I assume you already have a USB drive with the regular Debian 12 or Kubuntu image flashed directly on it. Having it as a file on the drive will most probably not work unless you have a special setup on that stick.
If not, you can do this step from the existing Windows 11 installation with a tool like Rufus.
Shrink the Windows C:\ drive
On my machine the internal drive is 1TB in size. Windows is known for its hunger for space, so I reduced it to 220GB.
In the start menu type "Computer Management" and launch as Administrator.
Then under the "Disk Management" find the
C drive and shrink it so that it remains roughly 220GB (or more depending on your needs) in size and hit apply.
Doing this on an alreay used drive takes more time than on a fresh one so grab a tea.
Install the latest firmware
Especially the BIOS, TouchPad, Chipset and the WiFi/WLan adapter firmware updates contain critical fixes. Some are security relevant, others just prevent crashes.
Some (Samsung) SSDs need firmware updates too so they don't burn out, best to install all the updates.
Prepare the BIOS/UEFI
First we must enable the "3rd party CA" or "partner keys" in the UEFI so we can boot from the USB stick that holds the normal image.
Alternatively, one could also either add the Linux Boot Keys specifically or simply disable Secure Boot.
With integrated AMD or Intel graphics the BIOS usually has an option for the initial VRAM split. On my AMD system increasing the default value from 128MB to 2GB makes animations smooth and allows me to play games.
My Intel machine has a maximum of 256MB, the animations are smooth too so I assume they make that adjustment in the driver at runtime.
Boot in "Try Kubuntu" mode
This allows us to execute any program like the shell that we need.
Start the setup and set your favorite keyboard layout and timezone. Connect to cable ethernet or WiFi to fetch updates automatically during the installation later and lookup things like this guide.
When the setup asks you to reformat the whole disk, go to the next step.
From the start menu, open
partitionmanager and add a 2GB partition formatted with
Then add a second partition that uses all the space and format it with
lvm2 pv and check the
enable encryption checkbox, call it
crypto-root or something not too generic.
Enter your disk encryption password here.
Important: if you forget that password all your data is lost forever.
Important 2: if you share said password all your data is potentially compromised.
If everything looks good hit
apply and take a sip of tea.
Open the encrypted container if it is not open already.
Encrypted partitions / logical volumes
First, open a Terminal and type
sudo -i (and press Enter to execute) to become root.
Now you don't have any restrictions and can do a lot of good as well as destroy your whole machine. ⚖️
First we need to add a volume group consisting of the space we just allocated that we name
crypto-vg or something:
vgcreate crypto-vg /dev/mapper/crypto-root
vgs command or
vgdisplay to confirm the size.
Now it is time to add a SWAP partition. This one should be at least the size of your RAM for suspand-to-disk aka. hybernation up to double that. I choose double the memory because I might upgrade my RAM in a year or two and I don't want to repartition then:
lvcreate --size 64GB crypto-vg
Finally we create the logical partition that will hold our OS and data:
lvcreate --extends 100%FREE crypto-vg
Note that we did not format any partition yet, the installer will do that for us.
Installing the operating system
Back in the installer we choose "custom partitioning" and click next.
In the next dialogue we should find all the physical and logical partitions:
- Ignore the Windows or Bitlocker as well as the EFI and Recovery partitions
- Pick the 2GB ext2 partition and use it as
- Select the 64GB partition with the long name as
- Select the huge partition with the long name as
Let the installer reformat the 2GB
/boot partition if it asks.
Now continue with the normal setup.
When it starts to install software or updates change back to the terminal and continue while it runs in the background.
Configuring the unlock screen
Without this screen the system will boot half and then be stuck.
It is absolutely possible to contine the boot by manually unlocking the partition, but is clumbsy and we would have to type the
cryptsetup command everytime.
Instead we are storing the UUID of our container in a special file:
This file has the following format:
label UUID=... none luks,discard
Now we need the actual UUID to replace the
... that we can get from this command:
blkid | grep LUKS
Copy the parts between
" withouth the
" and we are done.
In the end the line you add should look like this, where
none means that the boot loader should ask for your password:
kryptoWurzel UUID=abcdef01-2345-6789-abcd-ef0123456789 none discard,luks
discard is for SSDs and
luks because we use a LUKSv2 container.
Updating the initramfs aka. boot system
Sadly, the installer is not considering our shiny new crypttab file and we have to a final touch.
First we have to verify that the
/proc filesystem is still mounted in the
If not, bind mount it like this:
mount --bind /proc /target/proc
When the installer is on the last page, go back to the terminal and type this:
chroot /target /bin/bash
You are now inside the new installation and everything should be mounted correctly already. Now we can regenerate the initramfs with this command:
update-initramfs -c -k all
Once that is through type
exit + Enter to close each layer in the terminal.
Now we tell the installer to reboot the system.
After the BIOS splash screen we should be greeted by GRUB that allows us to choose between Kubuntu Linux and Windows 11.
And finally the unlock screen for the full disk encryption (FDE) is the confirmation that everything worked. After entering your personal password the system behaves normally and everything works just like always but is more secure than without the encryption.
Congratulations and enjoy your tea.