Repository navigation
NixMount now opens encrypted Linux volumes. Most installers offer full-disk encryption with LUKS, and until now those disks were listed as unsupported, as they were by Ext4Fsd and WinBtrfs.
Encrypted volumes
Select a volume with a lock, type the passphrase you use when Linux starts, and select Unlock. It then mounts, browses and exports like any other volume, read-only or read-write. Lock forgets the key again.
- LUKS1 and LUKS2, with AES-XTS (the default since 2013) or the older AES-CBC
- Argon2id, Argon2i and PBKDF2 key derivation, using several cores like Linux does
- The passphrase is never saved, and never reaches the background service
- From the command line, commands ask for the passphrase or read it from piped input
Volumes that unlock only with a TPM or security key need a passphrase added in Linux first. See what is and isn't supported.
How it was checked
- cryptsetup's own test images decrypt to exactly the checksums its test suite expects
- Volumes made by cryptsetup in five configurations are read and changed by NixMount, then decrypted by Linux and checked with
e2fsckandbtrfs check - On Windows, an encrypted volume is unlocked, written through the real driver, and confirmed to contain no plaintext
Install or upgrade
Download NixMount-Setup.exe and run it. Running it over an earlier version upgrades in place and keeps your settings. The driver is included, so there is nothing else to download.
Windows may warn about an unrecognized app, because the file isn't code-signed. Select More info, then Run anyway. You can check the download against NixMount-Setup.exe.sha256.
Requires 64-bit Windows 10 or 11.
Before you write to a volume
This is early filesystem software, so keep backups of anything you write to, and try it on an image or a spare disk first. Never write to a volume from a hibernated Linux. See the user guide.
WinFsp - Windows File System Proxy, Copyright (C) Bill Zissimopoulos, https://github.com/winfsp/winfsp