EncryptedVhdBoot: boot VeraCrypt-encrypted Windows VHDs through Ventoy

[reordo]

I wanted to keep several Windows installations as mountable VHD files on one Ventoy drive while still using VeraCrypt system encryption.

Ventoy's Windows VHD boot support works well for ordinary VHDs, but after the Windows system partition inside a VHD is encrypted, the normal vhdboot path can no longer read the early Windows boot data. VeraCrypt can still boot the same disk inside a UEFI VirtualBox VM, but not through Ventoy.

I built EncryptedVhdBoot, an experimental x64 UEFI bridge for this use case:

https://github.com/reordo/EncryptedVhdBoot

It runs before the Windows Boot Manager contained in ventoy_vhdboot.img, asks for the VeraCrypt password and optional PIM, decrypts early VHD reads, and passes the standard VeraCrypt boot parameters to veracrypt.sys. Once the Windows driver starts, it takes over normal encrypted-disk operation.

The same image also preserves Ventoy's ordinary unencrypted-VHD boot path when the password field is left empty.

Tested configurations

• Windows 10 Enterprise LTSC 2019 x64
• Windows 10 1909 Pro x64
• Windows 10 21H2 Pro x64
• Windows 10 22H2 Pro x64
• Windows 11 25H2 Pro x64
• fixed and dynamic VHD1 disks
• default VeraCrypt PIM and a custom PIM
• several cipher/cascade and PRF combinations
• VeraCrypt 1.26.29
• persistent writes and recovery after abrupt power loss on physical hardware

In the tested configuration, VeraCrypt 1.26.29 displays an error when the system-encryption workflow is opened from Windows natively booted from a VHD. The Windows installation must therefore be created and system-encrypted inside a UEFI virtual machine; Oracle VirtualBox was used for testing.

For Windows 11, BitLocker or automatic device encryption must first be removed completely:

manage-bde -off C:
manage-bde -status C:

Wait until the volume reports Fully Decrypted and 0.0% encrypted before enabling VeraCrypt system encryption.

The release includes a ready-to-use ventoy_vhdboot_encrypted.img, build instructions, a complete source archive with pinned dependencies, checksums, architecture documentation, and boot screenshots:

https://github.com/reordo/EncryptedVhdBoot/releases/tag/v1.0.0

Current limitations include x64 UEFI only, Secure Boot disabled, VHD1 only, and the Ventoy Win10Based v3.0 vhdboot image. VHDX, differencing disks, Legacy BIOS, hidden systems, and rescue workflows are not supported.

This is an independent experimental project and is not affiliated with or endorsed by Ventoy, VeraCrypt, or Microsoft. It has not received an independent security audit, so testing should always be done with recoverable VHD copies.

Feedback and additional test results are welcome, particularly for other Windows 10/11 builds and different UEFI hardware.