Made it more portable and user friendly

.gitignore

@@ -3,6 +3,7 @@ __pycache__/
 *.py[cod]
 *$py.class
 *.so
+*.backup
 .claude
 
 # Log files - may contain sensitive paths/device info

covert_sd_card_tool.py

@@ -8,6 +8,8 @@ import shutil
 from datetime import datetime
 import time
 import json
+import urllib.request
+import tempfile
 
 # Global variables
 DEBUG = False
@@ -82,6 +84,145 @@ def run_command(command, shell=False, interactive=False, ignore_enospc=False):
         log(f"Command failed: {e}\nOutput: {e.stdout}\nError: {e.stderr}")
         sys.exit(1)
 
+def download_file(url, destination, description="file"):
+    """
+    Downloads a file with progress indication.
+
+    Args:
+        url (str): URL to download from
+        destination (str): Local path to save file
+        description (str): Description for user feedback
+    """
+    try:
+        log(f"Downloading {description}...")
+        log(f"  From: {url}")
+        log(f"  To: {destination}")
+
+        def progress_hook(block_num, block_size, total_size):
+            if total_size > 0:
+                downloaded = block_num * block_size
+                percent = min(100, (downloaded * 100) // total_size)
+                mb_downloaded = downloaded / (1024 * 1024)
+                mb_total = total_size / (1024 * 1024)
+                # Use \r to overwrite the same line
+                print(f"\r  Progress: {percent}% ({mb_downloaded:.1f} MB / {mb_total:.1f} MB)", end='', flush=True)
+
+        urllib.request.urlretrieve(url, destination, reporthook=progress_hook)
+        print()  # New line after progress
+        log(f"✓ {description} downloaded successfully")
+        return True
+    except Exception as e:
+        log(f"✗ Failed to download {description}: {e}")
+        return False
+
+def download_portable_veracrypt():
+    """
+    Downloads portable VeraCrypt binaries for Windows, Linux, and macOS.
+    Returns the path to a temporary directory containing the downloads.
+    """
+    log("\n" + "="*70)
+    log("DOWNLOADING PORTABLE VERACRYPT")
+    log("="*70)
+    log("\nTo make this device work on ANY computer without software installation,")
+    log("we need to download portable VeraCrypt for Windows, Linux, and macOS.")
+    log("")
+    log("Total download size: ~86-90 MB")
+    log("  • Windows Portable: ~39 MB")
+    log("  • Linux AppImage: ~13 MB")
+    log("  • Linux .deb Installer: ~13 MB")
+    log("  • macOS DMG: ~22 MB")
+    log("")
+    log("This is a one-time download that will be stored on your device.")
+    log("")
+
+    # Create temp directory for downloads
+    temp_dir = tempfile.mkdtemp(prefix="veracrypt_download_")
+    log(f"Using temporary directory: {temp_dir}")
+    log("")
+
+    # Get latest VeraCrypt version from GitHub
+    log("Fetching latest VeraCrypt version from GitHub...")
+    try:
+        import urllib.request
+        import json
+        with urllib.request.urlopen("https://api.github.com/repos/veracrypt/VeraCrypt/releases/latest") as response:
+            release_data = json.loads(response.read().decode())
+            VC_TAG = release_data["tag_name"]  # e.g., "VeraCrypt_1.26.24"
+            VC_VERSION = VC_TAG.replace("VeraCrypt_", "")  # e.g., "1.26.24"
+            log(f"✓ Latest version: {VC_VERSION}")
+    except Exception as e:
+        log(f"⚠ Warning: Could not fetch latest version ({e})")
+        log("  Falling back to version 1.26.24")
+        VC_TAG = "VeraCrypt_1.26.24"
+        VC_VERSION = "1.26.24"
+
+    log("")
+
+    downloads = {
+        "Windows Portable": {
+            "url": f"https://github.com/veracrypt/VeraCrypt/releases/download/{VC_TAG}/VeraCrypt.Portable.{VC_VERSION}.exe",
+            "filename": "VeraCrypt-Portable-Windows.exe",
+            "required": True
+        },
+        "Linux Portable AppImage": {
+            "url": f"https://github.com/veracrypt/VeraCrypt/releases/download/{VC_TAG}/VeraCrypt-{VC_VERSION}-x86_64.AppImage",
+            "filename": "VeraCrypt-Portable-Linux.AppImage",
+            "required": True
+        },
+        "Linux DEB Installer": {
+            "url": f"https://github.com/veracrypt/VeraCrypt/releases/download/{VC_TAG}/veracrypt-{VC_VERSION}-Ubuntu-22.04-amd64.deb",
+            "filename": "veracrypt-Ubuntu-22.04-amd64.deb",
+            "required": False
+        },
+        "macOS": {
+            "url": f"https://github.com/veracrypt/VeraCrypt/releases/download/{VC_TAG}/VeraCrypt_{VC_VERSION}.dmg",
+            "filename": "VeraCrypt-MacOS.dmg",
+            "required": False
+        }
+    }
+
+    success_count = 0
+    required_count = 0
+
+    for platform, info in downloads.items():
+        log(f"\n[{platform}]")
+        dest_path = os.path.join(temp_dir, info["filename"])
+
+        if info.get("required"):
+            required_count += 1
+
+        if download_file(info["url"], dest_path, f"{platform} VeraCrypt"):
+            success_count += 1
+
+            # Make Linux AppImage executable
+            if "AppImage" in info["filename"]:
+                try:
+                    os.chmod(dest_path, 0o755)
+                    log(f"  ✓ Made executable")
+                except Exception as e:
+                    log(f"  ⚠ Warning: Could not make executable: {e}")
+        else:
+            if info.get("required"):
+                log(f"  ✗ ERROR: {platform} is required but download failed!")
+
+    log("\n" + "="*70)
+    if success_count >= required_count:
+        log("✓ PORTABLE VERACRYPT DOWNLOAD COMPLETE")
+        log("="*70)
+        log(f"\nDownloaded {success_count} of {len(downloads)} platform(s)")
+        log(f"Files saved to: {temp_dir}")
+        return temp_dir
+    else:
+        log("✗ DOWNLOAD FAILED")
+        log("="*70)
+        log(f"\nOnly {success_count} of {required_count} required downloads succeeded.")
+        log("Cannot proceed without portable VeraCrypt binaries.")
+        log("\nTroubleshooting:")
+        log("  • Check your internet connection")
+        log("  • Verify firewall settings")
+        log("  • Try again later (download servers may be busy)")
+        sys.exit(1)
+
 def check_dependencies():
     """Checks and installs missing dependencies."""
     dependencies = [
@@ -178,6 +319,12 @@ def setup_usb():
     Sets up the bootable USB (Tails or Kali) and creates additional partitions if required.
     """
     global DRIVE
+
+    # Download portable VeraCrypt first (so it's ready to copy later)
+    veracrypt_dir = None
+    if CREATE_DOCS:
+        veracrypt_dir = download_portable_veracrypt()
+
     log("\n" + "="*70)
     log("STEP 1: DRIVE SELECTION")
     log("="*70)
@@ -412,7 +559,7 @@ def fix_partition_table_docs_only():
     time.sleep(5)  # Increased sleep to ensure partitions are recognized
     log("✓ Partition table refreshed")
 
-    setup_unencrypted_partition()
+    setup_unencrypted_partition(veracrypt_dir)
     setup_docs_partition()
 
 def fix_partition_table_tails():
@@ -504,7 +651,7 @@ def fix_partition_table_tails():
     time.sleep(5)
 
     setup_docs_partition()
-    setup_unencrypted_partition()
+    setup_unencrypted_partition(veracrypt_dir)
 
     log("Tails + encrypted documents partition setup complete!")
 
@@ -604,7 +751,7 @@ def fix_partition_table():
     setup_kali_partition()
     if CREATE_DOCS:
         setup_docs_partition()
-    setup_unencrypted_partition()
+    setup_unencrypted_partition(veracrypt_dir)
 
 def setup_kali_partition():
     """
@@ -702,22 +849,28 @@ def setup_docs_partition():
     log("ENCRYPTED VOLUME SETUP")
     log("="*70)
     log("\nYou will now create an encrypted volume for sensitive documents.")
-    log("\nWhat you'll be asked:")
-    log("  1. PASSWORD: Enter a strong passphrase (you'll type it twice)")
-    log("     - Use at least 20 characters")
-    log("     - Mix uppercase, lowercase, numbers, and symbols")
-    log("     - Avoid dictionary words or personal information")
-    log("  2. PIM (Personal Iterations Multiplier):")
+    log("")
+    log("SECURITY SETTINGS:")
+    log("  • Encryption: AES-Twofish-Serpent (triple cascade)")
+    log("  • Hash: SHA-512")
     if PARANOID_MODE:
-        log("     - PARANOID MODE: PIM set to 5000 (maximum security)")
-        log("     - Unlock time: ~5-7 seconds")
+        log("  • PIM: 5000 (PARANOID mode - maximum security)")
+        log("  • Unlock time: ~5-7 seconds")
     else:
-        log("     - STANDARD: PIM set to 2000 (high security)")
-        log("     - Unlock time: ~2-3 seconds")
-    log("  3. KEYFILES: Leave blank unless you know what you're doing")
-    log("\nIMPORTANT: Remember your password! There is NO password recovery!")
+        log("  • PIM: 2000 (standard high security)")
+        log("  • Unlock time: ~2-3 seconds")
+    log("")
+    log("PASSWORD REQUIREMENTS:")
+    log("  • Minimum 20 characters (longer is better)")
+    log("  • Mix uppercase, lowercase, numbers, and symbols")
+    log("  • Avoid dictionary words or personal information")
+    log("  • Example: My$ecur3Tr@v3lD0cs!2025#Paris")
+    log("")
+    log("⚠ CRITICAL: There is NO password recovery!")
+    log("  If you forget your password, your data is GONE FOREVER.")
+    log("")
     log("="*70)
-    input("\nPress ENTER to continue with encryption setup...")
+    input("Press ENTER when you're ready to create your password...")
 
     log("\nConfiguring VeraCrypt encryption for documents partition...")
 
@@ -734,11 +887,32 @@ def setup_docs_partition():
     )
 
     log("\nStarting VeraCrypt encryption (this may take a few minutes)...")
-    log("You will be prompted for:")
-    log("  1. Password (enter twice)")
-    log("  2. PIM (press Enter to use default)")
-    log("  3. Keyfiles (press Enter to skip)")
-    log("  4. Filesystem (will use ext4 automatically)")
+    log("="*70)
+    log("VERACRYPT WILL ASK YOU THESE QUESTIONS:")
+    log("="*70)
+    log("")
+    log("1. 'Enter password:' → Type your strong password (20+ characters)")
+    log("   Then press ENTER")
+    log("")
+    log("2. 'Re-enter password:' → Type the SAME password again")
+    log("   Then press ENTER")
+    log("")
+    log("3. 'Enter PIM:' → Just press ENTER")
+    log(f"   (We're using PIM {pim_value} automatically)")
+    log("")
+    log("4. 'Enter keyfile path [none]:' → Just press ENTER")
+    log("   (Keyfiles not needed for most users)")
+    log("")
+    log("5. 'Please type at least 320 randomly chosen characters'")
+    log("   → Smash random keys on your keyboard until it says 'Done'")
+    log("   This creates entropy for encryption")
+    log("")
+    log("6. 'Protect hidden volume (if any)? (y=Yes/n=No) [No]:' → Type: n")
+    log("   Then press ENTER (we're not using hidden volumes)")
+    log("")
+    log("="*70)
+    log("Creating volume now...")
+    log("="*70)
     log("")
     run_command(veracrypt_create_cmd, shell=True, interactive=True)
     log("\n✓ Documents partition encrypted successfully!")
@@ -747,9 +921,12 @@ def setup_docs_partition():
     log(f"  PIM: {pim_value}")
     log(f"  Filesystem: ext4")
 
-def setup_unencrypted_partition():
+def setup_unencrypted_partition(veracrypt_dir=None):
     """
     Sets up the unencrypted partition for scripts and instructions.
+
+    Args:
+        veracrypt_dir (str): Path to directory containing portable VeraCrypt files
     """
     global DRIVE
     UNENCRYPTED_PART = get_partition_name(DRIVE, get_last_partition_number())
@@ -772,127 +949,81 @@ def setup_unencrypted_partition():
     run_command(f"sudo mount {UNENCRYPTED_PART} /mnt/unencrypted", shell=True)
     log("✓ Tools partition mounted")
 
-    instructions = f"""
-INSTRUCTIONS FOR ACCESSING SECURE STORAGE
+    # Get the directory where this script is located
+    script_dir = os.path.dirname(os.path.abspath(__file__))
+    tools_dir = os.path.join(script_dir, "tools")
 
-To access your secure partition:
-  1. Run: sudo ./mount_storage.sh
-  2. Enter your password when prompted
-  3. Your files will be available at /mnt/secure_storage
+    log("\nCopying helper files from tools/ directory...")
 
-To safely lock your storage:
-  1. Close all files and applications using the storage
-  2. Run: sudo ./lock_storage.sh
-  3. Your data is now secured
+    # Copy README.txt
+    readme_path = os.path.join(tools_dir, "README.txt")
+    if os.path.exists(readme_path):
+        run_command(f"sudo cp '{readme_path}' /mnt/unencrypted/README.txt", shell=True)
+        log("  ✓ README.txt copied")
+    else:
+        log(f"  ⚠ Warning: {readme_path} not found, skipping README")
 
-IMPORTANT: Always lock your storage before removing the device.
-"""
+    # Copy WINDOWS_INSTRUCTIONS.txt
+    windows_inst_path = os.path.join(tools_dir, "WINDOWS_INSTRUCTIONS.txt")
+    if os.path.exists(windows_inst_path):
+        run_command(f"sudo cp '{windows_inst_path}' /mnt/unencrypted/WINDOWS_INSTRUCTIONS.txt", shell=True)
+        log("  ✓ WINDOWS_INSTRUCTIONS.txt copied")
+    else:
+        log(f"  ⚠ Warning: {windows_inst_path} not found")
 
-    log("\nCreating helper files...")
-    with open("/tmp/README.txt", "w") as readme_file:
-        readme_file.write(instructions)
-    run_command("sudo cp /tmp/README.txt /mnt/unencrypted/README.txt", shell=True)
-    run_command("sudo rm /tmp/README.txt", shell=True)
-    log("  ✓ README.txt created")
+    # Copy MOBILE_INSTRUCTIONS.txt
+    mobile_inst_path = os.path.join(tools_dir, "MOBILE_INSTRUCTIONS.txt")
+    if os.path.exists(mobile_inst_path):
+        run_command(f"sudo cp '{mobile_inst_path}' /mnt/unencrypted/MOBILE_INSTRUCTIONS.txt", shell=True)
+        log("  ✓ MOBILE_INSTRUCTIONS.txt copied")
+    else:
+        log(f"  ⚠ Warning: {mobile_inst_path} not found")
 
-    mount_script = """#!/bin/bash
-# Script to mount secure storage partition
+    # Copy mount_storage.sh
+    mount_script_path = os.path.join(tools_dir, "mount_storage.sh")
+    if os.path.exists(mount_script_path):
+        run_command(f"sudo cp '{mount_script_path}' /mnt/unencrypted/mount_storage.sh", shell=True)
+        run_command("sudo chmod +x /mnt/unencrypted/mount_storage.sh", shell=True)
+        log("  ✓ mount_storage.sh copied")
+    else:
+        log(f"  ⚠ Warning: {mount_script_path} not found, skipping mount script")
 
-echo "=== Secure Storage Mount ==="
-echo ""
-echo "Available storage devices:"
-lsblk -o NAME,SIZE,TYPE,LABEL | grep -E 'disk|part'
-echo ""
-read -p "Enter the partition path (e.g., /dev/sdb3): " DRIVE_PATH
+    # Copy lock_storage.sh
+    lock_script_path = os.path.join(tools_dir, "lock_storage.sh")
+    if os.path.exists(lock_script_path):
+        run_command(f"sudo cp '{lock_script_path}' /mnt/unencrypted/lock_storage.sh", shell=True)
+        run_command("sudo chmod +x /mnt/unencrypted/lock_storage.sh", shell=True)
+        log("  ✓ lock_storage.sh copied")
+    else:
+        log(f"  ⚠ Warning: {lock_script_path} not found, skipping lock script")
 
-if [ -z "$DRIVE_PATH" ]; then
-    echo "Error: No partition specified."
-    exit 1
-fi
+    # Copy portable VeraCrypt files
+    if veracrypt_dir and os.path.exists(veracrypt_dir):
+        log("\nCopying portable VeraCrypt binaries...")
+        run_command("sudo mkdir -p /mnt/unencrypted/VeraCrypt", shell=True)
 
-if [ ! -b "$DRIVE_PATH" ]; then
-    echo "Error: $DRIVE_PATH is not a valid block device."
-    exit 1
-fi
+        veracrypt_files = [
+            ("VeraCrypt-Portable-Windows.exe", "Windows portable"),
+            ("VeraCrypt-Portable-Linux.AppImage", "Linux portable AppImage"),
+            ("veracrypt-Ubuntu-22.04-amd64.deb", "Linux DEB installer"),
+            ("VeraCrypt-MacOS.dmg", "macOS installer")
+        ]
 
-echo ""
-echo "Mounting secure storage from $DRIVE_PATH..."
-sudo mkdir -p /mnt/secure_storage
+        for filename, description in veracrypt_files:
+            src = os.path.join(veracrypt_dir, filename)
+            if os.path.exists(src):
+                run_command(f"sudo cp '{src}' /mnt/unencrypted/VeraCrypt/{filename}", shell=True)
+                if "Linux" in filename:
+                    run_command(f"sudo chmod +x /mnt/unencrypted/VeraCrypt/{filename}", shell=True)
+                log(f"  ✓ {description} copied")
+            else:
+                log(f"  ⚠ {description} not found (optional)")
 
-# Mount the encrypted volume
-if sudo veracrypt --text --mount "$DRIVE_PATH" /mnt/secure_storage; then
-    echo ""
-    echo "SUCCESS: Secure storage is now accessible at /mnt/secure_storage"
-    echo ""
-    echo "Remember to run ./lock_storage.sh when finished!"
-else
-    echo ""
-    echo "ERROR: Failed to mount storage. Check your password and try again."
-    sudo rmdir /mnt/secure_storage 2>/dev/null
-    exit 1
-fi
-"""
-
-    with open("/tmp/mount_storage.sh", "w") as script_file:
-        script_file.write(mount_script)
-    run_command("sudo cp /tmp/mount_storage.sh /mnt/unencrypted/mount_storage.sh", shell=True)
-    run_command("sudo chmod +x /mnt/unencrypted/mount_storage.sh", shell=True)
-    run_command("sudo rm /tmp/mount_storage.sh", shell=True)
-    log("  ✓ mount_storage.sh created")
-
-    cleanup_script = """#!/bin/bash
-# Script to safely lock secure storage
-
-echo "=== Secure Storage Lock ==="
-echo ""
-
-# Check if storage is mounted
-if mountpoint -q /mnt/secure_storage; then
-    echo "Checking for open files..."
-
-    # Check if any processes are using the mount
-    if sudo lsof /mnt/secure_storage 2>/dev/null | grep -q /mnt/secure_storage; then
-        echo ""
-        echo "WARNING: Files are still open in the secure storage!"
-        echo "Open files/processes:"
-        sudo lsof /mnt/secure_storage 2>/dev/null
-        echo ""
-        read -p "Force close and lock anyway? (y/N): " FORCE
-        if [ "$FORCE" != "y" ] && [ "$FORCE" != "Y" ]; then
-            echo "Lock cancelled. Please close all files and try again."
-            exit 1
-        fi
-    fi
-
-    echo ""
-    echo "Locking secure storage..."
-
-    # Sync any pending writes
-    sync
-
-    # Dismount the encrypted volume
-    if sudo veracrypt --text --dismount /mnt/secure_storage; then
-        sudo rmdir /mnt/secure_storage 2>/dev/null
-        echo ""
-        echo "SUCCESS: Secure storage is now locked."
-        echo "Your data is safe."
-    else
-        echo ""
-        echo "ERROR: Failed to lock storage. Try closing all applications and run again."
-        exit 1
-    fi
-else
-    echo "Secure storage is not currently mounted."
-    echo "Nothing to lock."
-fi
-"""
-
-    with open("/tmp/lock_storage.sh", "w") as script_file:
-        script_file.write(cleanup_script)
-    run_command("sudo cp /tmp/lock_storage.sh /mnt/unencrypted/lock_storage.sh", shell=True)
-    run_command("sudo chmod +x /mnt/unencrypted/lock_storage.sh", shell=True)
-    run_command("sudo rm /tmp/lock_storage.sh", shell=True)
-    log("  ✓ lock_storage.sh created")
+        log("  ✓ Portable VeraCrypt binaries installed")
+        log("\n  📌 IMPORTANT: These binaries allow accessing encrypted files")
+        log("      on ANY Windows, Linux, or Mac computer WITHOUT installing software!")
+    else:
+        log("\n  ⚠ No portable VeraCrypt binaries provided - skipping")
 
     log("\nUnmounting tools partition...")
     run_command("sudo umount /mnt/unencrypted", shell=True)

tools/MOBILE_INSTRUCTIONS.txt

@@ -0,0 +1,239 @@
+======================================================================
+          SECURE STORAGE - MOBILE DEVICE INSTRUCTIONS
+======================================================================
+
+IMPORTANT: Mobile access has limitations compared to desktop.
+Read carefully to understand what's possible on your device.
+
+======================================================================
+ANDROID DEVICES
+======================================================================
+
+REQUIREMENTS:
+  • Android 5.0 or newer
+  • EDS (Encrypted Data Store) app - REQUIRED
+  • USB OTG adapter (to connect USB device to phone)
+  • File manager app (most phones have one built-in)
+
+REQUIRED APP:
+  • EDS Lite (Free & Open Source)
+  • Google Play: https://play.google.com/store/apps/details?id=com.sovworks.eds.android
+  • Direct link if Google Play doesn't work:
+    https://play.google.com/store/apps/details?id=com.sovworks.projecteds
+
+----------------------------------------------------------------------
+SETUP: Using EDS Lite (RECOMMENDED)
+----------------------------------------------------------------------
+
+Step 1: Install EDS Lite
+        • Open Google Play Store
+        • Search for "EDS Lite" or "EDS (Encrypted Data Store)"
+        • Install the app (it's FREE)
+        • Or use the direct link above
+
+Step 2: Connect your USB device
+        • Connect USB device using OTG adapter
+        • Android should show "USB device connected" notification
+
+Step 3: Open EDS Lite app
+        • Tap "Open container"
+        • Navigate to your USB device
+        • Look for the partition WITHOUT a filesystem/label
+        • Select the encrypted partition
+
+Step 4: Enter password
+        • Select encryption: VeraCrypt
+        • Enter your password
+        • For PIM: enter 2000 or 5000 (whatever you set)
+        • Tap "OK"
+
+Step 5: Access your files
+        • Files will appear in EDS Lite
+        • You can view, copy, or share files
+        • Some apps can open files directly from EDS
+
+IMPORTANT - Safely Close:
+        • Tap "Close container" when done
+        • Wait for confirmation before unplugging
+        • Only then remove USB device
+
+----------------------------------------------------------------------
+ALTERNATIVE: VeraCrypt for Android (Advanced Users)
+----------------------------------------------------------------------
+
+ℹ️ NOTE: EDS Lite (above) is easier to use and recommended.
+   Only use VeraCrypt if you're familiar with it.
+
+Step 1: Install VeraCrypt for Android
+        • Download from: https://github.com/veracrypt/veracrypt
+        • Or install from F-Droid store
+        • Enable "Unknown sources" if needed
+
+Step 2-5: Follow similar steps as EDS Lite above
+        • The interface is similar to desktop VeraCrypt
+        • Process is the same: select partition, enter password, mount
+
+======================================================================
+iOS DEVICES (iPhone/iPad)
+======================================================================
+
+✅ SOLUTION: Crypto Disks App (Paid)
+
+RECOMMENDED APP:
+  • Crypto Disks - Store Private Files Securely
+  • App Store: https://apps.apple.com/us/app/crypto-disks-store-private/id889549308
+  • Price: ~$4.99 (one-time purchase)
+  • Supports VeraCrypt containers!
+
+----------------------------------------------------------------------
+SETUP: Using Crypto Disks on iOS
+----------------------------------------------------------------------
+
+Step 1: Purchase and Install Crypto Disks
+        • Open App Store on your iPhone/iPad
+        • Search for "Crypto Disks"
+        • Or use the direct link above
+        • Purchase and install (~$4.99)
+
+Step 2: Transfer Encrypted Container
+        ⚠️ LIMITATION: iOS doesn't support direct USB access like Android
+
+        You have two options:
+
+        OPTION A: Copy via Computer (Easier)
+        1. Connect USB device to your Mac/PC
+        2. Mount the encrypted partition with VeraCrypt
+        3. Create a smaller VeraCrypt container file inside
+        4. Transfer that container to your iPhone via:
+           - AirDrop (Mac to iPhone)
+           - iCloud Drive
+           - iTunes File Sharing
+        5. Open in Crypto Disks app
+
+        OPTION B: Use Wi-Fi File Transfer
+        1. Use Crypto Disks' built-in file transfer
+        2. Transfer container file from computer
+        3. Open in app
+
+Step 3: Mount in Crypto Disks App
+        • Open Crypto Disks app
+        • Select "Add Disk Image"
+        • Choose your transferred container
+        • Enter password and PIM
+        • Access your files
+
+⚠️ IMPORTANT iOS LIMITATIONS:
+   • Cannot directly mount USB partition (Apple restriction)
+   • Must use container FILES, not raw partitions
+   • Requires copying/transferring container to iPhone
+   • Best for occasional access, not primary use
+
+----------------------------------------------------------------------
+iOS WORKAROUND: Emergency Access Only
+----------------------------------------------------------------------
+
+If you don't want to pay for Crypto Disks, here are free alternatives:
+
+Option A: Use a Computer as Bridge
+        1. Mount the encrypted storage on your Mac/PC
+        2. Copy files you need to iCloud or Files app
+        3. Access those files from your iPhone
+        4. Delete copies when done (IMPORTANT for security!)
+
+Option B: Use Remote Access
+        1. Mount encrypted storage on your home computer
+        2. Set up secure remote access (VPN + file sharing)
+        3. Access files remotely from iPhone
+        4. More complex but maintains security
+
+Option C: Take Photos of Documents
+        1. If you just need to VIEW travel docs in emergency
+        2. Take photos/screenshots on computer
+        3. Store in encrypted note app (Apple Notes with lock)
+        4. Delete after trip
+
+NOTE: These workarounds compromise security slightly.
+      Crypto Disks app is the most secure iOS solution.
+
+======================================================================
+IMPORTANT SECURITY NOTES FOR MOBILE
+======================================================================
+
+⚠ Screen Lock
+   • Always have a PIN/password on your phone
+   • If someone steals your phone while storage is mounted,
+     they can access your files
+
+⚠ App Permissions
+   • Only grant necessary permissions to encryption apps
+   • Be cautious with "file access" permissions
+
+⚠ Public WiFi
+   • Don't use public WiFi when accessing sensitive files
+   • Or use a VPN if you must
+
+⚠ Battery Concerns
+   • Don't let your phone die while storage is mounted
+   • Always properly close/dismount before battery runs out
+
+⚠ Background Apps
+   • Close the encryption app properly when done
+   • Don't just switch to another app
+   • Storage might stay mounted in background
+
+⚠ Phone Updates
+   • Close encrypted storage before major OS updates
+   • Updates might interrupt and cause corruption
+
+======================================================================
+TROUBLESHOOTING - ANDROID
+======================================================================
+
+"Cannot find USB device"
+  • Try a different OTG adapter
+  • Check if your phone supports USB OTG
+  • Some phones need USB settings changed (File Transfer mode)
+
+"Wrong password" (but password is correct)
+  • Make sure you selected "VeraCrypt" as encryption type
+  • Verify PIM value (2000 or 5000)
+  • Some apps don't support all VeraCrypt settings
+
+"App crashes when mounting"
+  • Try a different encryption app (EDS vs VeraCrypt)
+  • Check if partition is already mounted
+  • Restart phone and try again
+
+"Can't edit files, only view"
+  • This is normal for some apps
+  • Copy file to phone storage
+  • Edit it there
+  • Copy back when done
+
+"Storage disconnected unexpectedly"
+  • Check USB connection
+  • Some phones cut power to USB to save battery
+  • Disable battery optimization for the encryption app
+
+======================================================================
+LIMITATIONS OF MOBILE ACCESS
+======================================================================
+
+Things that DON'T work well on mobile:
+  ✗ Editing large files directly on encrypted storage
+  ✗ Running programs/apps from encrypted storage
+  ✗ Fast file operations (mobile is slower than desktop)
+  ✗ iOS access (not supported at all)
+
+Things that WORK WELL on mobile:
+  ✓ Viewing documents (PDFs, photos, etc.)
+  ✓ Copying individual files to phone
+  ✓ Sharing files to other apps
+  ✓ Emergency access when no computer available
+  ✓ Quick lookup of information
+
+RECOMMENDATION:
+  Use mobile access for emergencies and viewing only.
+  Use desktop (Linux/Windows) for actual file management.
+
+======================================================================

tools/README.txt

@@ -0,0 +1,194 @@
+======================================================================
+              SECURE STORAGE - QUICK START GUIDE
+======================================================================
+
+WHAT'S ON THIS DEVICE:
+  • Encrypted storage partition for sensitive documents
+  • Portable VeraCrypt (works on ANY computer - no installation!)
+  • Helper scripts (Linux/Mac)
+  • Instructions for Windows and mobile devices
+
+======================================================================
+ACCESSING YOUR FILES - QUICK GUIDE
+======================================================================
+
+LINUX / MAC:
+  1. Open terminal in this folder
+  2. Run: sudo ./mount_storage.sh
+  3. Enter your password
+  4. Files appear in: ~/SecureStorage
+
+WINDOWS:
+  1. Open "WINDOWS_INSTRUCTIONS.txt" on this device
+  2. Follow the step-by-step guide
+  3. Use portable VeraCrypt from "VeraCrypt" folder (no install needed!)
+
+ANDROID:
+  1. Install "EDS Lite" from Google Play Store (FREE)
+     https://play.google.com/store/apps/details?id=com.sovworks.projecteds
+  2. Connect USB with OTG adapter
+  3. Open "MOBILE_INSTRUCTIONS.txt" for step-by-step guide
+
+iOS (iPhone/iPad):
+  1. Install "Crypto Disks" from App Store (~$4.99)
+     https://apps.apple.com/us/app/crypto-disks-store-private/id889549308
+  2. See "MOBILE_INSTRUCTIONS.txt" for setup
+  ⚠ iOS has limitations - requires copying files, can't mount USB directly
+
+======================================================================
+IMPORTANT: HOW TO SAFELY LOCK YOUR STORAGE
+======================================================================
+
+LINUX / MAC:
+  1. Close ALL programs using the secure storage
+  2. Run: sudo ./lock_storage.sh
+  3. Wait for "SUCCESS" message
+  4. Safe to remove device
+
+WINDOWS:
+  1. Close all files
+  2. In VeraCrypt, select the drive
+  3. Click "Dismount"
+  4. Use "Safely Remove Hardware"
+
+⚠ CRITICAL: ALWAYS lock/dismount before removing!
+   Otherwise you risk losing your data.
+
+======================================================================
+PORTABLE VERACRYPT - NO INSTALLATION REQUIRED!
+======================================================================
+
+Inside the "VeraCrypt" folder on this device:
+
+• VeraCrypt-Portable-Windows.exe
+    → Double-click to run on ANY Windows PC
+    → Works without admin rights on most systems
+
+• VeraCrypt-Portable-Linux.AppImage
+    → Run on ANY Linux system (no install!)
+    → Command: ./VeraCrypt-Portable-Linux.AppImage
+    → AppImage = portable, works on all Linux distributions
+
+• veracrypt-Ubuntu-22.04-amd64.deb
+    → System-wide installer for Ubuntu/Debian
+    → Install with: sudo dpkg -i veracrypt-Ubuntu-22.04-amd64.deb
+    → Use this if you prefer installed version over AppImage
+
+• VeraCrypt-MacOS.dmg
+    → Install on Mac (one-time)
+    → Works on any Mac after that
+
+This means you can access your encrypted files on ANY computer
+even if VeraCrypt is not installed!
+
+======================================================================
+YOUR PASSWORD
+======================================================================
+
+⚠ There is NO password recovery! If you forget it, data is GONE.
+
+Password details:
+  • Case-sensitive (Abc123 ≠ abc123)
+  • Minimum 20 characters recommended
+  • Mix of letters, numbers, symbols
+  • Write it down and keep it SAFE (not on this device!)
+
+If you set a PIM value:
+  • Standard setup: PIM = 2000
+  • Paranoid setup: PIM = 5000
+  • VeraCrypt will ask for this when mounting
+
+======================================================================
+TROUBLESHOOTING
+======================================================================
+
+PROBLEM: "Cannot find TOOLS partition"
+FIX: Ensure device is fully connected; try different USB port
+
+PROBLEM: "Wrong password" (but you know it's correct)
+FIX: Check if CAPS LOCK is on; verify PIM value
+
+PROBLEM: "Volume already mounted"
+FIX: Close any VeraCrypt windows and run:
+     • Linux/Mac: sudo veracrypt -d
+     • Windows: Dismount all in VeraCrypt
+
+PROBLEM: "Permission denied" when accessing files
+FIX:
+     • Linux/Mac: Re-run mount script (it sets permissions)
+     • Windows: Check if you ran VeraCrypt as administrator
+
+PROBLEM: "Files appear but I can't edit them"
+FIX:
+     • Linux/Mac: Run: sudo chown -R $USER ~/SecureStorage
+     • Windows: Right-click → Properties → Security → Edit
+
+PROBLEM: Device not detected on Android
+FIX:
+     • Check USB OTG adapter is working
+     • Enable "File Transfer" mode in USB settings
+     • Try different OTG adapter
+
+======================================================================
+FILE LOCATIONS AFTER MOUNTING
+======================================================================
+
+Linux/Mac:     ~/SecureStorage
+               (In your home folder)
+
+Windows:       Z:\ (or whatever drive letter you selected)
+               Shows in "This PC"
+
+Android:       Accessible within EDS Lite or VeraCrypt app
+
+======================================================================
+SECURITY NOTES
+======================================================================
+
+✓ Your files use military-grade encryption
+✓ AES-Twofish-Serpent triple cascade (strongest available)
+✓ Even supercomputers cannot crack this encryption
+
+⚠ The password is the ONLY key
+⚠ No backdoors, no recovery, no "forgot password" option
+⚠ Keep password safe but separate from this device
+
+Best practices:
+  • Always dismount before removing device
+  • Don't leave mounted when unattended
+  • Use strong unique password
+  • Don't store password on this device
+  • Lock your computer when storage is mounted
+
+======================================================================
+ADVANCED: MANUAL MOUNTING (if scripts fail)
+======================================================================
+
+LINUX/MAC:
+  1. Find encrypted partition:
+       lsblk -o NAME,SIZE,LABEL,FSTYPE
+       (Look for partition WITHOUT filesystem label)
+
+  2. Mount with VeraCrypt:
+       sudo veracrypt /dev/sdX2 ~/SecureStorage
+       (Replace sdX2 with your partition)
+
+  3. Enter password and PIM when prompted
+
+WINDOWS:
+  1. Open portable VeraCrypt
+  2. Select any drive letter
+  3. Click "Select Device"
+  4. Choose partition WITHOUT label (not the TOOLS one)
+  5. Click "Mount"
+  6. Enter password
+
+======================================================================
+NEED MORE HELP?
+======================================================================
+
+• Windows users: See WINDOWS_INSTRUCTIONS.txt
+• Mobile users: See MOBILE_INSTRUCTIONS.txt
+• VeraCrypt documentation: https://www.veracrypt.fr/en/Documentation.html
+
+======================================================================

tools/WINDOWS_INSTRUCTIONS.txt

@@ -0,0 +1,93 @@
+======================================================================
+           SECURE STORAGE - WINDOWS INSTRUCTIONS
+======================================================================
+
+REQUIREMENTS:
+  • This secure storage device connected
+  • NO SOFTWARE INSTALLATION NEEDED!
+
+======================================================================
+HOW TO ACCESS YOUR SECURE FILES (WINDOWS)
+======================================================================
+
+OPTION 1: USE PORTABLE VERACRYPT (RECOMMENDED - NO INSTALL!)
+
+Step 1: Open the VeraCrypt folder on this USB drive
+
+Step 2: Double-click "VeraCrypt-Portable-Windows.exe"
+        • It runs directly - no installation!
+        • Works on most Windows PCs without admin rights
+        • If blocked, right-click → "Run anyway"
+
+Step 3: The VeraCrypt window opens
+
+----------------------------------------------------------------------
+
+OPTION 2: USE INSTALLED VERACRYPT (if you prefer)
+
+Step 1: Install VeraCrypt (if not already installed)
+        • Go to https://www.veracrypt.fr/en/Downloads.html
+        • Download VeraCrypt for Windows
+        • Run the installer
+
+Step 2: Open VeraCrypt from Start Menu
+        • Search for "VeraCrypt" in Start Menu
+        • Click "VeraCrypt" to launch
+
+----------------------------------------------------------------------
+
+CONTINUING (after opening VeraCrypt either way):
+
+Step 3: Select a drive letter
+        • In VeraCrypt window, click any drive letter (e.g., Z:)
+
+Step 4: Select Volume
+        • Click "Select Device..." button
+        • Find your USB device (look for the partition WITHOUT a filesystem)
+        • Usually it's the second-to-last partition
+        • Click OK
+
+Step 5: Click "Mount" button
+        • Enter your password when prompted
+        • For PIM: leave blank or enter the PIM you set (2000 or 5000)
+        • Click OK
+
+Step 6: Access your files
+        • Open File Explorer
+        • Look for new drive (e.g., Z:)
+        • Your files are there!
+
+======================================================================
+HOW TO SAFELY LOCK YOUR STORAGE (WINDOWS)
+======================================================================
+
+Step 1: Close ALL programs using the secure storage
+        • Save documents
+        • Close File Explorer windows
+        • Close any apps with open files
+
+Step 2: In VeraCrypt window
+        • Select the mounted drive (e.g., Z:)
+        • Click "Dismount" button
+
+Step 3: Safe to remove
+        • Click "Safely Remove Hardware" in system tray
+        • Select your USB device
+        • Remove when Windows says it's safe
+
+======================================================================
+IMPORTANT NOTES
+======================================================================
+
+⚠ ALWAYS dismount before removing the device!
+   Otherwise you risk data corruption.
+
+⚠ If you forget your password, your data is GONE.
+   There is NO password recovery.
+
+⚠ Partition to select:
+   • Look in VeraCrypt's "Select Device" window
+   • Choose the partition WITHOUT a label/filesystem
+   • It's usually NOT the one labeled "TOOLS"
+
+======================================================================

tools/lock_storage.sh

@@ -0,0 +1,88 @@
+#!/bin/bash
+# Script to safely lock secure storage
+
+echo "======================================================================"
+echo "                    SECURE STORAGE LOCK TOOL"
+echo "======================================================================"
+echo ""
+
+# Mount point location
+MOUNT_POINT="$HOME/SecureStorage"
+
+# Check if storage is mounted
+if mountpoint -q "$MOUNT_POINT" 2>/dev/null || [ -d "$MOUNT_POINT" ] && sudo veracrypt --text --list | grep -q "$MOUNT_POINT"; then
+    echo "Step 1: Checking for open files..."
+
+    # Check if any processes are using the mount
+    OPEN_FILES=$(sudo lsof "$MOUNT_POINT" 2>/dev/null | tail -n +2)
+    if [ -n "$OPEN_FILES" ]; then
+        echo ""
+        echo "⚠ WARNING: Files or programs are still using the secure storage!"
+        echo ""
+        echo "Open files/processes:"
+        echo "$OPEN_FILES"
+        echo ""
+        echo "You should close these programs first to avoid data loss."
+        echo ""
+        read -p "Force close and lock anyway? (y/N): " FORCE
+        if [ "$FORCE" != "y" ] && [ "$FORCE" != "Y" ]; then
+            echo ""
+            echo "Lock cancelled. Please:"
+            echo "  1. Close all programs using the secure storage"
+            echo "  2. Save any open documents"
+            echo "  3. Run this script again"
+            exit 1
+        fi
+        echo ""
+        echo "Forcing lock (files will be closed)..."
+    else
+        echo "✓ No open files detected"
+    fi
+
+    echo ""
+    echo "Step 2: Syncing pending writes to disk..."
+    sync
+    echo "✓ All data written to disk"
+
+    echo ""
+    echo "Step 3: Dismounting encrypted volume..."
+
+    # Dismount the encrypted volume
+    if sudo veracrypt --text --dismount "$MOUNT_POINT" 2>/dev/null; then
+        rmdir "$MOUNT_POINT" 2>/dev/null
+        echo "✓ Volume dismounted"
+        echo ""
+        echo "======================================================================"
+        echo "                           SUCCESS!"
+        echo "======================================================================"
+        echo ""
+        echo "Secure storage is now locked and encrypted."
+        echo "Your data is safe to remove the device."
+        echo ""
+        echo "======================================================================"
+    else
+        echo ""
+        echo "======================================================================"
+        echo "                       DISMOUNT FAILED"
+        echo "======================================================================"
+        echo ""
+        echo "Possible reasons:"
+        echo "  • Files still in use (close all programs)"
+        echo "  • Permission denied"
+        echo "  • Volume not mounted with this script"
+        echo ""
+        echo "Troubleshooting:"
+        echo "  1. Check what's using it: sudo lsof $MOUNT_POINT"
+        echo "  2. Force dismount all: sudo veracrypt -d"
+        echo "  3. Kill processes: sudo fuser -km $MOUNT_POINT"
+        echo ""
+        exit 1
+    fi
+else
+    echo "ℹ Secure storage is not currently mounted."
+    echo ""
+    echo "Nothing to lock - your data is already secured."
+    echo ""
+    echo "If you want to access it, run:"
+    echo "    sudo ./mount_storage.sh"
+fi

tools/mount_storage.sh

@@ -0,0 +1,137 @@
+#!/bin/bash
+# Script to mount secure storage partition
+
+echo "======================================================================"
+echo "                    SECURE STORAGE MOUNT TOOL"
+echo "======================================================================"
+echo ""
+
+# Function to find the documents partition (second-to-last partition on drive)
+find_docs_partition() {
+    # Look for drives with TOOLS partition (our indicator)
+    local tools_drive=$(lsblk -ln -o NAME,LABEL | grep "TOOLS" | awk '{print $1}' | head -1)
+
+    if [ -z "$tools_drive" ]; then
+        echo "ERROR: Could not find TOOLS partition."
+        echo "Please ensure the secure storage device is connected."
+        return 1
+    fi
+
+    # Get the base drive name (remove partition number)
+    local base_drive=$(echo "$tools_drive" | sed 's/[0-9]*$//' | sed 's/p$//')
+
+    # Get all partitions on this drive
+    local partitions=$(lsblk -ln -o NAME "/dev/$base_drive" | grep "^$base_drive" | tail -n +2)
+    local part_count=$(echo "$partitions" | wc -l)
+
+    if [ "$part_count" -lt 2 ]; then
+        echo "ERROR: Not enough partitions found."
+        return 1
+    fi
+
+    # Get second-to-last partition (documents partition)
+    local docs_part=$(echo "$partitions" | tail -n 2 | head -n 1)
+    echo "/dev/$docs_part"
+    return 0
+}
+
+echo "Step 1: Detecting secure storage device..."
+DOCS_PARTITION=$(find_docs_partition)
+
+if [ $? -ne 0 ]; then
+    echo ""
+    echo "======================================================================"
+    echo "AUTO-DETECTION FAILED - MANUAL MODE"
+    echo "======================================================================"
+    echo ""
+    echo "Available partitions:"
+    lsblk -o NAME,SIZE,TYPE,LABEL,FSTYPE | grep -v "loop"
+    echo ""
+    echo "TIP: Look for a partition WITHOUT a filesystem (blank FSTYPE)"
+    echo "      This is usually your encrypted documents partition."
+    echo ""
+    read -p "Enter the partition path (e.g., /dev/sdb1): " DOCS_PARTITION
+
+    if [ -z "$DOCS_PARTITION" ]; then
+        echo "ERROR: No partition specified."
+        exit 1
+    fi
+
+    if [ ! -b "$DOCS_PARTITION" ]; then
+        echo "ERROR: $DOCS_PARTITION is not a valid block device."
+        exit 1
+    fi
+fi
+
+echo "✓ Found encrypted partition: $DOCS_PARTITION"
+echo ""
+
+echo "Step 2: Creating mount point..."
+# Mount in user's home directory for easy access
+MOUNT_POINT="$HOME/SecureStorage"
+mkdir -p "$MOUNT_POINT"
+echo "✓ Mount point ready at: $MOUNT_POINT"
+echo ""
+
+echo "Step 3: Mounting encrypted volume..."
+echo "You will now be prompted for your encryption password."
+echo ""
+
+# Mount the encrypted volume
+if sudo veracrypt --text --mount "$DOCS_PARTITION" "$MOUNT_POINT"; then
+    echo ""
+    echo "Setting correct permissions..."
+
+    # Change ownership of the mount point to current user
+    # This allows the user to read/write files
+    sudo chown $USER:$USER "$MOUNT_POINT"
+
+    # If there are already files, change their ownership too
+    if [ "$(ls -A $MOUNT_POINT 2>/dev/null)" ]; then
+        sudo chown -R $USER:$USER "$MOUNT_POINT"/*
+    fi
+
+    echo "✓ Permissions set for user access"
+
+    echo ""
+    echo "======================================================================"
+    echo "                           SUCCESS!"
+    echo "======================================================================"
+    echo ""
+    echo "Your secure storage is now accessible at:"
+    echo "    $MOUNT_POINT"
+    echo ""
+    echo "Easy access:"
+    echo "  • Open file manager and go to Home folder"
+    echo "  • Look for 'SecureStorage' folder"
+    echo "  • Or in terminal: cd ~/SecureStorage"
+    echo ""
+    echo "You can now:"
+    echo "  • Drag and drop files"
+    echo "  • Edit documents"
+    echo "  • Create new folders"
+    echo ""
+    echo "IMPORTANT: When finished, run:"
+    echo "    sudo ./lock_storage.sh"
+    echo ""
+    echo "======================================================================"
+else
+    echo ""
+    echo "======================================================================"
+    echo "                       MOUNT FAILED"
+    echo "======================================================================"
+    echo ""
+    echo "Possible reasons:"
+    echo "  • Wrong password"
+    echo "  • Wrong partition selected"
+    echo "  • Volume already mounted"
+    echo "  • veracrypt not installed"
+    echo ""
+    echo "Troubleshooting:"
+    echo "  1. Check if already mounted: mount | grep secure_storage"
+    echo "  2. Try unmounting first: sudo veracrypt -d"
+    echo "  3. Verify veracrypt: which veracrypt"
+    echo ""
+    rmdir "$MOUNT_POINT" 2>/dev/null
+    exit 1
+fi

tools/veracrypt/DOWNLOAD_INSTRUCTIONS.md

@@ -0,0 +1,93 @@
+# Portable VeraCrypt Setup Instructions
+
+Before running the main tool, you need to download portable VeraCrypt binaries.
+These will be copied to the TOOLS partition so the device works on any computer.
+
+## Required Downloads
+
+Download the following files and place them in this directory (`tools/veracrypt/`):
+
+### 1. Windows Portable (REQUIRED)
+- **File**: `VeraCrypt Portable.exe`
+- **URL**: https://www.veracrypt.fr/en/Downloads.html
+- **Section**: "Portable" under Windows
+- **Size**: ~30 MB
+- **Rename to**: `VeraCrypt-Portable-Windows.exe`
+
+### 2. Linux Portable (REQUIRED)
+- **Option A - GUI version**:
+  - Download from: https://www.veracrypt.fr/en/Downloads.html
+  - Generic Installer: `veracrypt-*-setup.tar.bz2`
+  - Extract and place: `veracrypt-*-setup-gui-x64`
+  - **Rename to**: `VeraCrypt-Portable-Linux`
+
+- **Option B - Console only**:
+  - Download: `veracrypt-*-setup-console-x64`
+  - **Rename to**: `VeraCrypt-Portable-Linux-Console`
+
+### 3. macOS Portable (OPTIONAL)
+- **File**: `VeraCrypt_*.dmg`
+- **URL**: https://www.veracrypt.fr/en/Downloads.html
+- **Note**: Not truly "portable" but can be included for reference
+- **Rename to**: `VeraCrypt-MacOS.dmg`
+
+### 4. Android APK (OPTIONAL but recommended)
+- **Source**: https://github.com/veracrypt/VeraCrypt/releases
+- **Alternative**: EDS Lite from Play Store (can't include, user must download)
+- **Note**: Android apps can't be "portable" but having APK helps
+
+## Quick Download Script
+
+Run this to download automatically (Linux):
+
+```bash
+cd tools/veracrypt/
+
+# Windows Portable
+wget https://launchpad.net/veracrypt/trunk/1.26.7/+download/VeraCrypt_Portable_1.26.7.exe \
+  -O VeraCrypt-Portable-Windows.exe
+
+# Linux Console
+wget https://launchpad.net/veracrypt/trunk/1.26.7/+download/veracrypt-console-1.26.7-Ubuntu-22.04-amd64.deb \
+  -O veracrypt-linux.deb
+ar x veracrypt-linux.deb
+tar xf data.tar.xz
+cp usr/bin/veracrypt VeraCrypt-Portable-Linux
+chmod +x VeraCrypt-Portable-Linux
+rm -rf usr/ *.tar.* *.deb
+
+# macOS
+wget https://launchpad.net/veracrypt/trunk/1.26.7/+download/VeraCrypt_1.26.7.dmg \
+  -O VeraCrypt-MacOS.dmg
+
+echo "✓ Downloads complete!"
+```
+
+## Verification
+
+After downloading, your `tools/veracrypt/` directory should contain:
+
+```
+tools/veracrypt/
+├── DOWNLOAD_INSTRUCTIONS.md (this file)
+├── VeraCrypt-Portable-Windows.exe  (~30 MB)
+├── VeraCrypt-Portable-Linux        (~3-5 MB)
+└── VeraCrypt-MacOS.dmg             (~40 MB) [optional]
+```
+
+## Notes
+
+- **Total size**: ~70-80 MB for all platforms
+- **License**: VeraCrypt is open source (Apache 2.0 / TrueCrypt License 3.0)
+- **Updates**: Check veracrypt.fr periodically for newer versions
+- These portable versions allow accessing your encrypted partition on ANY computer without installing software
+
+## After Downloading
+
+Once you have the files in place, run the main setup script:
+
+```bash
+sudo python3 covert_sd_card_tool.py -d /dev/sdX -a -t /path/to/tails.iso
+```
+
+The script will automatically copy these portable versions to the TOOLS partition.