Welcome to part four of this module.
This video is going to focus on how to create a hidden Windows operating system using very script while
also creating an encrypted Cally Linux installation.
In other words when we're done we're going to have an encrypted decoy installation of Windows and encrypted
hidden installation.
And we're also going to have an encrypted Cally Linux installation when we built our system.
The password that we enter is going to determine which encrypted operating system loads before we get
started.
I have to cover a lot of the same things that I covered in the last video.
If you're only interested in having a hidden Windows system and you don't care about being able to dual
boot to an encrypted Cally operating system please see the prior video.
Although much of this procedure is going to look almost identical to everything shown in the last presentation
certain key aspects of it are in fact very different.
This is a very complicated setup to pull off everything shown here is done at your own risk.
And I do strongly recommend that you try this out in virtual box first.
The best time to do something like this is when you're first setting up your computer.
If you're using a newer computer you may need to go into your system bios and make some changes very
script supports you EFI boot loaders.
But if your BIOS has a secure boot enabled you are going to need to disable that.
Otherwise your system may not allow you to boot from USP your city ram at all unless you're booting
a Windows system because every BIOS is different.
I can't show this procedure for how to do this.
So please research your BIOS version a bit before proceeding normally.
It is as simple as toggling enabled to disabled but be aware this may require you to reinstall your
operating systems.
You should be fully willing to reinstall your operating systems before you begin anyway because if something
does go wrong in this process it is quite often necessary that you reformat your hard drive and try
again.
So with that in mind make absolutely sure that you've backed up all of your important data on external
media.
Another thing that may vary from system to system is the partition configuration.
Some computer manufacturers like to create truly bizarre partition layouts with multiple reserved partitions
in front of the operating system and so on and so forth.
Generally speaking these are recovery partitions and the like but they tend to gnaws up the entire process
and may in fact compromise the security of your encrypted system for these reasons.
You may wish to reformat and start fresh anyway.
Finally some bios versions will give you the option of using a legacy bootloader and switching from
GP t to MPR partitioning.
Doing so will absolutely require a ring installation of any operating systems you have installed.
If you run into problems though this may be your only option to make a long story short.
Don't attempt this unless you are 100 percent comfortable with reformatting your hard drive.
You absolutely must have all of the installation media created and on hand before we begin a Windows
rescue disk is not adequate.
You will need an iso image burned to either a seedy or USP for the Windows version that you wish to
install.
These can usually be obtained legally from the Microsoft Web site.
You will need your Windows product key So be certain to obtain that key and verify it before you begin.
It is also recommended that you have a boot repair disk or USP of some kind.
On hand in case your bootloader gets goofed up if you need any help reform any computer please see the
next video on Derek's boot and nuke.
The demonstration shown here will work with all versions of Windows going as far back as Windows XP.
The procedure is identical if you prefer True Crypt over Vera crypt.
However be aware.
True Crypt has no UTF I support so you will need to change the bootloader to legacy and recreate your
partitions as MPR if you wish to use True Crypt.
Last but not least you absolutely must activate your Windows operating system before you encrypted.
This is covered in the very crypto documentation creating a hidden operating system prior to authentication
and can compromise your security in several key ways.
It is also recommended that you fully update before encrypting to start us off.
We're actually going to go to the disk management system so we're going to press the Windows plus X
key and we're going to select disk manage.
If you watch the prior video this is the point where you'll start to notice procedural differences.
The first thing we're going to do is we're going to create a large volume of space behind the primary
part system partition to do this.
We need to shrink our system volume.
We're going to create three partitions behind the primary.
The first one is going to contain our hidden Windows operating system.
This partition must be at least twice the size plus 5 percent of your primary partition which will contain
your decoy operating system.
In other words if your decoy system partition is 50 gigabytes in size your hidden partition must be
at least one hundred and five gigabytes in size.
What makes this a little more complicated is that we're going to create two more partitions behind the
hidden partition.
One will be a beautiful partition that is going to contain our Linux grub bootloader.
The next will be the actual operating system for our encrypted Cally Linux partition.
There are other partition schemes that can work here and once you're practiced at doing this you can
experiment.
If you prefer to separate your Linux installations across partitions that is possible you wouldn't do
do so in this window however you would do so during the installation of Cally by splitting up the system
partition that we're creating now.
However doing that is a little outside of the scope of this tutorial.
We're going to keep things simple for demonstration purposes.
So the first thing we're gonna do is we're going to right click on b c the C partition which is the
system partition and select shrink volume and we're gonna go ahead and shrink it by about 81 gigabytes.
In this example that will leave about 20 for the decoy operating system.
So now we're going to right click on the unallocated space and we're going to select new simple volume
of the amount of space available.
We're going to go ahead and assign it 41000 megabytes or 41 gigabytes.
This will make it a little more than double the size the first partition.
And remember this is a requirement.
It will also leave us around 40 gigs or so to play with for our Linux installation.
We'll use all of the default options here and we'll do NTSC format.
It's up to you if you wish to assign a drive letter.
Now we'll do the same thing again.
We'll click on unallocated space and select new simple volume
and we'll sign 30 nine thousand megabytes or thirty nine gigabytes.
Again the size will vary for you.
And don't worry about format this will leave a little over a gigabyte of free space that we're going
to make another partition out of.
This is going to be our boot partition that we're going to install the grub bootloader too.
This is a little unusual.
One thing that I want to point out is that this boot partition or any boot partitions that you create
if you create more than one always need to be at the end of the partition scheme.
There's a reason for this and I'll try to illustrate it as it becomes relevant during the installation
of Kali.
But for right now just make sure that your boot partition is at the end of the scheme and how big of
a partition you want this to be is up to you.
I recommend about a gigabyte.
The reason is that while grubs certainly doesn't take up that much space it will allow you more flexibility
for updating your bootloader later on if you so desire.
So once again we're just going to go with the default options here.
These don't matter because we will be given the opportunity to properly format these partitions during
the cowling installation.
So now we're basically done but one last thing I want to point out if you have enough disk space and
you're so inclined it is possible to have still more encrypted operating systems.
However you may run into some difficulties with the swap partition between different versions of Linux
so just be aware of this.
Also be aware that if you were to install multiple versions of Linux behind the encrypted Windows operating
systems you would need a designated boot partition for each one.
This is because every time we install grub it's only going to recognize the encrypted operating system
that we are installing it for not any other encrypted operating systems that we have present.
So for example if you wanted to have Cally and let's say a bunch too you would then have a system partition
another system partition a boot partition for Kali and a boot partition for a to again outside of the
scope of this tutorial.
But I wanted to mention that it is possible so we're now done with the disk manager.
We're gonna go ahead and close it out.
Now things are gonna get a little tricky so we're going to open up very crypt.
I've already done so it is vitally important that we follow these next steps in the correct order.
Otherwise this will all turn into a huge mess.
The first thing we're going to do is create the hidden Windows operating system using very crypt.
Again this can be any version of Windows from XP to 10.
Just remember your decoy system must be the exact same type of windows.
If you're using Windows 10 professional for your hidden system then your decoy must be Windows 10 professional.
So how this works is pretty simple and very crypt is going to encrypt the large partition we created
behind our system partition it will then copy our current version of Windows on to that encrypted partition
that is going to be our hidden operating system then it is going to wipe out the current partition and
if you watch the last video then you would know that the next step would be to install Windows on the
first partition again and encrypted.
But that isn't quite what we're going to do here.
Instead we're going to go ahead and we're going to create the hidden operating system.
We will fully delete and securely wipe the first partition but before we go ahead and install our windows
decoy operating system we're going to install the encrypted Kali Linux installation complete with its
own beautiful partition only after that is done will we install the decoy system and encrypted confused.
Hopefully it will all make sense by the end of the presentation to start with.
We need to click on system and select encrypt partition drive.
This time we're going to click the second radial button to specify that we want to create a hidden operating
system and click next.
Read through this warning carefully.
It's just telling you what I've already said.
You must be ready to install a fresh copy of Windows to the decoy operating system.
Once the hidden system is created make sure you have all of the disks on hand and make sure that you
have your windows product key the correct product key and all of your important files fully backed up
before proceeding when you're ready click.
Yes please read through this carefully and keep in mind you may encounter certain issues while using
USP devices such as unencrypted thumb drives being read only when you're using hidden operating system.
This is by design and yes.
This can make things rather a pain but it isn't necessary security precaution when you're ready click
OK.
And yes we want to grant authority.
Now you may or may not receive this message.
Depending on how your windows is configured if you don't skip this next step.
If you do what this is telling you is that there are paging files on non system partitions.
This can adversely affect plausible deniability of the hidden operating system.
It is therefore very strongly recommended that you click yes here which will configure windows to create
paging files only on the windows partition from now on.
But doing this will require a system reboot.
So I'm going to click yes once you reboot is complete you won't receive any special prompts so go ahead
and relaunch very script and once again we're gonna click system encrypt system partition drive hidden
click yes click OK yes to authorize now once again if you watched the prior videos you already know
what I think of this screen.
I call it the screen of doom because it exists only to confuse you.
We are setting up multiple beautiful operating systems so it would be quite reasonable for you to think
that you're supposed to click on multi boot and you're really not.
This screen is a holdover from true script and it really should be rewritten to be less blatantly deceptive.
We're going to click the single boot radial button and yes I know it seems counterintuitive and we're
going to click next this next pop up is basically telling you about two important salient points.
First your hidden operating system won't be allowed to hibernate but your decoy system can hibernate
normally.
You can select no.
At this point however removing the extra boot partition is outside of the scope of this tutorial.
So we're going to click yes the next pop up is reminding us that for security reasons we must make sure
the current operating system is activated and authenticated before proceeding.
This is your last chance to do so before we begin.
So if you haven't exit Vera crypt and do so now if you have click yes with all the preamble out of the
way it's now time to create our outer volume.
This should seem familiar if you've been following along but if it's new that's OK this so-called outer
volume is going to be our decoy partition.
In other words when we are using our decoy operating system the hidden system will appear to be a regular
encrypted partition to make the deception convincing.
We need to create this outer volume and will place some sensitive looking files into it in case wherever
ever called upon to melt the partition while we're using the decoy operating system.
So we're presented with our encryption options and these will be the encryption and hash algorithms
that bear crypto will be using as before we have the option of using a single algorithm or a cascade
of algorithms.
The choice is yours.
However I strongly recommend that you select a single algorithm.
The reason is that using multiple algorithms is going to slow your system performance down considerably.
If system performance is not a concern and you want maximum security by all means do as you like but
realize that all of these are solid choices.
The United States military itself uses advanced encryption standard to encrypt top secret data and that's
really going to be good enough for this demonstration.
Also keep in mind you aren't ever likely to use the outer partition for anything and in fact you really
shouldn't.
As you run the risk of corrupting your hidden operating system.
As for the hash algorithm there really isn't a wrong choice here.
You can read up on the different algorithms if you desire.
They are all completely rock solid for this demonstration.
I'll be using SHA 256.
Notice that on this next screen the option to change volume size is great out.
Just click next.
Now we need to set the outer volume password.
This is actually a little bit more tricky than it seems.
You probably won't ever have a reason to use this password since in in the normal scheme of things you're
not likely to ever access the decoy partition but you need to remember this password so that you can
access the partition if you're ever called upon to do so.
Yet if you make the password simple enough to be easily brute forced it won't be convincing.
After all if you use a password less than 20 characters long why did you even bother to encrypt at all.
Really can't give you any special advice here.
You just have to use your best judgment.
Pick a password can't be brute forced easily and you'll remember despite the fact that you'll probably
never have any occasion to use it.
I explained the key files and pin in the last few videos so I'm not going to go into great length about
them here except to say that key files add an extra layer of security by requiring certain files to
be present when the password is entered.
If these files are lost or become corrupted by even a few killer bytes they will no longer function.
So do this at your own risk.
Also keep in mind that if you ever ordered by a legal authority to grant access to this volume and you
find that you can't because the key files have become lost or corrupted you may be in seriously hot
water legally speaking.
Even if there's nothing important stored in the decoy drive for this reason I recommend against using
key files and I further recommend that you avoid using the PMA option the choice is yours.
Now this looks really simple and it is but it's also a little complicated very crypt is asking you if
you want to store files larger than 4 gigabytes on your decoy partition or your outer partition that
is to say in the prior video covering how to encrypt a USP device.
I rather mischaracterized the selection of N T S F for the outer volume by saying that it cuts available
space in half.
It does but only relative to how much data you have on the drive.
In other words what I should have said is if you save a 4 gigabyte file and you format the outer volume
using NTSC f around 8 gigabytes worth of space is going to end up being used up or double the total
amount of space used in the container when it was created.
This is because n t s f likes to store stuff stored data in the middle of the file system.
This may be a bit confusing so to cut right to the point you really want to click no here.
If you decide to click yes and go with NTFS you'll be wasting a little bit of space and this is a random
pool.
As we move the mouse around within the very crypt or true crypt window the complexity of the pool will
grow.
This is one of the safety precautions that these pieces of software use so that you're not 100 percent
dependent upon windows cryptographic functions.
These functions can fail and then you can be potentially compromised either by nation state actors or
corporations to produce a weak or predictable random pool.
This would make it trivially easy to obtain the master key and access the volume for that reason.
It is recommended that you waive your mouse cursor around in this window like a crazy person for as
long as you can stand it in order to increase the cryptographic strength and the randomness of your
encrypted container volume or partition.
Do this for as long as you can stand it.
The little bar at the bottom of the screen here is really just a suggestion and if you click display
pool then the obscuring symbols will be changed to hexadecimal.
It will also display your master and header keys when you're done.
When you're ready click format.
Also notice that four file system it will default to fat in most cases.
Fat is probably your best choice for an outer volume unless you're dealing with a drive of two terabytes
or more in which case you would need to choose e x fat or X fat
neither the outer volume has been created.
We have one chance and one chance only to add files to it.
So to do this the outer volume is currently mounted at this point in the process.
So we're gonna click the open outer volume button and it's going to open the outer volume as a partition
and we're going to go ahead and we're gonna drag are fake secret files onto this drive.
Now remember that these are going to be files that look like something he would want to encrypt and
keep secret.
But you don't actually mind if you end up having to give up your password and they do get discovered.
So what these files are are entirely up to you.
I went ahead and created a single file folder just to have something there to look at me.
Come on open up this drive later you would want to make this look convincing.
How you do that is up to you.
You might add picture files or old records or journal entries or whatever you like.
Remember though this is your one and only chance to add files to this drive.
You really don't want to add anything to the drive later on after this process is finished because this
outer volume and your hidden operating system are really occupying the same partition and there is a
chance whenever you modify files on the outer partition without protecting it first that you can corrupt
your hidden operating system.
So it's strongly recommended that once you're done with this you never touch this drive again so after
you've added whatever whatever files you wish to add close out of this and we click next.
It's now time to create the hidden volume.
This is going to contain our hidden operating system.
Click Next.
Now please pay careful attention to this warning it's very important.
It's absolutely essential that you choose the same encryption algorithm and hash for both the hidden
volume and the outer volume or decoy volume as it were.
In other words if you pick a s for your hidden operating system and Sha 256 then when you install your
decoy operating system and encrypted you need to select ATX and Sha 256 your choices must match if they
don't match you won't be able to boot into the hidden operating system.
So write down on a piece of paper whatever it is you choose from these options.
Once again I'm going to go with a yes and Sha 256 when you've made your selection click next.
Remember that the password you select for the hidden volume is the one that you're going to be keeping
secret.
And it's probably one that you want to be as strong as possible a minimum of 20 characters the password
that you choose for the hidden volume needs to be as this message says substantially different from
your other two passwords.
That is the outer end decoy volumes.
Once again you have the option of using key files or setting a pin.
I'm not going to do so.
This has been covered but you have the option when you're ready click Next
once again we're going to wave our mouse cursor around to gather entropy increase the cryptographic
strength.
Notice that you don't have an option to set a file system currently.
When you're ready click format
and we're done with this step.
Just like the creation of a hidden volume on USP.
The creation of a hidden volume happens almost instantly.
Now as I said before and I'll say it again.
Get ready for the pain.
You thought creating the outer volume took a long time but that was just the tip of the iceberg.
As soon as we clicks the start button very script will begin copying the current version of Windows
that we are running right now into the hidden volume that we just created.
It's then going to wipe the original completely out of existence in a secure manner that we will be
prompted to specify.
So we're gonna click start and we will be required to restart the computer.
This is all going to happen in the bootloader so click.
Yes.
Welcome to the very crypt bootloader.
The screen may look slightly different in you EFI.
It is possible to abort at this stage by pressing the escape key which will allow you to boot into windows.
We haven't as of yet done anything.
As soon as we put in the password to our hidden operating system however everything is going to be set
in motion.
If you selected a value for Pym you would enter it now.
Otherwise just press enter the password will now verify.
I have noticed that this verification process takes substantially longer with better script than it
does with true script.
Presumably this is a result of updated security although the true script audit which I do strongly encourage
you to read online if you're interested.
Found no flaws with bootloader implementation.
In any case you are in for a bit of a wait here.
But once the password does verify the process of copying the hidden system will begin.
There we go.
The version of Windows we were just using on the C partition is now being copied into the hidden container
or volume that we created on the D partition.
That is to say on the first partition.
Windows is being copied onto the second partition.
Once this is done we'll boot into the hidden operating system on the second partition and be prompted
to securely delete and wipe all data located on that first partition or C partition.
Once that is done we're going to begin the process of installing Kali Linux as an encrypted system.
Once Cally is installed then we can go ahead and install our decoy Windows operating system on the first
partition.
Once all of our systems are encrypted the very crypto bootloader will direct you to the correct system
based on the password you enter.
In other words if you wish to boot into the decoy operating system you would supply your decoy password.
If you want to boot into the hidden operating system which is being created for us right now you'd supplier
hidden password if you wanted to boot into Cali Linux you would press the escape key.
Select the second mutable partition which we're going to setup and that would then take you to the password
screen where you would enter your encryption password for Cally.
It is strongly recommended that you read through all of our crypto documentation on hidden operating
systems so that you can maintain plausible deniability.
It is also recommended that your decoy operating system be used from time to time so that it shows signs
of being lived in a decoy system that is never used makes a very poor decoy.
I would also like to note in case you are a little worried at this point that the decoy system works
exactly like a normal windows installation since these are actually two totally separate partitions.
You can save files on the decoy operating system without any fear of corrupting the hidden system as
would be the case if you saved files to the outer volume without first placing it into protected mode.
This will be demonstrated a little later in the video for right now.
I'm going to make a cut to the recording so that we can skip to the end of this process.
Copying is now complete.
Enter the password to boot into your hidden operating system remember to just press enter for Pim unless
you set a value in which case you would enter that value excellent our hidden system is now up and running.
Read through this if you want.
It's just telling you that even though we appear to be on C drive we are in fact on the D drive.
Of course your partition designations may vary but the point is that the applications will not be able
to tell the difference between a hidden and decoy systems because both systems will appear to be the
primary system partition or in this case c if we were to click the defer button we could postpone the
next step until our next reboot.
If you're ready to proceed click next.
Now it's time to wait again.
The original system needs to be securely deleted.
As you know simply deleting something of a hard drive won't actually make the information go away.
It can still be recovered by using certain tools and forensic techniques to securely delete data.
We're going to need to overwrite that data that we wish to delete with random nonsense.
The more we do this the harder it will be to recover the original operating system or to even know that
one existed.
Click next.
As I explained in the prior video the number of passes indicates how securely your data is going to
be wiped but also adds time to this already lengthy process.
One pass will simply overwrite the operating system and that's that three passes is a better level of
security and is used by the Department of Defense of the United States to wipe secret data seven passes
is used by the DOJ to wipe data classified top secret and above 35 passes.
Also known as the government wipe is generally used only when you plan to discard a drive.
It is extremely hard on even conventional hard drives.
And remember also that solid state drives have a limited number of read rights before they begin to
fail.
The choice is yours but three passes should be very sufficient for most users.
If you have the time to devote and if you are paranoid 7 passes should be enough to defeat even the
most determined adversary.
However if your life hangs in the balance and you absolutely positively must do so you can select the
government wipe.
I've never actually heard of anyone selecting 256 passes.
I wasn't even aware that very crypt added that option and frankly it's kind of beyond insane.
If you ever have a hard drive that requires that level of time and effort to wipe you're probably just
better off smashing it and burying the pieces 256 passes will not be a good choice for hard drive longevity.
I strongly recommend that you not choose it when you've made your selection.
I'm going to go with one WIP for this demonstration.
Click Next when you're ready to begin click wipe.
You will be prompted with a warning that the entire contents of the original operating system will be
erased.
Once again we're being asked to generate entropy in the form of mouse movements.
This is of course the random pool if we click display pool it will change these symbols to hexadecimal
this is because as I said Windows cryptographic functions can potentially fail or be compromised.
So while doing this may seem a bit tiresome it does add extra layers of security that is not easily
sabotaged.
So when you're done click continue and click yes to authorize as always.
Once the authorization is done very crypto will proceed to wipe the original drive.
Keep in mind as you watch this that the amount of space we're dealing with is really quite small and
I'm only doing a single wipe for a modern hard drive.
Be prepared to devote hours to this stage of the process.
All right.
The contents of the original operating system have been securely erased.
Our first partition is now totally blank.
You should read through this information carefully and maybe even print it the first thing it is telling
you to do is power off your computer and leave it powered off for at least several minutes.
Although ideally you should do this for up to an hour.
This is because memory still remains active in the ram ships until they have had time to cool.
And this may include evidence of your hidden operating system.
If we were doing this normally the next step would be to install our Windows operating system as the
decoy.
However since we want to install an encrypted version of Linux in this case Kelly we need to do that
first.
Once our encrypted Cally is installed with the grub bootloader and our designated boot partition we
can then go ahead and install windows again on the first partition encrypt it and everything should
work smoothly.
So we need to take our Cally installation media and use it to boot up our computer
so I'm going to go ahead and reboot with the Kelly Cedi installed.
Once you reach the screen you're going to select graphical installation.
Most of these initial options are pretty straightforward so I'm just going to go through this quickly.
Select your language.
Continue.
Select your country click continue and select your keyboard layout.
It's not necessary to configure the network at this time so it will click continue.
Now we have the opportunity to name our system.
You can provide any hostname you like.
I'm just going to go with Carly.
When you've done this click continue.
And now we need to set our root password.
Remember that the default is tor t o o r.
I'm going to set it as Tor but you may set it as whatever you wish.
This is not our encryption password but rather the password to log into Cally once we've decrypted it
click continue.
Go ahead and select your time zone.
Okay we're gonna go ahead and click manual and continue.
Now we need to set up our boot partition so we've got these two partitions down here that we created
after the two primaries.
Now this first primary was our original Windows operating system which has been wiped.
Third primary in this particular scheme is our hidden operating system.
And you can tell because this is a little more than twice the total size of this first partition.
And we have these two logical partitions down here and the first one the larger one is going to contain
our encrypted Cowling installation.
So we need to set up our boot partition that is going to link to that encrypted Cally and it's always
the last one on the list.
So we're gonna double click it and we're going to double click use as X T for journaling file system.
We're gonna set the Mount point to boot and then we're going to click done setting up partition and
notice now that this change to e x T4 and we see that it is now a beautiful partition while we're at
it let's go ahead and double click on the Cowley partition.
This isn't absolutely necessary but it will make it easier to recognize later so we don't make a mistake
and we're going to double click use as and we're going to select X T4 again.
And this is again mainly just so that we know what we're looking at later in the process.
We don't want to accidentally format one of our windows partitions by mistake click done setting up
partition.
And with that done we're going to come up to configure encrypted volumes and double click it and we're
going to select yes we want to write the changes.
This may take a few moments okay.
We're going to click Create encrypted volume.
Now we're going to select R. Kelly Linux partition or what is going to become our encrypted Cally Linux
partition.
But this is very important don't also select your beautiful partition.
What we're doing here is we're creating a container an encrypted container on.
In this case SDH 5 and your number may vary which is going to contain Cally and if you were to include
your boot partition in that encrypted container then it's not going to be recognized when you boot up
your computer and you won't have any way of getting into it.
So just select your Kelly partition and be careful not to select your windows partition and one more
thing.
Make note of what your beautiful partition is in my case it's Dev slash SD 6.
Yours may vary.
You're going to need to remember this.
You might want to write it down because we're gonna have to manually enter forward slash Dev 4D slash
SD 6 when it comes time to specify where we want to install the bootloader and if we install it in the
wrong place the whole process will fail.
So when you're ready click continue the default settings are in my opinion just fine.
We do have the option to change certain things.
For example if you don't like a yes encryption you do have other options but the defaults are going
to be very strong.
So we're just going to go with that in this demonstration when you're ready click done setting up partition
and then we're going to click finish.
And when prompted we are going to write the changes.
Now we're being prompted to erase all data on the partition that we have selected for encryption.
This wiping process is more or less exactly what very cryptic does with a partition prior to encryption.
It is important for security reasons.
So I recommend that you do so.
We're going to click yes you have the option of canceling this process to save time in this demonstration.
I'm going to cancel but if you're doing this for real I strongly suggest that you allow this process
to complete.
Now you need to select your encryption passphrase.
This passphrase should be 20 or more characters any less than that and will be relatively easy to brute
force depending on the password you select.
There's really no point in encrypting your entire operating system if your password is something easily
found in the dictionary.
In any case whatever password you select you need to remember because there is absolutely no way to
recover it if you forget it.
You will be locked out of your system.
So choose carefully when you've entered your very strong password.
Click Continue.
You probably won't see this warning.
Hopefully you won't see this with that out of the way.
We're going to configure the launch call volume manager we're going to say yes to write changes and
now we need to create our volume group.
And this is what's going to contain all of our encrypted volumes.
Or rather the volume is going to be encrypted and contain our operating system and our swap area.
So click Create volume group and we're going to need to give the volume group a name.
This can be any name you want.
For simplicity I'm just going to call it crypto underscore.
KELLY Again you can name it whatever you want.
Click Continue.
And now we need to select or partition that we're using as this encrypted volume.
It's been setup in my case it's SD a five underscore crypt 64.
Be careful not to select any of your other partitions.
Click Continue.
Now we're going to click Create logical volume and we're going to select our group and we're going to
define this first volume as the swap underscore area.
You could just call it swap or whatever you like click continue.
Now how much space you assigned your swamp area is up to you.
There is a lot of debate about how big a swamp area should be.
I personally believe just a little over four gigabytes is best if you have a larger system.
You may wish to have a larger swap area.
You can of course choose not to use a swamp area at all.
If you wish.
Whatever you decide entered and click continue and we're going to create logical volume again select
our crypto Kelly group now that this is going to be the root partition or the Cali partition if you're
one of those people who likes to split up your Linux installation for example having a root partition
and a different home partition and so on and so forth you can do that.
I'm not going to be demonstrating it in this tutorial it's a little outside of the scope.
I want to keep things simple for this demonstration but if this is how you would do it you just create
each logical volume within this group and then set it up accordingly in the next steps.
So we're going to call this the Kali underscore root and click continue and we're going to assign it
the maximum amount of space left click finish.
So now we need to set up our root partition and our swap area.
So this first partition we're going to double click on it.
We're going to double click on use as X T4 or whatever file system we prefer.
And we're going to set the Mount point as root.
Now again I'm just going to quickly point out that if you wanted to separate your partitions you would
have simply created a few more partitions within the volume that we created.
And then you would set for example your home partition and your root partition and so on and so forth.
But I don't want to get confusing.
We're gonna set the root partition and we're gonna say done setting up partition and now we're gonna
double click on this second four point two gigabyte partition and we're going to double click on use
as we're gonna define it as the swamp area.
So double click on that done setting up partition and now we're going to scroll all the way to the bottom.
We've got our root partition.
We've got our swamp area.
These are all setup within our encrypted SDK five underscore crypt volume that we've created.
So we're going to click finish partitioning and write changes to disk.
We're going to click yes to confirm we wish to write changes and click continue.
Now the operating system will install this will take some time so please be patient.
Once the lengthy installation process is complete you can use a network mirror if you want to configure
the package manager.
I'm going to say no.
Okay now here we need to be a little careful because this is the part where most people seem to goof
up this process.
We're now being asked if we want to install grub bootloader to the master boot record.
Normally we would do this but remember the master boot record is going to be taken up by the very script
or true crypt bootloader.
So we can't install grub to the master boot record we need to say no and click continue and then we're
going to specify our second beautiful partition and this has to be done manually.
Remember I said to write it down.
So we're going to enter the device and in my case it's going to be forward slash Dev forward slash Esh
SD a six.
Yours may vary.
Once you've typed in your boot partition going to click continue and grub will be installed to that
partition.
So now when we boot our computer we will first be presented with the very script or true script bootloader
and if we were to press the escape key we would see a list of beautiful partitions we would select.
The second partition on the list and that partition is going to contain R. Kelly Linux grub bootloader
which will then allow us to boot into Kali and will then be prompted for our encryption password to
open the Cowley volume which is encrypted so hopefully that didn't seem too confusing with the installation
complete and go ahead and remove your installation media whether it's a CDO or a pen drive containing
your Kelly Linux image and then when you're done click continue.
Once you reboot you'll find yourself in the very crypt bootloader or true crypt.
If you used true crypto instead we haven't installed the decoy operating system yet.
So if you enter your hidden password that is to say the password for your hidden Windows operating system
you will boot into it.
But if you press the escape key notice that we have two beautiful partitions.
If we select the second mutable partition we're in grub we'll go ahead and boot Kelly and in a moment
we will be prompted for our encryption password
and here we are in Cali normally.
Now we would just enter our user name which in most cases is route and whatever password you specified.
But we're not going to log in to Cali right now.
We've confirmed that Cali has been installed successfully and is encrypted so now it's time to install
the windows decoy operating system.
This will be the final step of this procedure.
We're going to need to insert our windows installation media whether that's a city that you burned with
the ISO or a U.S. B pen drive and we're going to boot our computer from it to get into the windows installer
then we're going to install Windows normally and this will temporarily make the hidden operating system
unsuitable and we're going to encrypt this new installation of Windows to be our decoy.
Once this is done all three operating systems will once again be accessible.
So let's go ahead and do that now.
All right then.
Having booted from our windows installation media we will be presented with a screen like this.
Now this is all a very straightforward process of following prompts all of which you'll see me do though
I will make little recording edits to make sure that this process speeds along.
So when you're ready click next and click install.
This is where you enter your product key for your Windows installation.
You can skip this step if you don't have a key.
But remember you need to activate Windows before you encrypted.
This is very important since I'm doing this for a demonstration.
I will click I don't have a product key.
Select your operating system.
If you're presented with different choices remember to select the same operating system that you're
using for your hidden operating system.
In my case that is Windows 10 professional you will be required to agree to these terms before you'll
be allowed to proceed select custom.
And remember to select the first partition not the system reserved.
If you have one.
But this first partition.
We wiped that contained or original Windows installation.
Remember it'll be smaller than the partition immediately following it.
Because this is our hidden partition which is by requirement a little over twice the size.
When you're ready click Next windows will now proceed to install normally.
Please be patient.
The rest of the installation process is really just going through the steps.
You can use Express settings if you want to.
I always choose customize and I tend to switch all of these off.
I'm not sure it does any good with Windows 10 but once you've made your selections and you're ready
to proceed
once you're done windows will setup and you should boot straight into the operating system.
So once all the critical updates are downloaded and everything is setup and we're back in Windows we're
gonna go ahead.
We're going to open up our browser of choice or more likely edge because that's what comes default with
Windows nowadays and we're going to download a better script.
Remember that we need to download the installer and not the portable version with that done we can go
ahead and close our browser and we'll run the very script installation click yes to authorize select
your language accept the terms and click install once the installation is successful click OK finish
you can read through the beginners tutorial if you wish.
Close out of this all right now with very scripts installed.
We're gonna go ahead and we're going to encrypt this operating system and it's going to become our decoy.
Now remember it's very important that you make sure that your current windows installation is properly
activated before proceeding to the next step.
It's also recommended that you go ahead and download updates at this time.
You don't absolutely have to.
The reason I recommend to doing that is because when you're running through the very script reboot you
really don't want to deal with Windows Updates reconfiguring things in the background.
So it is your choice but when you're ready to proceed go ahead and run very crypt and from here we're
gonna go to system and select encrypt system partition drive the hidden operating system has already
been created.
We're going to now create the decoy so we want to make sure that normal is selected.
Press next we're going to select encrypt the Windows system partition click next.
And now once again were on my favorite screen which is essentially trying to trick you.
I have never really run into a case where multi boot was the correct choice.
Pretty much every time no matter how you set this up you're going to want to go with single boot so
click the single boot radial button and click next.
Now this is very important.
Whatever options you selected for the hidden operating system need to be repeated here.
In other words if you selected a yes for the encryption algorithm you need to select a yes again and
the same is true for the hash algorithm.
If you change either option in other words if your hidden operating system and your decoy have either
a different encryption algorithm or a different hash algorithm than the hidden operating system will
not boot.
So please make sure that these are the same choices you made when you set up the hidden operating system
and click next.
Now we need to give the password for our decoy operating system.
And again it is important that you pick a good password to make the deception credible.
You also need to be able to remember it.
Few were ever forced to give up your password.
This is the password you'd give up along with the outer volume.
Again key files are an option.
Do not select the use of the Pym option unless you did so with the hidden operating system.
And if you did set a pin with the hidden operating system be sure you choose the same setting here 20
or more characters is recommended for the password when you're ready click next.
Now we've reached the random pool collection screen.
This should look familiar to you by now and I trust it needs no further explanation.
If you wish to display the pool content that option is available simply wave your mouse cursor around
for as long as you can stand it and try to be as random as possible.
And remember that the bar at the bottom of the screen really is just a suggestion.
You can keep doing this longer if you wish and the longer the better.
And once you're satisfied click next click yes to authorize the screen is letting us know that our keys
have been generated.
You can hide these keys if you wish.
Now comes the tricky bit both true crypt and very crypt require you to create a rescue desk.
If you encounter a situation where windows will not start or if the very crypt bootloader itself gets
corrupted somehow the disk will allow you to repair this damage.
Keep one very important detail in mind.
However the rescue disk is not a substitution for the password and or key files.
If you forget your password or you lose your key files or you set a pin and you forget about it you're
out of luck.
We can use the Browse button to select where we want to save the iso file.
The file would then be placed on some form of external media such as a USP or burned to a CDO before
proceeding very script gives you the option of skipping the rescue disk verification which is handy
if your system doesn't have any way to mount it.
True Crypt does not give you this option if you are using True Crypt you will need to mount the iso
image somehow either by right clicking it and selecting the mount option in certain versions of Windows
or by using third party software and Windows 7 to melt the image as if it were a drive for this tutorial.
I'm going to go ahead and click skip rescue disk verification when you're ready click next.
We're now being told essentially what I just said that the ISO for the rescue desk has been created
in a directory that we specified and that it should at this time be moved to external media or burned
onto a disk.
Click Next this screen is telling you something important so don't just flash right through it.
This is reminding you that each rescue disk is unique to the encrypted operating system that you're
using it on.
In other words if you create a rescue disk on another system or even a prior encryption on the system
you're using now the disk won't work.
Only the disk that is now being created will work with this encryption so keep that in mind and click
OK.
And last but not least we need to once again select our WIP mode since we already covered this with
the hidden system creation.
I won't go over it again for this demonstration.
I'm selecting none.
Keep in mind that the more passes you select the longer this process is going to take and the harder
it's going to be on your drive.
Please do not select government unless you absolutely have to.
Once you've made your selection click next and the last step is going to be the encryption pretest when
we click the test button.
Windows is going to reboot and we will be presented with the very script password screen.
If we fail to enter our password or if something broke along the way the test will fail and no harm
will be done.
If the password works and everything else functions correctly we will be prompted to proceed with the
encryption process.
Please note however that you must not boot into the hidden system at this time.
It will seriously goof things up when you're ready click test.
You may read through this if you wish otherwise click Okay.
We will now be prompted to restart click yes to confirm.
So here we are once again on the bootloader screen.
I've mentioned before that cosmetically this is almost identical to the true script.
Boot loading screen.
Except that we have the option to show our password and Pym and also to skip authentication with the
escape key which by the way does work with true crypto as well.
Remember this is only the pre-test.
Our system is not yet being encrypted.
Enter the password you selected for the decoy operating system and again do not enter the password for
the hidden system or the outer volume under P.M..
Just press enter unless you specified a specific value in which case you would enter that value now
true crypto has no Pym prompt.
He will now verify our password and this may take a minute or two.
Once done windows will boot normally and we can begin the process of encryption.
Once Windows is finished rebooting will need to wait just a minute for the notification to pop up telling
us that our pretest was successful and there it is our pretest was successful.
We could click the defer button if we don't wish to begin encrypting right now.
However we're ready so we're gonna go ahead and click encrypt read through this pop up and printed if
you wish.
It is simply telling you how to use the rescue disk if you need to when you're ready click OK and finally
click yes to authorize.
Now we can see the encryption progress.
It would begin with the wiping of free space.
If we had selected a white mode other than none.
I said all of this in the prior video but you may have skipped it and it does bear repeating so I'm
going to say it again now.
I really can't stress enough just how long this takes.
You are seeing this performed on a very small amount of space but for a real system this process can
take days.
A four terabyte hard drive might take up to a week or more.
Of course it depends on many factors.
I therefore suggest that you place your system somewhere cool and keep all potentially flammable objects
away from it as you may need to leave it on for an extended period unattended and the heavy drive usage
may cause it to heat up quite a bit.
Please also keep in mind the laws of your region of the world concerning encryption.
As I mentioned before I'm not an international lawyer.
Depending on where you are in the world encryption may or may not be legal or you may be under a legal
obligation to surrender your password and keys if requested to do so by certain authorities.
Even if they do not have a warrant as such.
If you fail to comply with these laws you may end up in hot water.
This is very important to remember when you're traveling abroad.
It might be 100 percent legal to encrypt your laptop in the United States but you might be in for a
nasty shock when you travel to certain parts of the world and airport authorities demand that you decrypt
it or worse you must do your due diligence and make certain that you were employing these techniques
in a way consistent with the laws of wherever you happen to be.
To avoid getting into any legal trouble the hidden operating system and plausible deniability exists
so that in the event that some criminal attempts to compel you to give up your password you have a way
of protecting your real data withholding the hidden password from lawful authorities when you are expressly
required by law to give up all of your encryption keys may be illegal.
Please have all of this sorted out in your mind long before you ever find yourself in this situation
where you need to think about it.
Encryption is a very good technology and protects innocent people from oppressive powers.
Helps to ensure honest journalism and protect important information from criminal theft.
There are many good and lawful reasons to employ encryption.
Even at the level that we're seeing in this video and we're done click OK and finish all right now we're
going to reboot the system.
So now if we enter our decoy password our decoy operating system will boot if we enter our hidden password
our hidden operating system will boot if we press the escape key and select the second mutable partition.
As you saw before we can then boot into R. Kelly Linux installation and we will be prompted for our
encryption password.
So for right now we're gonna go ahead and we're going to boot into the decoy partition.
Remember that if you did not specify a pin.
Just press enter.
Now we could end the video here and if this is all you need to know then.
Thank you for your attention.
But the last thing I'm going to show off is how to mount the decoy or outer volume.
If you're ever called upon to do so this is something you will need to know.
So here we are once again in our decoy installation of Windows and you'll notice that when you go to
this P.C. or my computer you have this local disk D and we know that this is the partition which contains
the hidden Windows operating system.
But an adversary who is looking at this decoy installation of Windows will notice this drive and will
probably ask you what it is.
And of course you don't want to say that it contains a hidden Windows installation or that would defeat
the whole purpose.
So remember that we set up what was called an outer volume and this contained files that looked sensitive
like something we would wish to encrypt but are actually files we don't mind falling into the hands
of an adversary so to mount this partition not as a hidden operating system but as what appears to be
a normal encrypted volume.
We're going to launch very crypt and we're going to select any drive that is not currently in use.
We're going to select device we're going to choose the appropriate partition and then we're going to
mount.
We will now enter our outer volume password
and please notice that there is a true crypt mode that you can click on.
If you're using a volume that was created with True Crypt one ready click OK.
Notice that the partition has now been mounted as a Z drive and it appears to be a normal encrypted
volume under type.
So we go back to my computer or this P.C. we can see local disk Z and it contains the supposedly top
secret files that we placed into it during the creation of our outer volume.
Someone very knowledgeable about how very crypt or True Crypt works might suspect the deception but
they will be unable to prove the existence of a hidden operating system.
This gives you plausible deniability.
And one last thing.
And do not under any circumstances add or modify files on this drive.
You run the risk of damaging your hidden operating system.
If you need to interact with this file space at any time when you're not under any sort of a threat
then you need to mount the drive in what is called protected mode which I will now demonstrate.
So we're going to dismount the drive and we're going to once again click mount.
And this time we're going to go in to mount options.
We're going to click protected and volume against damage caused by writing to the outer volume.
And for this we need to supply the password to our hidden operating system.
So remember only do this when you're alone.
You'll need to you.
You'll need to specify a poem if you set one and you'll need to use key files.
If you used key files and you'll only need to use key files if you specified them during the creation
the hidden system.
When you're ready click OK then enter the password and credentials for your outer volume click OK.
We'll receive this message and notice that the outer volume is now revealed under type as being an outer
volume.
So the character of the partition is in this way revealed so again only do this when you're alone and
only do this when you absolutely need to.
And that's about it.
How you use your decoy and hidden operating systems is entirely up to you.
However I would suggest making frequent use of your decoy make it your daily driver for most of the
things that you do only use the hidden system for activities or when dealing with data that needs to
stay hidden.
That way if anyone ever has cause to examine your decoy system in detail it will appear lived in a decoy
system that is never used is going to look extremely suspicious.
Also remember that your hidden operating system right protects things like external media to prevent
data leaks so you may find that certain activities like transferring files via a USP is a pain while
using the hidden operating system in a prior video.
I gave a demonstration of how to remove the encryption for an operating system if you so desire.
Please see that video for more information about doing that if you wish.
However this will leave you with two windows systems installed side by side and a potentially broken
bootloader.
So please make sure you have a boot repair disk of some kind handy before you attempt that if at any
point you wish to start over from scratch.
And I do mean square one or if you just wish to securely delete all encrypted data once you're done
using the encrypted systems please see the video later in this module covering Derek's boot and nuke
boot and nuke will completely wipe a hard drive including its partition table and allow you to start
fresh with the obvious catch being that all of your data will be totally erased.
Finally it is probably worth repeating that for any of this to work you will need to disable any protected
boot settings in your BIOS.
If they exist this is done at your own risk and may require you to reinstall your operating system.
It may also be possible to switch from GP t partitioning to NPR and put your bootloader into legacy
mode.
Again this is done in bios and Iran risk although it may make things much smoother because every version
of bios is a little different.
There isn't any real way to show this.
So you may need to research the subject a bit if it is a consideration for you.
Thank you for your attention.