My computer is using a double OS partition Ubuntu/Win11. I choose from the initial double boot which one to use. I want to encrypt the Ubuntu partition only and I’m not an advanced user (1 year using Ubuntu only). I found some technical info about genera encryption, but I’m not sure it is applicable to my personal situation. Could someone please help me to understand how to do it whithout touching the Win11 partition?
Yes, you can encrypt only your Ubuntu installation without affecting Windows 11. However, if Ubuntu was installed without encryption, you can’t simply enable it afterward. The safest option is to back up your files, reinstall Ubuntu with LUKS encryption enabled, and then restore your data. During installation, choose “Something Else” and modify only the Ubuntu partitions , leaving the Windows and EFI partitions untouched. GRUB will still detect Windows, so your dual-boot setup will remain. While it’s possible to encrypt an existing Ubuntu installation, the process is complex and can leave your system unbootable if something goes wrong. Before you begin, make sure you have backups, a Windows recovery USB, and an Ubuntu installation USB.
@dmxplx already gave you the answer for full-disk or partition-level encryption. However, you might not need that. If that’s what you want, reinstalling is the easiest, and sometimes (as with LUKS, probably the best option if you want all your Ubuntu data to be encrypted) the only way.
Otherwise, there are much easier solutions. If you only need or want to encrypt some of your data, say a Documents folder or similar, you could use something like gocryptfs.
The Ubuntu installer for 26.04 makes it easy to encrypt the partitions during the installation process.
Windows 11 will not be affected.
Bitlocker (Windows 11 Pro) must be disabled before you install Ubuntu 26.04 but it can be re-enabled afterwards.
I had a spare disk so I installed both Windows 11 Pro and Ubuntu 26.04
Here is the partition layout with one personal (not essential) choice
Before the Ubuntu installation, I removed the ESP and Boot flag from the Windows ESP (nvme0n1p1) so that the Ubuntu installer would automatically create a new ESP (nvme0n1p5)
It allows me to destroy either OS if I want to conduct future tests.
test@test:~$ lsblk -e 7 -o name,size,pttype,type,fstype,fsuse%,fsavail,mountpoint
NAME SIZE PTTYPE TYPE FSTYPE FSUSE% FSAVAIL MOUNTPOINT
nvme0n1 232.9G gpt disk
├─nvme0n1p1 200M gpt part vfat
├─nvme0n1p2 16M gpt part
├─nvme0n1p3 100G gpt part BitLocker
├─nvme0n1p4 743M gpt part ntfs
├─nvme0n1p5 1G gpt part vfat 1% 1G /boot/efi
├─nvme0n1p6 2G gpt part ext4 4% 1.7G /boot
└─nvme0n1p7 128.9G gpt part crypto_LUKS
└─dm_crypt-0 128.9G crypt LVM2_member
└─ubuntu--vg-ubuntu--lv 128.9G lvm ext4 11% 105.4G /
test@test:~$
I would not advise trying to encrypt an existing Ubuntu partition - too complicated and easy to make a mistake.
Better to allow the Ubuntu installer to do all the heavy lifting
Backups are essential together with recovery USB devices.
Having multiple ESPs on the drive was always iffy. As example, attempt to repair Windows boot configuration in Windows 7 recovery boot completely destroyed this configuration instead. Some systems offer “Boot from UEFI disk” meaning “use the default bootloader on ESP”; multiple ESP may or may not work in this case.
Windows and Linux can coexist on the same ESP without negative effects. Whether Ubuntu installer supports reusing the existing ESP without re-formatting it I do not remember.
Yes, I’ve often come across this observation.
I did mention in my reply that it is a personal choice and it’s unimportant if it fails because it’s a test.
Out of interest, I’ve tried to find the definitive clause in the UEFI specification about extra ESPs but, so far, it has eluded me.
This implies that you can boot the disk rather than choose a particular system on the disk.
I have a PC where you can boot the disk if only one ESP is present (Grub has to take care of the subsequent choice)
When I added a second ESP, the PC gave me the choice of booting either system (i.e. directly from the PC boot menu).
Thank you very much for all your replies. Honestly, I’m too scared to reinstall my Ubuntu partition and then restoring my files. Murphy’s law is relentless and I know for sure something would be lost. However using a specific too encrypt particular folders sounds more interesting. I have been recommended Veracrypt to do it. Is there an easier/more reliable tool to do it and, at the same time user friendly? Please remember that this is my first year on Ubuntu. I’m not a linux guru like all of the people here!
