From d1c02063939a8a9ab65f511feb9ed674d46f1364 Mon Sep 17 00:00:00 2001 From: n0mad1k Date: Tue, 21 Oct 2025 11:20:08 -0400 Subject: [PATCH] Made it more portable and user friendly --- .gitignore | 1 + covert_sd_card_tool.py | 397 +++++++++++++++-------- tools/MOBILE_INSTRUCTIONS.txt | 239 ++++++++++++++ tools/README.txt | 194 +++++++++++ tools/WINDOWS_INSTRUCTIONS.txt | 93 ++++++ tools/lock_storage.sh | 88 +++++ tools/mount_storage.sh | 137 ++++++++ tools/veracrypt/DOWNLOAD_INSTRUCTIONS.md | 93 ++++++ 8 files changed, 1109 insertions(+), 133 deletions(-) mode change 100755 => 100644 covert_sd_card_tool.py create mode 100644 tools/MOBILE_INSTRUCTIONS.txt create mode 100644 tools/README.txt create mode 100644 tools/WINDOWS_INSTRUCTIONS.txt create mode 100755 tools/lock_storage.sh create mode 100755 tools/mount_storage.sh create mode 100644 tools/veracrypt/DOWNLOAD_INSTRUCTIONS.md diff --git a/.gitignore b/.gitignore index 7690660..4ff0325 100644 --- a/.gitignore +++ b/.gitignore @@ -3,6 +3,7 @@ __pycache__/ *.py[cod] *$py.class *.so +*.backup .claude # Log files - may contain sensitive paths/device info diff --git a/covert_sd_card_tool.py b/covert_sd_card_tool.py old mode 100755 new mode 100644 index d852a9d..69ae1f5 --- a/covert_sd_card_tool.py +++ b/covert_sd_card_tool.py @@ -8,6 +8,8 @@ import shutil from datetime import datetime import time import json +import urllib.request +import tempfile # Global variables DEBUG = False @@ -82,6 +84,145 @@ def run_command(command, shell=False, interactive=False, ignore_enospc=False): log(f"Command failed: {e}\nOutput: {e.stdout}\nError: {e.stderr}") sys.exit(1) +def download_file(url, destination, description="file"): + """ + Downloads a file with progress indication. + + Args: + url (str): URL to download from + destination (str): Local path to save file + description (str): Description for user feedback + """ + try: + log(f"Downloading {description}...") + log(f" From: {url}") + log(f" To: {destination}") + + def progress_hook(block_num, block_size, total_size): + if total_size > 0: + downloaded = block_num * block_size + percent = min(100, (downloaded * 100) // total_size) + mb_downloaded = downloaded / (1024 * 1024) + mb_total = total_size / (1024 * 1024) + # Use \r to overwrite the same line + print(f"\r Progress: {percent}% ({mb_downloaded:.1f} MB / {mb_total:.1f} MB)", end='', flush=True) + + urllib.request.urlretrieve(url, destination, reporthook=progress_hook) + print() # New line after progress + log(f"✓ {description} downloaded successfully") + return True + except Exception as e: + log(f"✗ Failed to download {description}: {e}") + return False + +def download_portable_veracrypt(): + """ + Downloads portable VeraCrypt binaries for Windows, Linux, and macOS. + Returns the path to a temporary directory containing the downloads. + """ + log("\n" + "="*70) + log("DOWNLOADING PORTABLE VERACRYPT") + log("="*70) + log("\nTo make this device work on ANY computer without software installation,") + log("we need to download portable VeraCrypt for Windows, Linux, and macOS.") + log("") + log("Total download size: ~86-90 MB") + log(" • Windows Portable: ~39 MB") + log(" • Linux AppImage: ~13 MB") + log(" • Linux .deb Installer: ~13 MB") + log(" • macOS DMG: ~22 MB") + log("") + log("This is a one-time download that will be stored on your device.") + log("") + + # Create temp directory for downloads + temp_dir = tempfile.mkdtemp(prefix="veracrypt_download_") + log(f"Using temporary directory: {temp_dir}") + log("") + + # Get latest VeraCrypt version from GitHub + log("Fetching latest VeraCrypt version from GitHub...") + try: + import urllib.request + import json + with urllib.request.urlopen("https://api.github.com/repos/veracrypt/VeraCrypt/releases/latest") as response: + release_data = json.loads(response.read().decode()) + VC_TAG = release_data["tag_name"] # e.g., "VeraCrypt_1.26.24" + VC_VERSION = VC_TAG.replace("VeraCrypt_", "") # e.g., "1.26.24" + log(f"✓ Latest version: {VC_VERSION}") + except Exception as e: + log(f"⚠ Warning: Could not fetch latest version ({e})") + log(" Falling back to version 1.26.24") + VC_TAG = "VeraCrypt_1.26.24" + VC_VERSION = "1.26.24" + + log("") + + downloads = { + "Windows Portable": { + "url": f"https://github.com/veracrypt/VeraCrypt/releases/download/{VC_TAG}/VeraCrypt.Portable.{VC_VERSION}.exe", + "filename": "VeraCrypt-Portable-Windows.exe", + "required": True + }, + "Linux Portable AppImage": { + "url": f"https://github.com/veracrypt/VeraCrypt/releases/download/{VC_TAG}/VeraCrypt-{VC_VERSION}-x86_64.AppImage", + "filename": "VeraCrypt-Portable-Linux.AppImage", + "required": True + }, + "Linux DEB Installer": { + "url": f"https://github.com/veracrypt/VeraCrypt/releases/download/{VC_TAG}/veracrypt-{VC_VERSION}-Ubuntu-22.04-amd64.deb", + "filename": "veracrypt-Ubuntu-22.04-amd64.deb", + "required": False + }, + "macOS": { + "url": f"https://github.com/veracrypt/VeraCrypt/releases/download/{VC_TAG}/VeraCrypt_{VC_VERSION}.dmg", + "filename": "VeraCrypt-MacOS.dmg", + "required": False + } + } + + success_count = 0 + required_count = 0 + + for platform, info in downloads.items(): + log(f"\n[{platform}]") + dest_path = os.path.join(temp_dir, info["filename"]) + + if info.get("required"): + required_count += 1 + + if download_file(info["url"], dest_path, f"{platform} VeraCrypt"): + success_count += 1 + + # Make Linux AppImage executable + if "AppImage" in info["filename"]: + try: + os.chmod(dest_path, 0o755) + log(f" ✓ Made executable") + except Exception as e: + log(f" ⚠ Warning: Could not make executable: {e}") + else: + if info.get("required"): + log(f" ✗ ERROR: {platform} is required but download failed!") + + log("\n" + "="*70) + if success_count >= required_count: + log("✓ PORTABLE VERACRYPT DOWNLOAD COMPLETE") + log("="*70) + log(f"\nDownloaded {success_count} of {len(downloads)} platform(s)") + log(f"Files saved to: {temp_dir}") + return temp_dir + else: + log("✗ DOWNLOAD FAILED") + log("="*70) + log(f"\nOnly {success_count} of {required_count} required downloads succeeded.") + log("Cannot proceed without portable VeraCrypt binaries.") + log("\nTroubleshooting:") + log(" • Check your internet connection") + log(" • Verify firewall settings") + log(" • Try again later (download servers may be busy)") + sys.exit(1) + def check_dependencies(): """Checks and installs missing dependencies.""" dependencies = [ @@ -178,6 +319,12 @@ def setup_usb(): Sets up the bootable USB (Tails or Kali) and creates additional partitions if required. """ global DRIVE + + # Download portable VeraCrypt first (so it's ready to copy later) + veracrypt_dir = None + if CREATE_DOCS: + veracrypt_dir = download_portable_veracrypt() + log("\n" + "="*70) log("STEP 1: DRIVE SELECTION") log("="*70) @@ -412,7 +559,7 @@ def fix_partition_table_docs_only(): time.sleep(5) # Increased sleep to ensure partitions are recognized log("✓ Partition table refreshed") - setup_unencrypted_partition() + setup_unencrypted_partition(veracrypt_dir) setup_docs_partition() def fix_partition_table_tails(): @@ -504,7 +651,7 @@ def fix_partition_table_tails(): time.sleep(5) setup_docs_partition() - setup_unencrypted_partition() + setup_unencrypted_partition(veracrypt_dir) log("Tails + encrypted documents partition setup complete!") @@ -604,7 +751,7 @@ def fix_partition_table(): setup_kali_partition() if CREATE_DOCS: setup_docs_partition() - setup_unencrypted_partition() + setup_unencrypted_partition(veracrypt_dir) def setup_kali_partition(): """ @@ -702,22 +849,28 @@ def setup_docs_partition(): log("ENCRYPTED VOLUME SETUP") log("="*70) log("\nYou will now create an encrypted volume for sensitive documents.") - log("\nWhat you'll be asked:") - log(" 1. PASSWORD: Enter a strong passphrase (you'll type it twice)") - log(" - Use at least 20 characters") - log(" - Mix uppercase, lowercase, numbers, and symbols") - log(" - Avoid dictionary words or personal information") - log(" 2. PIM (Personal Iterations Multiplier):") + log("") + log("SECURITY SETTINGS:") + log(" • Encryption: AES-Twofish-Serpent (triple cascade)") + log(" • Hash: SHA-512") if PARANOID_MODE: - log(" - PARANOID MODE: PIM set to 5000 (maximum security)") - log(" - Unlock time: ~5-7 seconds") + log(" • PIM: 5000 (PARANOID mode - maximum security)") + log(" • Unlock time: ~5-7 seconds") else: - log(" - STANDARD: PIM set to 2000 (high security)") - log(" - Unlock time: ~2-3 seconds") - log(" 3. KEYFILES: Leave blank unless you know what you're doing") - log("\nIMPORTANT: Remember your password! There is NO password recovery!") + log(" • PIM: 2000 (standard high security)") + log(" • Unlock time: ~2-3 seconds") + log("") + log("PASSWORD REQUIREMENTS:") + log(" • Minimum 20 characters (longer is better)") + log(" • Mix uppercase, lowercase, numbers, and symbols") + log(" • Avoid dictionary words or personal information") + log(" • Example: My$ecur3Tr@v3lD0cs!2025#Paris") + log("") + log("⚠ CRITICAL: There is NO password recovery!") + log(" If you forget your password, your data is GONE FOREVER.") + log("") log("="*70) - input("\nPress ENTER to continue with encryption setup...") + input("Press ENTER when you're ready to create your password...") log("\nConfiguring VeraCrypt encryption for documents partition...") @@ -734,11 +887,32 @@ def setup_docs_partition(): ) log("\nStarting VeraCrypt encryption (this may take a few minutes)...") - log("You will be prompted for:") - log(" 1. Password (enter twice)") - log(" 2. PIM (press Enter to use default)") - log(" 3. Keyfiles (press Enter to skip)") - log(" 4. Filesystem (will use ext4 automatically)") + log("="*70) + log("VERACRYPT WILL ASK YOU THESE QUESTIONS:") + log("="*70) + log("") + log("1. 'Enter password:' → Type your strong password (20+ characters)") + log(" Then press ENTER") + log("") + log("2. 'Re-enter password:' → Type the SAME password again") + log(" Then press ENTER") + log("") + log("3. 'Enter PIM:' → Just press ENTER") + log(f" (We're using PIM {pim_value} automatically)") + log("") + log("4. 'Enter keyfile path [none]:' → Just press ENTER") + log(" (Keyfiles not needed for most users)") + log("") + log("5. 'Please type at least 320 randomly chosen characters'") + log(" → Smash random keys on your keyboard until it says 'Done'") + log(" This creates entropy for encryption") + log("") + log("6. 'Protect hidden volume (if any)? (y=Yes/n=No) [No]:' → Type: n") + log(" Then press ENTER (we're not using hidden volumes)") + log("") + log("="*70) + log("Creating volume now...") + log("="*70) log("") run_command(veracrypt_create_cmd, shell=True, interactive=True) log("\n✓ Documents partition encrypted successfully!") @@ -747,9 +921,12 @@ def setup_docs_partition(): log(f" PIM: {pim_value}") log(f" Filesystem: ext4") -def setup_unencrypted_partition(): +def setup_unencrypted_partition(veracrypt_dir=None): """ Sets up the unencrypted partition for scripts and instructions. + + Args: + veracrypt_dir (str): Path to directory containing portable VeraCrypt files """ global DRIVE UNENCRYPTED_PART = get_partition_name(DRIVE, get_last_partition_number()) @@ -772,127 +949,81 @@ def setup_unencrypted_partition(): run_command(f"sudo mount {UNENCRYPTED_PART} /mnt/unencrypted", shell=True) log("✓ Tools partition mounted") - instructions = f""" -INSTRUCTIONS FOR ACCESSING SECURE STORAGE + # Get the directory where this script is located + script_dir = os.path.dirname(os.path.abspath(__file__)) + tools_dir = os.path.join(script_dir, "tools") -To access your secure partition: - 1. Run: sudo ./mount_storage.sh - 2. Enter your password when prompted - 3. Your files will be available at /mnt/secure_storage + log("\nCopying helper files from tools/ directory...") -To safely lock your storage: - 1. Close all files and applications using the storage - 2. Run: sudo ./lock_storage.sh - 3. Your data is now secured + # Copy README.txt + readme_path = os.path.join(tools_dir, "README.txt") + if os.path.exists(readme_path): + run_command(f"sudo cp '{readme_path}' /mnt/unencrypted/README.txt", shell=True) + log(" ✓ README.txt copied") + else: + log(f" ⚠ Warning: {readme_path} not found, skipping README") -IMPORTANT: Always lock your storage before removing the device. -""" + # Copy WINDOWS_INSTRUCTIONS.txt + windows_inst_path = os.path.join(tools_dir, "WINDOWS_INSTRUCTIONS.txt") + if os.path.exists(windows_inst_path): + run_command(f"sudo cp '{windows_inst_path}' /mnt/unencrypted/WINDOWS_INSTRUCTIONS.txt", shell=True) + log(" ✓ WINDOWS_INSTRUCTIONS.txt copied") + else: + log(f" ⚠ Warning: {windows_inst_path} not found") - log("\nCreating helper files...") - with open("/tmp/README.txt", "w") as readme_file: - readme_file.write(instructions) - run_command("sudo cp /tmp/README.txt /mnt/unencrypted/README.txt", shell=True) - run_command("sudo rm /tmp/README.txt", shell=True) - log(" ✓ README.txt created") + # Copy MOBILE_INSTRUCTIONS.txt + mobile_inst_path = os.path.join(tools_dir, "MOBILE_INSTRUCTIONS.txt") + if os.path.exists(mobile_inst_path): + run_command(f"sudo cp '{mobile_inst_path}' /mnt/unencrypted/MOBILE_INSTRUCTIONS.txt", shell=True) + log(" ✓ MOBILE_INSTRUCTIONS.txt copied") + else: + log(f" ⚠ Warning: {mobile_inst_path} not found") - mount_script = """#!/bin/bash -# Script to mount secure storage partition + # Copy mount_storage.sh + mount_script_path = os.path.join(tools_dir, "mount_storage.sh") + if os.path.exists(mount_script_path): + run_command(f"sudo cp '{mount_script_path}' /mnt/unencrypted/mount_storage.sh", shell=True) + run_command("sudo chmod +x /mnt/unencrypted/mount_storage.sh", shell=True) + log(" ✓ mount_storage.sh copied") + else: + log(f" ⚠ Warning: {mount_script_path} not found, skipping mount script") -echo "=== Secure Storage Mount ===" -echo "" -echo "Available storage devices:" -lsblk -o NAME,SIZE,TYPE,LABEL | grep -E 'disk|part' -echo "" -read -p "Enter the partition path (e.g., /dev/sdb3): " DRIVE_PATH + # Copy lock_storage.sh + lock_script_path = os.path.join(tools_dir, "lock_storage.sh") + if os.path.exists(lock_script_path): + run_command(f"sudo cp '{lock_script_path}' /mnt/unencrypted/lock_storage.sh", shell=True) + run_command("sudo chmod +x /mnt/unencrypted/lock_storage.sh", shell=True) + log(" ✓ lock_storage.sh copied") + else: + log(f" ⚠ Warning: {lock_script_path} not found, skipping lock script") -if [ -z "$DRIVE_PATH" ]; then - echo "Error: No partition specified." - exit 1 -fi + # Copy portable VeraCrypt files + if veracrypt_dir and os.path.exists(veracrypt_dir): + log("\nCopying portable VeraCrypt binaries...") + run_command("sudo mkdir -p /mnt/unencrypted/VeraCrypt", shell=True) -if [ ! -b "$DRIVE_PATH" ]; then - echo "Error: $DRIVE_PATH is not a valid block device." - exit 1 -fi + veracrypt_files = [ + ("VeraCrypt-Portable-Windows.exe", "Windows portable"), + ("VeraCrypt-Portable-Linux.AppImage", "Linux portable AppImage"), + ("veracrypt-Ubuntu-22.04-amd64.deb", "Linux DEB installer"), + ("VeraCrypt-MacOS.dmg", "macOS installer") + ] -echo "" -echo "Mounting secure storage from $DRIVE_PATH..." -sudo mkdir -p /mnt/secure_storage + for filename, description in veracrypt_files: + src = os.path.join(veracrypt_dir, filename) + if os.path.exists(src): + run_command(f"sudo cp '{src}' /mnt/unencrypted/VeraCrypt/{filename}", shell=True) + if "Linux" in filename: + run_command(f"sudo chmod +x /mnt/unencrypted/VeraCrypt/{filename}", shell=True) + log(f" ✓ {description} copied") + else: + log(f" ⚠ {description} not found (optional)") -# Mount the encrypted volume -if sudo veracrypt --text --mount "$DRIVE_PATH" /mnt/secure_storage; then - echo "" - echo "SUCCESS: Secure storage is now accessible at /mnt/secure_storage" - echo "" - echo "Remember to run ./lock_storage.sh when finished!" -else - echo "" - echo "ERROR: Failed to mount storage. Check your password and try again." - sudo rmdir /mnt/secure_storage 2>/dev/null - exit 1 -fi -""" - - with open("/tmp/mount_storage.sh", "w") as script_file: - script_file.write(mount_script) - run_command("sudo cp /tmp/mount_storage.sh /mnt/unencrypted/mount_storage.sh", shell=True) - run_command("sudo chmod +x /mnt/unencrypted/mount_storage.sh", shell=True) - run_command("sudo rm /tmp/mount_storage.sh", shell=True) - log(" ✓ mount_storage.sh created") - - cleanup_script = """#!/bin/bash -# Script to safely lock secure storage - -echo "=== Secure Storage Lock ===" -echo "" - -# Check if storage is mounted -if mountpoint -q /mnt/secure_storage; then - echo "Checking for open files..." - - # Check if any processes are using the mount - if sudo lsof /mnt/secure_storage 2>/dev/null | grep -q /mnt/secure_storage; then - echo "" - echo "WARNING: Files are still open in the secure storage!" - echo "Open files/processes:" - sudo lsof /mnt/secure_storage 2>/dev/null - echo "" - read -p "Force close and lock anyway? (y/N): " FORCE - if [ "$FORCE" != "y" ] && [ "$FORCE" != "Y" ]; then - echo "Lock cancelled. Please close all files and try again." - exit 1 - fi - fi - - echo "" - echo "Locking secure storage..." - - # Sync any pending writes - sync - - # Dismount the encrypted volume - if sudo veracrypt --text --dismount /mnt/secure_storage; then - sudo rmdir /mnt/secure_storage 2>/dev/null - echo "" - echo "SUCCESS: Secure storage is now locked." - echo "Your data is safe." - else - echo "" - echo "ERROR: Failed to lock storage. Try closing all applications and run again." - exit 1 - fi -else - echo "Secure storage is not currently mounted." - echo "Nothing to lock." -fi -""" - - with open("/tmp/lock_storage.sh", "w") as script_file: - script_file.write(cleanup_script) - run_command("sudo cp /tmp/lock_storage.sh /mnt/unencrypted/lock_storage.sh", shell=True) - run_command("sudo chmod +x /mnt/unencrypted/lock_storage.sh", shell=True) - run_command("sudo rm /tmp/lock_storage.sh", shell=True) - log(" ✓ lock_storage.sh created") + log(" ✓ Portable VeraCrypt binaries installed") + log("\n 📌 IMPORTANT: These binaries allow accessing encrypted files") + log(" on ANY Windows, Linux, or Mac computer WITHOUT installing software!") + else: + log("\n ⚠ No portable VeraCrypt binaries provided - skipping") log("\nUnmounting tools partition...") run_command("sudo umount /mnt/unencrypted", shell=True) diff --git a/tools/MOBILE_INSTRUCTIONS.txt b/tools/MOBILE_INSTRUCTIONS.txt new file mode 100644 index 0000000..485f8b6 --- /dev/null +++ b/tools/MOBILE_INSTRUCTIONS.txt @@ -0,0 +1,239 @@ +====================================================================== + SECURE STORAGE - MOBILE DEVICE INSTRUCTIONS +====================================================================== + +IMPORTANT: Mobile access has limitations compared to desktop. +Read carefully to understand what's possible on your device. + +====================================================================== +ANDROID DEVICES +====================================================================== + +REQUIREMENTS: + • Android 5.0 or newer + • EDS (Encrypted Data Store) app - REQUIRED + • USB OTG adapter (to connect USB device to phone) + • File manager app (most phones have one built-in) + +REQUIRED APP: + • EDS Lite (Free & Open Source) + • Google Play: https://play.google.com/store/apps/details?id=com.sovworks.eds.android + • Direct link if Google Play doesn't work: + https://play.google.com/store/apps/details?id=com.sovworks.projecteds + +---------------------------------------------------------------------- +SETUP: Using EDS Lite (RECOMMENDED) +---------------------------------------------------------------------- + +Step 1: Install EDS Lite + • Open Google Play Store + • Search for "EDS Lite" or "EDS (Encrypted Data Store)" + • Install the app (it's FREE) + • Or use the direct link above + +Step 2: Connect your USB device + • Connect USB device using OTG adapter + • Android should show "USB device connected" notification + +Step 3: Open EDS Lite app + • Tap "Open container" + • Navigate to your USB device + • Look for the partition WITHOUT a filesystem/label + • Select the encrypted partition + +Step 4: Enter password + • Select encryption: VeraCrypt + • Enter your password + • For PIM: enter 2000 or 5000 (whatever you set) + • Tap "OK" + +Step 5: Access your files + • Files will appear in EDS Lite + • You can view, copy, or share files + • Some apps can open files directly from EDS + +IMPORTANT - Safely Close: + • Tap "Close container" when done + • Wait for confirmation before unplugging + • Only then remove USB device + +---------------------------------------------------------------------- +ALTERNATIVE: VeraCrypt for Android (Advanced Users) +---------------------------------------------------------------------- + +ℹ️ NOTE: EDS Lite (above) is easier to use and recommended. + Only use VeraCrypt if you're familiar with it. + +Step 1: Install VeraCrypt for Android + • Download from: https://github.com/veracrypt/veracrypt + • Or install from F-Droid store + • Enable "Unknown sources" if needed + +Step 2-5: Follow similar steps as EDS Lite above + • The interface is similar to desktop VeraCrypt + • Process is the same: select partition, enter password, mount + +====================================================================== +iOS DEVICES (iPhone/iPad) +====================================================================== + +✅ SOLUTION: Crypto Disks App (Paid) + +RECOMMENDED APP: + • Crypto Disks - Store Private Files Securely + • App Store: https://apps.apple.com/us/app/crypto-disks-store-private/id889549308 + • Price: ~$4.99 (one-time purchase) + • Supports VeraCrypt containers! + +---------------------------------------------------------------------- +SETUP: Using Crypto Disks on iOS +---------------------------------------------------------------------- + +Step 1: Purchase and Install Crypto Disks + • Open App Store on your iPhone/iPad + • Search for "Crypto Disks" + • Or use the direct link above + • Purchase and install (~$4.99) + +Step 2: Transfer Encrypted Container + ⚠️ LIMITATION: iOS doesn't support direct USB access like Android + + You have two options: + + OPTION A: Copy via Computer (Easier) + 1. Connect USB device to your Mac/PC + 2. Mount the encrypted partition with VeraCrypt + 3. Create a smaller VeraCrypt container file inside + 4. Transfer that container to your iPhone via: + - AirDrop (Mac to iPhone) + - iCloud Drive + - iTunes File Sharing + 5. Open in Crypto Disks app + + OPTION B: Use Wi-Fi File Transfer + 1. Use Crypto Disks' built-in file transfer + 2. Transfer container file from computer + 3. Open in app + +Step 3: Mount in Crypto Disks App + • Open Crypto Disks app + • Select "Add Disk Image" + • Choose your transferred container + • Enter password and PIM + • Access your files + +⚠️ IMPORTANT iOS LIMITATIONS: + • Cannot directly mount USB partition (Apple restriction) + • Must use container FILES, not raw partitions + • Requires copying/transferring container to iPhone + • Best for occasional access, not primary use + +---------------------------------------------------------------------- +iOS WORKAROUND: Emergency Access Only +---------------------------------------------------------------------- + +If you don't want to pay for Crypto Disks, here are free alternatives: + +Option A: Use a Computer as Bridge + 1. Mount the encrypted storage on your Mac/PC + 2. Copy files you need to iCloud or Files app + 3. Access those files from your iPhone + 4. Delete copies when done (IMPORTANT for security!) + +Option B: Use Remote Access + 1. Mount encrypted storage on your home computer + 2. Set up secure remote access (VPN + file sharing) + 3. Access files remotely from iPhone + 4. More complex but maintains security + +Option C: Take Photos of Documents + 1. If you just need to VIEW travel docs in emergency + 2. Take photos/screenshots on computer + 3. Store in encrypted note app (Apple Notes with lock) + 4. Delete after trip + +NOTE: These workarounds compromise security slightly. + Crypto Disks app is the most secure iOS solution. + +====================================================================== +IMPORTANT SECURITY NOTES FOR MOBILE +====================================================================== + +⚠ Screen Lock + • Always have a PIN/password on your phone + • If someone steals your phone while storage is mounted, + they can access your files + +⚠ App Permissions + • Only grant necessary permissions to encryption apps + • Be cautious with "file access" permissions + +⚠ Public WiFi + • Don't use public WiFi when accessing sensitive files + • Or use a VPN if you must + +⚠ Battery Concerns + • Don't let your phone die while storage is mounted + • Always properly close/dismount before battery runs out + +⚠ Background Apps + • Close the encryption app properly when done + • Don't just switch to another app + • Storage might stay mounted in background + +⚠ Phone Updates + • Close encrypted storage before major OS updates + • Updates might interrupt and cause corruption + +====================================================================== +TROUBLESHOOTING - ANDROID +====================================================================== + +"Cannot find USB device" + • Try a different OTG adapter + • Check if your phone supports USB OTG + • Some phones need USB settings changed (File Transfer mode) + +"Wrong password" (but password is correct) + • Make sure you selected "VeraCrypt" as encryption type + • Verify PIM value (2000 or 5000) + • Some apps don't support all VeraCrypt settings + +"App crashes when mounting" + • Try a different encryption app (EDS vs VeraCrypt) + • Check if partition is already mounted + • Restart phone and try again + +"Can't edit files, only view" + • This is normal for some apps + • Copy file to phone storage + • Edit it there + • Copy back when done + +"Storage disconnected unexpectedly" + • Check USB connection + • Some phones cut power to USB to save battery + • Disable battery optimization for the encryption app + +====================================================================== +LIMITATIONS OF MOBILE ACCESS +====================================================================== + +Things that DON'T work well on mobile: + ✗ Editing large files directly on encrypted storage + ✗ Running programs/apps from encrypted storage + ✗ Fast file operations (mobile is slower than desktop) + ✗ iOS access (not supported at all) + +Things that WORK WELL on mobile: + ✓ Viewing documents (PDFs, photos, etc.) + ✓ Copying individual files to phone + ✓ Sharing files to other apps + ✓ Emergency access when no computer available + ✓ Quick lookup of information + +RECOMMENDATION: + Use mobile access for emergencies and viewing only. + Use desktop (Linux/Windows) for actual file management. + +====================================================================== diff --git a/tools/README.txt b/tools/README.txt new file mode 100644 index 0000000..3751c1a --- /dev/null +++ b/tools/README.txt @@ -0,0 +1,194 @@ +====================================================================== + SECURE STORAGE - QUICK START GUIDE +====================================================================== + +WHAT'S ON THIS DEVICE: + • Encrypted storage partition for sensitive documents + • Portable VeraCrypt (works on ANY computer - no installation!) + • Helper scripts (Linux/Mac) + • Instructions for Windows and mobile devices + +====================================================================== +ACCESSING YOUR FILES - QUICK GUIDE +====================================================================== + +LINUX / MAC: + 1. Open terminal in this folder + 2. Run: sudo ./mount_storage.sh + 3. Enter your password + 4. Files appear in: ~/SecureStorage + +WINDOWS: + 1. Open "WINDOWS_INSTRUCTIONS.txt" on this device + 2. Follow the step-by-step guide + 3. Use portable VeraCrypt from "VeraCrypt" folder (no install needed!) + +ANDROID: + 1. Install "EDS Lite" from Google Play Store (FREE) + https://play.google.com/store/apps/details?id=com.sovworks.projecteds + 2. Connect USB with OTG adapter + 3. Open "MOBILE_INSTRUCTIONS.txt" for step-by-step guide + +iOS (iPhone/iPad): + 1. Install "Crypto Disks" from App Store (~$4.99) + https://apps.apple.com/us/app/crypto-disks-store-private/id889549308 + 2. See "MOBILE_INSTRUCTIONS.txt" for setup + ⚠ iOS has limitations - requires copying files, can't mount USB directly + +====================================================================== +IMPORTANT: HOW TO SAFELY LOCK YOUR STORAGE +====================================================================== + +LINUX / MAC: + 1. Close ALL programs using the secure storage + 2. Run: sudo ./lock_storage.sh + 3. Wait for "SUCCESS" message + 4. Safe to remove device + +WINDOWS: + 1. Close all files + 2. In VeraCrypt, select the drive + 3. Click "Dismount" + 4. Use "Safely Remove Hardware" + +⚠ CRITICAL: ALWAYS lock/dismount before removing! + Otherwise you risk losing your data. + +====================================================================== +PORTABLE VERACRYPT - NO INSTALLATION REQUIRED! +====================================================================== + +Inside the "VeraCrypt" folder on this device: + +• VeraCrypt-Portable-Windows.exe + → Double-click to run on ANY Windows PC + → Works without admin rights on most systems + +• VeraCrypt-Portable-Linux.AppImage + → Run on ANY Linux system (no install!) + → Command: ./VeraCrypt-Portable-Linux.AppImage + → AppImage = portable, works on all Linux distributions + +• veracrypt-Ubuntu-22.04-amd64.deb + → System-wide installer for Ubuntu/Debian + → Install with: sudo dpkg -i veracrypt-Ubuntu-22.04-amd64.deb + → Use this if you prefer installed version over AppImage + +• VeraCrypt-MacOS.dmg + → Install on Mac (one-time) + → Works on any Mac after that + +This means you can access your encrypted files on ANY computer +even if VeraCrypt is not installed! + +====================================================================== +YOUR PASSWORD +====================================================================== + +⚠ There is NO password recovery! If you forget it, data is GONE. + +Password details: + • Case-sensitive (Abc123 ≠ abc123) + • Minimum 20 characters recommended + • Mix of letters, numbers, symbols + • Write it down and keep it SAFE (not on this device!) + +If you set a PIM value: + • Standard setup: PIM = 2000 + • Paranoid setup: PIM = 5000 + • VeraCrypt will ask for this when mounting + +====================================================================== +TROUBLESHOOTING +====================================================================== + +PROBLEM: "Cannot find TOOLS partition" +FIX: Ensure device is fully connected; try different USB port + +PROBLEM: "Wrong password" (but you know it's correct) +FIX: Check if CAPS LOCK is on; verify PIM value + +PROBLEM: "Volume already mounted" +FIX: Close any VeraCrypt windows and run: + • Linux/Mac: sudo veracrypt -d + • Windows: Dismount all in VeraCrypt + +PROBLEM: "Permission denied" when accessing files +FIX: + • Linux/Mac: Re-run mount script (it sets permissions) + • Windows: Check if you ran VeraCrypt as administrator + +PROBLEM: "Files appear but I can't edit them" +FIX: + • Linux/Mac: Run: sudo chown -R $USER ~/SecureStorage + • Windows: Right-click → Properties → Security → Edit + +PROBLEM: Device not detected on Android +FIX: + • Check USB OTG adapter is working + • Enable "File Transfer" mode in USB settings + • Try different OTG adapter + +====================================================================== +FILE LOCATIONS AFTER MOUNTING +====================================================================== + +Linux/Mac: ~/SecureStorage + (In your home folder) + +Windows: Z:\ (or whatever drive letter you selected) + Shows in "This PC" + +Android: Accessible within EDS Lite or VeraCrypt app + +====================================================================== +SECURITY NOTES +====================================================================== + +✓ Your files use military-grade encryption +✓ AES-Twofish-Serpent triple cascade (strongest available) +✓ Even supercomputers cannot crack this encryption + +⚠ The password is the ONLY key +⚠ No backdoors, no recovery, no "forgot password" option +⚠ Keep password safe but separate from this device + +Best practices: + • Always dismount before removing device + • Don't leave mounted when unattended + • Use strong unique password + • Don't store password on this device + • Lock your computer when storage is mounted + +====================================================================== +ADVANCED: MANUAL MOUNTING (if scripts fail) +====================================================================== + +LINUX/MAC: + 1. Find encrypted partition: + lsblk -o NAME,SIZE,LABEL,FSTYPE + (Look for partition WITHOUT filesystem label) + + 2. Mount with VeraCrypt: + sudo veracrypt /dev/sdX2 ~/SecureStorage + (Replace sdX2 with your partition) + + 3. Enter password and PIM when prompted + +WINDOWS: + 1. Open portable VeraCrypt + 2. Select any drive letter + 3. Click "Select Device" + 4. Choose partition WITHOUT label (not the TOOLS one) + 5. Click "Mount" + 6. Enter password + +====================================================================== +NEED MORE HELP? +====================================================================== + +• Windows users: See WINDOWS_INSTRUCTIONS.txt +• Mobile users: See MOBILE_INSTRUCTIONS.txt +• VeraCrypt documentation: https://www.veracrypt.fr/en/Documentation.html + +====================================================================== diff --git a/tools/WINDOWS_INSTRUCTIONS.txt b/tools/WINDOWS_INSTRUCTIONS.txt new file mode 100644 index 0000000..e0a9f9c --- /dev/null +++ b/tools/WINDOWS_INSTRUCTIONS.txt @@ -0,0 +1,93 @@ +====================================================================== + SECURE STORAGE - WINDOWS INSTRUCTIONS +====================================================================== + +REQUIREMENTS: + • This secure storage device connected + • NO SOFTWARE INSTALLATION NEEDED! + +====================================================================== +HOW TO ACCESS YOUR SECURE FILES (WINDOWS) +====================================================================== + +OPTION 1: USE PORTABLE VERACRYPT (RECOMMENDED - NO INSTALL!) + +Step 1: Open the VeraCrypt folder on this USB drive + +Step 2: Double-click "VeraCrypt-Portable-Windows.exe" + • It runs directly - no installation! + • Works on most Windows PCs without admin rights + • If blocked, right-click → "Run anyway" + +Step 3: The VeraCrypt window opens + +---------------------------------------------------------------------- + +OPTION 2: USE INSTALLED VERACRYPT (if you prefer) + +Step 1: Install VeraCrypt (if not already installed) + • Go to https://www.veracrypt.fr/en/Downloads.html + • Download VeraCrypt for Windows + • Run the installer + +Step 2: Open VeraCrypt from Start Menu + • Search for "VeraCrypt" in Start Menu + • Click "VeraCrypt" to launch + +---------------------------------------------------------------------- + +CONTINUING (after opening VeraCrypt either way): + +Step 3: Select a drive letter + • In VeraCrypt window, click any drive letter (e.g., Z:) + +Step 4: Select Volume + • Click "Select Device..." button + • Find your USB device (look for the partition WITHOUT a filesystem) + • Usually it's the second-to-last partition + • Click OK + +Step 5: Click "Mount" button + • Enter your password when prompted + • For PIM: leave blank or enter the PIM you set (2000 or 5000) + • Click OK + +Step 6: Access your files + • Open File Explorer + • Look for new drive (e.g., Z:) + • Your files are there! + +====================================================================== +HOW TO SAFELY LOCK YOUR STORAGE (WINDOWS) +====================================================================== + +Step 1: Close ALL programs using the secure storage + • Save documents + • Close File Explorer windows + • Close any apps with open files + +Step 2: In VeraCrypt window + • Select the mounted drive (e.g., Z:) + • Click "Dismount" button + +Step 3: Safe to remove + • Click "Safely Remove Hardware" in system tray + • Select your USB device + • Remove when Windows says it's safe + +====================================================================== +IMPORTANT NOTES +====================================================================== + +⚠ ALWAYS dismount before removing the device! + Otherwise you risk data corruption. + +⚠ If you forget your password, your data is GONE. + There is NO password recovery. + +⚠ Partition to select: + • Look in VeraCrypt's "Select Device" window + • Choose the partition WITHOUT a label/filesystem + • It's usually NOT the one labeled "TOOLS" + +====================================================================== diff --git a/tools/lock_storage.sh b/tools/lock_storage.sh new file mode 100755 index 0000000..d9ce73e --- /dev/null +++ b/tools/lock_storage.sh @@ -0,0 +1,88 @@ +#!/bin/bash +# Script to safely lock secure storage + +echo "======================================================================" +echo " SECURE STORAGE LOCK TOOL" +echo "======================================================================" +echo "" + +# Mount point location +MOUNT_POINT="$HOME/SecureStorage" + +# Check if storage is mounted +if mountpoint -q "$MOUNT_POINT" 2>/dev/null || [ -d "$MOUNT_POINT" ] && sudo veracrypt --text --list | grep -q "$MOUNT_POINT"; then + echo "Step 1: Checking for open files..." + + # Check if any processes are using the mount + OPEN_FILES=$(sudo lsof "$MOUNT_POINT" 2>/dev/null | tail -n +2) + if [ -n "$OPEN_FILES" ]; then + echo "" + echo "⚠ WARNING: Files or programs are still using the secure storage!" + echo "" + echo "Open files/processes:" + echo "$OPEN_FILES" + echo "" + echo "You should close these programs first to avoid data loss." + echo "" + read -p "Force close and lock anyway? (y/N): " FORCE + if [ "$FORCE" != "y" ] && [ "$FORCE" != "Y" ]; then + echo "" + echo "Lock cancelled. Please:" + echo " 1. Close all programs using the secure storage" + echo " 2. Save any open documents" + echo " 3. Run this script again" + exit 1 + fi + echo "" + echo "Forcing lock (files will be closed)..." + else + echo "✓ No open files detected" + fi + + echo "" + echo "Step 2: Syncing pending writes to disk..." + sync + echo "✓ All data written to disk" + + echo "" + echo "Step 3: Dismounting encrypted volume..." + + # Dismount the encrypted volume + if sudo veracrypt --text --dismount "$MOUNT_POINT" 2>/dev/null; then + rmdir "$MOUNT_POINT" 2>/dev/null + echo "✓ Volume dismounted" + echo "" + echo "======================================================================" + echo " SUCCESS!" + echo "======================================================================" + echo "" + echo "Secure storage is now locked and encrypted." + echo "Your data is safe to remove the device." + echo "" + echo "======================================================================" + else + echo "" + echo "======================================================================" + echo " DISMOUNT FAILED" + echo "======================================================================" + echo "" + echo "Possible reasons:" + echo " • Files still in use (close all programs)" + echo " • Permission denied" + echo " • Volume not mounted with this script" + echo "" + echo "Troubleshooting:" + echo " 1. Check what's using it: sudo lsof $MOUNT_POINT" + echo " 2. Force dismount all: sudo veracrypt -d" + echo " 3. Kill processes: sudo fuser -km $MOUNT_POINT" + echo "" + exit 1 + fi +else + echo "ℹ Secure storage is not currently mounted." + echo "" + echo "Nothing to lock - your data is already secured." + echo "" + echo "If you want to access it, run:" + echo " sudo ./mount_storage.sh" +fi diff --git a/tools/mount_storage.sh b/tools/mount_storage.sh new file mode 100755 index 0000000..cb225b3 --- /dev/null +++ b/tools/mount_storage.sh @@ -0,0 +1,137 @@ +#!/bin/bash +# Script to mount secure storage partition + +echo "======================================================================" +echo " SECURE STORAGE MOUNT TOOL" +echo "======================================================================" +echo "" + +# Function to find the documents partition (second-to-last partition on drive) +find_docs_partition() { + # Look for drives with TOOLS partition (our indicator) + local tools_drive=$(lsblk -ln -o NAME,LABEL | grep "TOOLS" | awk '{print $1}' | head -1) + + if [ -z "$tools_drive" ]; then + echo "ERROR: Could not find TOOLS partition." + echo "Please ensure the secure storage device is connected." + return 1 + fi + + # Get the base drive name (remove partition number) + local base_drive=$(echo "$tools_drive" | sed 's/[0-9]*$//' | sed 's/p$//') + + # Get all partitions on this drive + local partitions=$(lsblk -ln -o NAME "/dev/$base_drive" | grep "^$base_drive" | tail -n +2) + local part_count=$(echo "$partitions" | wc -l) + + if [ "$part_count" -lt 2 ]; then + echo "ERROR: Not enough partitions found." + return 1 + fi + + # Get second-to-last partition (documents partition) + local docs_part=$(echo "$partitions" | tail -n 2 | head -n 1) + echo "/dev/$docs_part" + return 0 +} + +echo "Step 1: Detecting secure storage device..." +DOCS_PARTITION=$(find_docs_partition) + +if [ $? -ne 0 ]; then + echo "" + echo "======================================================================" + echo "AUTO-DETECTION FAILED - MANUAL MODE" + echo "======================================================================" + echo "" + echo "Available partitions:" + lsblk -o NAME,SIZE,TYPE,LABEL,FSTYPE | grep -v "loop" + echo "" + echo "TIP: Look for a partition WITHOUT a filesystem (blank FSTYPE)" + echo " This is usually your encrypted documents partition." + echo "" + read -p "Enter the partition path (e.g., /dev/sdb1): " DOCS_PARTITION + + if [ -z "$DOCS_PARTITION" ]; then + echo "ERROR: No partition specified." + exit 1 + fi + + if [ ! -b "$DOCS_PARTITION" ]; then + echo "ERROR: $DOCS_PARTITION is not a valid block device." + exit 1 + fi +fi + +echo "✓ Found encrypted partition: $DOCS_PARTITION" +echo "" + +echo "Step 2: Creating mount point..." +# Mount in user's home directory for easy access +MOUNT_POINT="$HOME/SecureStorage" +mkdir -p "$MOUNT_POINT" +echo "✓ Mount point ready at: $MOUNT_POINT" +echo "" + +echo "Step 3: Mounting encrypted volume..." +echo "You will now be prompted for your encryption password." +echo "" + +# Mount the encrypted volume +if sudo veracrypt --text --mount "$DOCS_PARTITION" "$MOUNT_POINT"; then + echo "" + echo "Setting correct permissions..." + + # Change ownership of the mount point to current user + # This allows the user to read/write files + sudo chown $USER:$USER "$MOUNT_POINT" + + # If there are already files, change their ownership too + if [ "$(ls -A $MOUNT_POINT 2>/dev/null)" ]; then + sudo chown -R $USER:$USER "$MOUNT_POINT"/* + fi + + echo "✓ Permissions set for user access" + + echo "" + echo "======================================================================" + echo " SUCCESS!" + echo "======================================================================" + echo "" + echo "Your secure storage is now accessible at:" + echo " $MOUNT_POINT" + echo "" + echo "Easy access:" + echo " • Open file manager and go to Home folder" + echo " • Look for 'SecureStorage' folder" + echo " • Or in terminal: cd ~/SecureStorage" + echo "" + echo "You can now:" + echo " • Drag and drop files" + echo " • Edit documents" + echo " • Create new folders" + echo "" + echo "IMPORTANT: When finished, run:" + echo " sudo ./lock_storage.sh" + echo "" + echo "======================================================================" +else + echo "" + echo "======================================================================" + echo " MOUNT FAILED" + echo "======================================================================" + echo "" + echo "Possible reasons:" + echo " • Wrong password" + echo " • Wrong partition selected" + echo " • Volume already mounted" + echo " • veracrypt not installed" + echo "" + echo "Troubleshooting:" + echo " 1. Check if already mounted: mount | grep secure_storage" + echo " 2. Try unmounting first: sudo veracrypt -d" + echo " 3. Verify veracrypt: which veracrypt" + echo "" + rmdir "$MOUNT_POINT" 2>/dev/null + exit 1 +fi diff --git a/tools/veracrypt/DOWNLOAD_INSTRUCTIONS.md b/tools/veracrypt/DOWNLOAD_INSTRUCTIONS.md new file mode 100644 index 0000000..1921a14 --- /dev/null +++ b/tools/veracrypt/DOWNLOAD_INSTRUCTIONS.md @@ -0,0 +1,93 @@ +# Portable VeraCrypt Setup Instructions + +Before running the main tool, you need to download portable VeraCrypt binaries. +These will be copied to the TOOLS partition so the device works on any computer. + +## Required Downloads + +Download the following files and place them in this directory (`tools/veracrypt/`): + +### 1. Windows Portable (REQUIRED) +- **File**: `VeraCrypt Portable.exe` +- **URL**: https://www.veracrypt.fr/en/Downloads.html +- **Section**: "Portable" under Windows +- **Size**: ~30 MB +- **Rename to**: `VeraCrypt-Portable-Windows.exe` + +### 2. Linux Portable (REQUIRED) +- **Option A - GUI version**: + - Download from: https://www.veracrypt.fr/en/Downloads.html + - Generic Installer: `veracrypt-*-setup.tar.bz2` + - Extract and place: `veracrypt-*-setup-gui-x64` + - **Rename to**: `VeraCrypt-Portable-Linux` + +- **Option B - Console only**: + - Download: `veracrypt-*-setup-console-x64` + - **Rename to**: `VeraCrypt-Portable-Linux-Console` + +### 3. macOS Portable (OPTIONAL) +- **File**: `VeraCrypt_*.dmg` +- **URL**: https://www.veracrypt.fr/en/Downloads.html +- **Note**: Not truly "portable" but can be included for reference +- **Rename to**: `VeraCrypt-MacOS.dmg` + +### 4. Android APK (OPTIONAL but recommended) +- **Source**: https://github.com/veracrypt/VeraCrypt/releases +- **Alternative**: EDS Lite from Play Store (can't include, user must download) +- **Note**: Android apps can't be "portable" but having APK helps + +## Quick Download Script + +Run this to download automatically (Linux): + +```bash +cd tools/veracrypt/ + +# Windows Portable +wget https://launchpad.net/veracrypt/trunk/1.26.7/+download/VeraCrypt_Portable_1.26.7.exe \ + -O VeraCrypt-Portable-Windows.exe + +# Linux Console +wget https://launchpad.net/veracrypt/trunk/1.26.7/+download/veracrypt-console-1.26.7-Ubuntu-22.04-amd64.deb \ + -O veracrypt-linux.deb +ar x veracrypt-linux.deb +tar xf data.tar.xz +cp usr/bin/veracrypt VeraCrypt-Portable-Linux +chmod +x VeraCrypt-Portable-Linux +rm -rf usr/ *.tar.* *.deb + +# macOS +wget https://launchpad.net/veracrypt/trunk/1.26.7/+download/VeraCrypt_1.26.7.dmg \ + -O VeraCrypt-MacOS.dmg + +echo "✓ Downloads complete!" +``` + +## Verification + +After downloading, your `tools/veracrypt/` directory should contain: + +``` +tools/veracrypt/ +├── DOWNLOAD_INSTRUCTIONS.md (this file) +├── VeraCrypt-Portable-Windows.exe (~30 MB) +├── VeraCrypt-Portable-Linux (~3-5 MB) +└── VeraCrypt-MacOS.dmg (~40 MB) [optional] +``` + +## Notes + +- **Total size**: ~70-80 MB for all platforms +- **License**: VeraCrypt is open source (Apache 2.0 / TrueCrypt License 3.0) +- **Updates**: Check veracrypt.fr periodically for newer versions +- These portable versions allow accessing your encrypted partition on ANY computer without installing software + +## After Downloading + +Once you have the files in place, run the main setup script: + +```bash +sudo python3 covert_sd_card_tool.py -d /dev/sdX -a -t /path/to/tails.iso +``` + +The script will automatically copy these portable versions to the TOOLS partition.