssh. Grml has a large number of useful boot options, check them on /cheatcodes. If it works, you should see a grml menu similar to this: Configure boot options It is also very useful on old machines that don't support boot from USB. most virtualization softwares do not support boot from USB, so how? Since boot from ISO is pretty standard, you can boot on plop boot manager, a tiny ISO (544KB as of version 5.0.14) which will set up USB to allow booting from a USB key. You can reboot or try it on another computer, or simply set up a virtual machine and boot it from USB. grml2usb ~/grml64-full_2014.11.iso /dev/sdb1 Test the USB boot key

#REMOVE TRUECRYPT BOOTLOADER INSTALL#

Install grml32/64 with syslinux bootloader (the default) on the USb key: Tip: if you don't have it, apt-get install syslinux Make sure you have syslinux installed (usually available as a package), and a version >= 4: Tip: if you don't have it, apt-get install dosfstools Install grmlĭownload the latest grml ISO you're interested in, check integrity and authenticity: # dd if=/dev/zero of=/dev/sdb bs=512 count=1Ĭhoose primary, take all available size, make it bootable, change type to 0b ( WIN95 FAT32), write changes, confirm with yes and exit with q.įormat the partition to FAT32 and optionally label ( -n) the device:

#REMOVE TRUECRYPT BOOTLOADER HOW TO#

This post will describe how to set up a USB disk with grml32/64, grub4dos for TrueCrypt Rescue Disks, a Linux /boot and how to add other live CDs. TrustedGrub) are not yet ready, this simple workaround allows you to protect against tampering of the non-encrypted disk portions (mbr, /boot), because this part of the boot chain is on the USB key. Since TrueCrypt does not use the TPM (unlike BitLocker) and Linux solutions (e.g. And good news, this is not specific to Linux! If you use TrueCrypt on Windows, you can chain syslinux to grub4dosand boot from your TrueCrypt Rescue Disk ISO file. This way, you can have a fully encrypted local disk and boot (kernel+initrd) from CD/USB. The filesystem can be stored on the CD/USB (usually as a squashfs file), but you can also point to a local filesystem. Personally I like Grml, debian-based, 32/64 bits and it can be installed on USB.īooting from CD/USB is as simple as embedding syslinux, a kernel, an initrd and give it a filesystem. I think it's always good to carry a rescue operating system, like Ultimate Boot CD for Linux or UBCD for Windows.

Remove truecrypt bootloader