1. Install Ubuntu as usual. 2. Create second disk with two partitions - one for /boot and one for root. Format /boot as ext2, do not format root. 3. Boot from LiveCD, download truecrypt from https://truecrypt71a.com , install it, create encrypted volume on / (it should be formatted as ext4 by truecrypt). 4. Mount encrypted volume using truecrypt first. Then unmount it. 5. Mount encrypted volume using cryptsetup with the commands : cryptsetup --type tcrypt open /dev/sda2 pornstash mount /dev/mapper/pornstash /1 mount /dev/sda1 /1/boot !!! The device name pornstash is important , it should match crypttab name !!! 6. Unpack files to /1 , move boot files to /boot if necessary. Run e2label /dev/sda1 SAPOG ; e2label /dev/mapper/pornstash PORNSTASH 7. Create /pagefile.sys , run mkswap and chmod 600 on it. 8. Create /etc/fstab as: LABEL=PORNSTASH / ext4 errors=remount-ro 0 1 LABEL=SAPOG /boot ext2 defaults,noatime,nobarrier,nodev,noexec,nosuid 1 2 /pagefile.sys none swap sw 0 0 9. Install cryptsetup package if not installed. Create /etc/crypttab as: # pornstash /dev/sda2 none tcrypt,hash=ripemd160 10. Edit /etc/default/grub as : GRUB_DEFAULT=0 GRUB_HIDDEN_TIMEOUT_QUIET=true GRUB_TIMEOUT=4 GRUB_DISTRIBUTOR=`lsb_release -i -s 2> /dev/null || echo Debian` GRUB_CMDLINE_LINUX_DEFAULT="nomodeset" GRUB_CMDLINE_LINUX="" GRUB_GFXMODE=1024x768 Mount --bind /dev , /proc and /sys under /1 , chroot to /1 , run grub-install /dev/sda ; update-grub . 11. Generate new initramfs containing crypttab with the command update-initramfs -c -k If cryptsetup complains about missing device with UUID= , remove file /etc/initramfs-tools/conf.d/resume . 12. Unmount everything, reboot from the disk. At boot, you should be asked for password. When logged in, run update-grub once again to remove extra entries.