Skip to content

Set up a drive: encrypted folder on a drive you use

What you'll do: create an encrypted backup inside one big file on a drive that already holds your files, without erasing anything.
What you need: Deucalion installed (with VeraCrypt for a VeraCrypt folder); a drive with free space that is mounted (open it once in the Files app); a password you will remember; your administrator password (VeraCrypt).
How long it takes: 5 minutes of your time; creating a VeraCrypt folder fills it with encrypted data, from seconds for a small folder to hours for a very large one (LUKS is quick).

Good for: a drive you already use for other things, such as a photo drive or a drive that came formatted as NTFS. Keep in mind: the encrypted folder has a fixed size that can't grow later. Choose it with room to spare.

Before: a drive called Photos (NTFS) with some folders on it.

  1. Plug in the drive and make sure it is mounted (open it in the Files app).
  2. In Deucalion, go to Drives and click Set Up… next to the drive.

  3. Choose Encrypted folder on this drive (it says Keeps everything already on the drive) and click Next.

    The Storage page of a Photo Drive that holds files, with "Encrypted folder on this drive" selected.

  4. Choose VeraCrypt (or LUKS) and click Next.

  5. Type a name (here Photo Vault), the Size of the encrypted folder (GB) (the suggestion is 80 % of the free space) and the password twice. Click Next.

    The Details page: name "Photo Vault", size of the encrypted folder 2 GB, and the password typed twice.

  6. On the Confirm page, nothing will be erased: click Set Up.

    The Confirm page with a Set Up button (no erasing).

  7. When it is ready, click Done.

    The finished setup: "Photo Vault" is ready.

  1. Plug in the drive and make sure it is mounted (open it in the Files app).

  2. Run deucalion setup-drive and answer: the drive; 3 (Encrypted folder on this drive); the encryption; the size in GB; a name; y to continue; the password twice.

    $ deucalion setup-drive
Which drive?
  1) /dev/sda  Photo Drive  32.0 GB
  Choose [1-1] (default 1):

/dev/sda  Photo Drive  32.0 GB
  /dev/sda1  ntfs  32.0 GB, 75.2 MB used  “Photos”  at /media/alex/Photos

How should the backup be stored?
  1) Encrypt the whole drive
  2) Encrypted part for the backup + a normal part for other files
  3) Encrypted folder on this drive (keeps what is already on it)
  4) No encryption: erase and format the whole drive as exFAT
  5) No encryption: use the drive as it is (keeps what is already on it)
  Choose [1-5] (default 1): 3

Which encryption?
  1) VeraCrypt: open it on Linux, macOS and Windows (with VeraCrypt)
  2) LUKS: built into Ubuntu, no extra software, Linux only
  Choose [1-2] (default 1): 1
  Size of the encrypted folder? (it cannot grow later) [default 24 GB, max 30 GB]: 2
  A name for this backup drive [Deucalion]: Photo Vault

Summary
  Drive:  /dev/sda  Photo Drive  32.0 GB
  Layout: Encrypted folder on this drive (keeps what is already on it) (veracrypt)
  Encrypted size: 2.0 GB
  Continue? [y/N] y

Choose the password for the backup. It cannot be recovered if you forget it: write it down and keep it somewhere safe.
  Backup password:
  Type it again:
  Creating the VeraCrypt folder (you will be asked for your administrator password)…
  Encrypting (VeraCrypt)…
  Unlocking (VeraCrypt volumes can take up to a minute)…
  Creating the exFAT filesystem inside
  Unlocking (VeraCrypt volumes can take up to a minute)…
  Backup drive 'Photo Vault' is ready: /media/alex/Photo Vault/Deucalion-Backup

Done. Back up with: deucalion backup  (drive 'Photo Vault')

Write the password down

Nobody can recover it. Without it, the backup can't be opened.

What is on the drive now

Your files are untouched. Next to them are the encrypted folder (Deucalion-Backup.hc for VeraCrypt, Deucalion-Backup.luks for LUKS), a copy of Deucalion and the READ-ME file:

$ ls /media/alex/Photos
 Deucalion-Backup.hc   Deucalion-Tool  'Photos 2019'  'Photos 2020'   READ-ME-FIRST.txt   Scans

$ cat "/media/alex/Photos/READ-ME-FIRST.txt"
DEUCALION BACKUP DRIVE
======================

This drive holds a backup made with Deucalion 0.2.0
(https://github.com/Dimitrios-Kafetzis/Deucalion).

Your backup is inside the encrypted file Deucalion-Backup.hc on this drive.
It opens as a normal folder after you enter its password.

Opening the backup
------------------
Linux (Ubuntu):
  Run:  Deucalion-Tool/bin/deucalion open
  or use VeraCrypt: Select File → Deucalion-Backup.hc → Mount.

macOS:
  Install VeraCrypt (and macFUSE) from https://www.veracrypt.fr/en/Downloads.html,
  then Select File → Deucalion-Backup.hc → Mount.

Windows:
  Install VeraCrypt from https://www.veracrypt.fr/en/Downloads.html,
  then Select File → Deucalion-Backup.hc → Mount.

Restoring files or rebuilding a machine (Ubuntu)
------------------------------------------------
  1. Run Deucalion-Tool/bin/deucalion open and enter the backup password.
  2. Open a terminal in the Deucalion-Tool folder on this drive and run:
       bin/deucalion register <the backup folder>   (only the first time on a new machine)
       bin/deucalion rebuild                        rebuild a whole machine, step by step
       bin/deucalion restore ~/Documents            restore single folders or files

Notes
-----
- Never format this drive or rename the Deucalion-Backup folder.
- Deucalion-Backup/_removed holds older versions and deleted files; empty it with
  'deucalion removed empty' when you need space.

Don't delete or move Deucalion-Backup.hc

That one file is your backup. Deleting it deletes the backup.

What you have now: an encrypted backup folder, unlocked and registered as your default backup drive, on a drive that still holds your files.

Next steps: Make a full backup · Unlock and lock an encrypted drive.