Full system encryption on already installed system

[joao177]

The FAQ describes how to perform a full disk encryption at the moment of the installation, in a way a passphrase is asked at boot time. My question is, could someone do the same AFTER the system was already installed?

Some information that might be useful:

% uname -a
OpenBSD localhost.localdomain 6.9 GENERIC.MP#473 amd6

% doas disklabel -h sd0 
# /dev/rsd0c:
type: SCSI
disk: SCSI disk
label: WDC WD5000LPCX-0
duid: 60ba97023390d6f0
flags:
bytes/sector: 512
sectors/track: 63
tracks/cylinder: 255
sectors/cylinder: 16065
cylinders: 60801
total sectors: 976773168 # total bytes: 476940.0M
boundstart: 1128448
boundend: 294729728
drivedata: 0 

16 partitions:
#                size           offset  fstype [fsize bsize   cpg]
  a:        133594.4M          1128448  4.2BSD   4096 32768 26062 # /
  b:          9765.6M        274729728    swap                    # none
  c:        476940.0M                0  unused                    
  i:           550.0M             2048   MSDOS                    
  j:        144384.0M        513984512  ext2fs                    
  k:        107058.0M        294729728  ext2fs

Thanks in advance!

[jggimi]

Hello and welcome!

The simple answer: No.

The longer answer: You would have to back up the system, wipe the drive's disklabel partitions, create a softraid drive, recreate your partitions, restore from backup, and recreate bootblocks.

[joao177]

Originally Posted by jggimi

Hello and welcome!

The simple answer: No.

The longer answer: You would have to back up the system, wipe the drive's disklabel partitions, create a softraid drive, recreate your partitions, restore from backup, and recreate bootblocks.

Thank you!