Added resume function and checkpoints for broken

setups

.gitignore

@@ -1 +1,61 @@
-*.log
+# Python cache and bytecode
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+*.backup
+.claude
+
+# Log files - may contain sensitive paths/device info
+*.log
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+
+# Virtual environments
+venv/
+env/
+ENV/
+.venv
+
+# IDE and editor files
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store
+
+# Testing
+.pytest_cache/
+.coverage
+htmlcov/
+
+# Claude docs
+.claude_docs
+
+# Sensitive files that should never be committed
+*.iso
+*.img
+*.key
+*.pem
+*.p12
+*.pfx
+test_*
+*.bak
+*.backup

README.md

@@ -0,0 +1,334 @@
+# Covert SD Card Tool
+
+## Introduction
+
+The **Covert SD Card Tool** is a Python script designed to automate the process of setting up a bootable USB/SD card with either Kali Linux or Tails OS. It includes options to create encrypted persistence partitions, secure document storage, and user-friendly access scripts. This tool simplifies the complex steps involved in preparing a secure, portable operating system on a USB drive or SD card.
+
+## Features
+
+- **Install Kali Linux or Tails OS** on a USB/SD card
+- **Create an encrypted persistence partition** for Kali Linux (LUKS encryption)
+- **Create a maximum-security encrypted documents partition** with triple-cascade encryption
+- **Secure drive wiping** using multi-pass shred for data sanitization
+- **User-friendly access scripts** for mounting and locking secure storage
+- **OPSEC-focused design** - generated scripts use generic terminology
+- **Automated dependency checking and installation**
+
+## Prerequisites
+
+- **Operating System:** Linux (Debian-based distributions recommended)
+- **Python Version:** Python 3.x
+- **Root Access:** Required for disk operations
+- **Dependencies:**
+  - `parted` - Partition management
+  - `cryptsetup` - LUKS encryption
+  - `lsblk` - Block device listing
+  - `dd` - Disk writing
+  - `sgdisk` - GPT partition manipulation
+  - `wipefs` - Filesystem signature removal
+  - `shred` - Secure data wiping
+  - `bc` - Calculator for partition math
+  - `fdisk` - Partition table manipulation
+  - `veracrypt` - Document partition encryption
+  - `lsof`, `fuser` - Process detection
+  - `udevadm` - Device management
+
+**Note:** The script will automatically detect missing dependencies and offer to install them.
+
+## Installation
+
+1. **Clone the Repository or Download the Script:**
+
+   ```bash
+   git clone https://github.com/yourusername/covert_sd_card_tool.git
+   cd covert_sd_card_tool
+   ```
+
+2. **Make the Script Executable:**
+
+   ```bash
+   chmod +x covert_sd_card_tool.py
+   ```
+
+## Usage
+
+Run the script with appropriate options:
+
+```bash
+sudo ./covert_sd_card_tool.py [options]
+```
+
+### Command-Line Options
+
+- `-a`, `--all` : Set up both the OS bootable USB and the documents partition (defaults to Kali)
+- `-k`, `--kali` : Create a Kali bootable USB and persistence partition
+- `-t`, `--tails` : Create a Tails bootable USB (no persistence, mutually exclusive with `-a`)
+- `-c`, `--custom` : Create a custom ISO bootable USB (uses Kali-style partitioning with persistence)
+- `-d`, `--docs` : Create an encrypted documents partition
+- `-i`, `--iso` : Path to the ISO file (Kali, Tails, or custom)
+- `--fast` : Enable fast setup mode (weaker encryption, faster setup - not recommended)
+- `--paranoid` : Enable paranoid mode (maximum security: 3-pass wipe, Argon2id, PIM 5000)
+- `--debug` : Enable debug mode with verbose logging
+
+**Note:** `--fast` and `--paranoid` are mutually exclusive. Documents partition always uses strong encryption even in fast mode.
+
+### Examples
+
+- **Install Kali with Encrypted Persistence and Encrypted Documents Partition:**
+
+  ```bash
+  sudo ./covert_sd_card_tool.py -a -i /path/to/kali.iso
+  ```
+
+- **Install Tails with Encrypted Documents Partition:**
+
+  ```bash
+  sudo ./covert_sd_card_tool.py -t -d -i /path/to/tails.iso
+  ```
+
+- **Install Tails Only (No Documents Partition):**
+
+  ```bash
+  sudo ./covert_sd_card_tool.py -t -i /path/to/tails.iso
+  ```
+
+- **Create Encrypted Documents Partition Only (No OS):**
+
+  ```bash
+  sudo ./covert_sd_card_tool.py -d
+  ```
+
+- **Install Custom ISO (e.g., Parrot OS, BlackArch) with Persistence and Documents:**
+
+  ```bash
+  sudo ./covert_sd_card_tool.py -c -d -i /path/to/custom.iso
+  ```
+
+- **Install Custom ISO with Persistence Only (No Documents):**
+
+  ```bash
+  sudo ./covert_sd_card_tool.py -c -i /path/to/custom.iso
+  ```
+
+- **Paranoid Mode - Maximum Security (Tails + Docs):**
+
+  ```bash
+  sudo ./covert_sd_card_tool.py -t -d -i /path/to/tails.iso --paranoid
+  ```
+
+## Security Features
+
+### Documents Partition Encryption
+
+The documents partition uses **strong security** in all modes:
+
+**Standard Mode (default):**
+- **Triple Cascade Encryption:** AES-Twofish-Serpent (3 layers)
+- **Hash Algorithm:** SHA-512
+- **Key Derivation:** PIM 2000 (strong key stretching)
+- **Unlock Time:** ~2-3 seconds
+- **Filesystem:** ext4
+- **Full Format:** Always overwrites old data
+
+**Paranoid Mode (`--paranoid`):**
+- **Triple Cascade Encryption:** AES-Twofish-Serpent (3 layers)
+- **Hash Algorithm:** SHA-512
+- **Key Derivation:** PIM 5000 (maximum key stretching)
+- **Unlock Time:** ~5-7 seconds
+- **Security:** Would take trillions of years to brute force
+
+**Fast Mode (`--fast`):**
+- Documents still use standard mode (PIM 2000) - no compromise on docs security
+
+### Persistence Partition Encryption (Kali/Custom)
+
+**Standard Mode (default):**
+- **Algorithm:** AES-XTS-PLAIN64
+- **Key Size:** 512-bit
+- **Hash:** SHA-512
+- **KDF:** LUKS2 PBKDF2
+- **Iteration Time:** 5 seconds
+
+**Paranoid Mode (`--paranoid`):**
+- **Algorithm:** AES-XTS-PLAIN64
+- **Key Size:** 512-bit
+- **Hash:** SHA-512
+- **KDF:** LUKS2 Argon2id (memory-hard, GPU-resistant)
+- **Memory:** 1GB
+- **Parallel Threads:** 4
+- **Iteration Time:** 10 seconds
+
+**Fast Mode (`--fast`):**
+- **Algorithm:** AES-CBC-ESSIV:SHA256
+- **Key Size:** 256-bit
+- **Hash:** SHA-256
+- **KDF:** LUKS1 PBKDF2
+- **Iteration Time:** 1 second
+
+### Secure Drive Wiping
+
+**Standard Mode (default):**
+- **1 pass** with zeros (`dd if=/dev/zero`)
+- Fast and sufficient for most use cases
+- Prevents casual data recovery
+- Confirmation required (must type 'WIPE')
+
+**Paranoid Mode (`--paranoid`):**
+- **3 passes** with random data (`shred`)
+- **Final pass** with zeros
+- Makes data recovery virtually impossible
+- Defense against forensic recovery techniques
+- **Much slower** (can take hours on large drives)
+- Confirmation required (must type 'WIPE')
+
+### OPSEC (Operational Security)
+
+The generated helper scripts use **generic terminology** to avoid disclosing encryption methods:
+
+- Scripts renamed to `mount_storage.sh` and `lock_storage.sh` (instead of mentioning encryption types)
+- README uses terms like "secure storage" instead of specific encryption names
+- No algorithm disclosure in user-facing documentation on the device
+- Suitable for travel scenarios where device inspection may occur
+
+## Generated Helper Scripts
+
+The tool creates a small unencrypted partition (TOOLS) containing:
+
+### `mount_storage.sh`
+- Interactive script to mount the encrypted documents partition
+- Shows available devices and validates input
+- Mounts to `/mnt/secure_storage`
+- Clear error messages and success confirmations
+
+### `lock_storage.sh`
+- Safely dismounts and locks the encrypted storage
+- Checks for open files before locking
+- Shows warnings if applications are still using the storage
+- Syncs pending writes before dismount
+- Prevents data loss from improper ejection
+
+### `README.txt`
+- Simple instructions for non-technical users
+- Generic terminology (no encryption disclosure)
+- Step-by-step mount/lock procedures
+
+## Security Mode Comparison
+
+| Feature | Fast Mode | Standard Mode (Default) | Paranoid Mode |
+|---------|-----------|------------------------|---------------|
+| **Drive Wipe** | Partition table clear only | 1-pass zeros | 3-pass shred + zeros |
+| **Wipe Time (64GB)** | Instant | ~5-10 min | ~2-3 hours |
+| **Persistence KDF** | LUKS1 PBKDF2 | LUKS2 PBKDF2 | LUKS2 Argon2id |
+| **Persistence Unlock** | ~1 sec | ~5 sec | ~10 sec |
+| **Docs Encryption** | AES-Twofish-Serpent | AES-Twofish-Serpent | AES-Twofish-Serpent |
+| **Docs PIM** | 2000 | 2000 | 5000 |
+| **Docs Unlock** | ~2-3 sec | ~2-3 sec | ~5-7 sec |
+| **Best For** | Testing/dev | Travel, daily use | Maximum security, high-value targets |
+
+**Recommendation:** Use **standard mode** for most cases. Use **paranoid mode** if:
+- You're protecting extremely sensitive data
+- You face nation-state level threats
+- You have time for longer setup and unlock times
+- You want defense against forensic analysis
+
+## Important Security Notes
+
+⚠️ **Password Strength:** Use strong passphrases (20+ characters, mixed case, numbers, symbols)
+
+⚠️ **No Password Recovery:** If you forget your password, your data is **permanently inaccessible**
+
+⚠️ **PIM Value:** The tool enforces PIM 2000 for documents partition - this adds 2-3 seconds to unlock time but massively increases security
+
+⚠️ **Always Lock Before Removal:** Use `lock_storage.sh` before removing the device to prevent data corruption
+
+⚠️ **Fast Mode:** While available for persistence partition, documents partition **always uses maximum security**
+
+## Partition Layout Examples
+
+### Kali + Documents (`-a`)
+1. **Partition 1:** Kali Live OS (bootable)
+2. **Partition 2:** LUKS encrypted persistence (configurable size, e.g., 4GB)
+3. **Partition 3:** VeraCrypt encrypted documents (remaining space minus 1GB)
+4. **Partition 4:** Unencrypted tools partition (1GB, FAT32, contains scripts)
+
+### Tails Only (`-t`)
+- **Entire Drive:** Tails Live OS (bootable, no additional partitions)
+
+### Tails + Documents (`-t -d`)
+1. **Partition 1:** Tails Live OS (bootable, 12MB EFI System)
+2. **Partition 2:** Tails system partition (~2-3GB depending on Tails version)
+3. **Partition 3:** VeraCrypt encrypted documents (remaining space minus 1GB)
+4. **Partition 4:** Unencrypted tools partition (1GB, FAT32, contains scripts)
+
+### Documents Only (`-d`)
+1. **Partition 1:** VeraCrypt encrypted documents (remaining space minus 1GB)
+2. **Partition 2:** Unencrypted tools partition (1GB, FAT32, contains scripts)
+
+### Custom ISO + Documents (`-c -d`)
+1. **Partition 1:** Custom Live OS (bootable)
+2. **Partition 2:** LUKS encrypted persistence (configurable size, e.g., 4GB)
+3. **Partition 3:** VeraCrypt encrypted documents (remaining space minus 1GB)
+4. **Partition 4:** Unencrypted tools partition (1GB, FAT32, contains scripts)
+
+**Note:** Custom ISO mode uses Kali-style partitioning. Works well with Debian-based live ISOs like Parrot OS, BlackArch, BackBox, etc.
+
+## Using Custom ISOs
+
+The `-c` (custom) flag allows you to use **any bootable ISO** and set it up with encrypted persistence and documents partitions. This is useful for:
+
+### Compatible ISOs
+- **Parrot Security OS** - Privacy-focused security distro
+- **BlackArch Linux** - Penetration testing distro
+- **BackBox** - Ubuntu-based penetration testing
+- **Pentoo** - Gentoo-based security distro
+- **Any Debian/Ubuntu-based live ISO**
+
+### How It Works
+Custom ISOs are treated like Kali Linux:
+1. ISO is flashed to the drive
+2. LUKS encrypted persistence partition is created (if you want settings to persist)
+3. VeraCrypt encrypted documents partition is added (if `-d` flag is used)
+4. Tools partition with mount/lock scripts
+
+### Example: Parrot OS with Docs
+```bash
+sudo ./covert_sd_card_tool.py -c -d -i ~/Downloads/parrot-security.iso
+```
+
+### Compatibility Notes
+- **Best for:** Debian/Ubuntu-based live ISOs
+- **May not work with:** Arch-based ISOs (different partition structure), Windows ISOs
+- **Persistence:** Depends on the ISO supporting LUKS persistence (Debian-based usually do)
+- If persistence doesn't work with your ISO, you can still use the documents partition
+
+## Troubleshooting
+
+### Device Busy Errors
+- The tool automatically unmounts partitions and kills processes using the drive
+- If problems persist, manually unmount: `sudo umount /dev/sdX*`
+- Check for processes: `sudo lsof /dev/sdX`
+
+### VeraCrypt Not Found
+- On Debian/Ubuntu: `sudo apt install veracrypt`
+- Or the script will offer to install it automatically
+
+### Permission Denied
+- Always run with `sudo`
+- Ensure your user has sudo privileges
+
+### Drive Not Detected
+- Check if drive is connected: `lsblk`
+- Verify drive path (e.g., `/dev/sdb` not `/dev/sdb1`)
+- Try unplugging and reconnecting the device
+
+## License
+
+This tool is provided as-is for educational and legitimate security purposes only. Use responsibly and in compliance with applicable laws.
+
+## Contributing
+
+Contributions, bug reports, and feature requests are welcome! Please open an issue or submit a pull request.
+
+## Disclaimer
+
+This tool performs destructive operations on storage devices. **Always verify you've selected the correct drive** before proceeding. The authors are not responsible for data loss.

tools/MOBILE_INSTRUCTIONS.txt

@@ -0,0 +1,239 @@
+======================================================================
+          SECURE STORAGE - MOBILE DEVICE INSTRUCTIONS
+======================================================================
+
+IMPORTANT: Mobile access has limitations compared to desktop.
+Read carefully to understand what's possible on your device.
+
+======================================================================
+ANDROID DEVICES
+======================================================================
+
+REQUIREMENTS:
+  • Android 5.0 or newer
+  • EDS (Encrypted Data Store) app - REQUIRED
+  • USB OTG adapter (to connect USB device to phone)
+  • File manager app (most phones have one built-in)
+
+REQUIRED APP:
+  • EDS Lite (Free & Open Source)
+  • Google Play: https://play.google.com/store/apps/details?id=com.sovworks.eds.android
+  • Direct link if Google Play doesn't work:
+    https://play.google.com/store/apps/details?id=com.sovworks.projecteds
+
+----------------------------------------------------------------------
+SETUP: Using EDS Lite (RECOMMENDED)
+----------------------------------------------------------------------
+
+Step 1: Install EDS Lite
+        • Open Google Play Store
+        • Search for "EDS Lite" or "EDS (Encrypted Data Store)"
+        • Install the app (it's FREE)
+        • Or use the direct link above
+
+Step 2: Connect your USB device
+        • Connect USB device using OTG adapter
+        • Android should show "USB device connected" notification
+
+Step 3: Open EDS Lite app
+        • Tap "Open container"
+        • Navigate to your USB device
+        • Look for the partition WITHOUT a filesystem/label
+        • Select the encrypted partition
+
+Step 4: Enter password
+        • Select encryption: VeraCrypt
+        • Enter your password
+        • For PIM: enter 2000 or 5000 (whatever you set)
+        • Tap "OK"
+
+Step 5: Access your files
+        • Files will appear in EDS Lite
+        • You can view, copy, or share files
+        • Some apps can open files directly from EDS
+
+IMPORTANT - Safely Close:
+        • Tap "Close container" when done
+        • Wait for confirmation before unplugging
+        • Only then remove USB device
+
+----------------------------------------------------------------------
+ALTERNATIVE: VeraCrypt for Android (Advanced Users)
+----------------------------------------------------------------------
+
+ℹ️ NOTE: EDS Lite (above) is easier to use and recommended.
+   Only use VeraCrypt if you're familiar with it.
+
+Step 1: Install VeraCrypt for Android
+        • Download from: https://github.com/veracrypt/veracrypt
+        • Or install from F-Droid store
+        • Enable "Unknown sources" if needed
+
+Step 2-5: Follow similar steps as EDS Lite above
+        • The interface is similar to desktop VeraCrypt
+        • Process is the same: select partition, enter password, mount
+
+======================================================================
+iOS DEVICES (iPhone/iPad)
+======================================================================
+
+✅ SOLUTION: Crypto Disks App (Paid)
+
+RECOMMENDED APP:
+  • Crypto Disks - Store Private Files Securely
+  • App Store: https://apps.apple.com/us/app/crypto-disks-store-private/id889549308
+  • Price: ~$4.99 (one-time purchase)
+  • Supports VeraCrypt containers!
+
+----------------------------------------------------------------------
+SETUP: Using Crypto Disks on iOS
+----------------------------------------------------------------------
+
+Step 1: Purchase and Install Crypto Disks
+        • Open App Store on your iPhone/iPad
+        • Search for "Crypto Disks"
+        • Or use the direct link above
+        • Purchase and install (~$4.99)
+
+Step 2: Transfer Encrypted Container
+        ⚠️ LIMITATION: iOS doesn't support direct USB access like Android
+
+        You have two options:
+
+        OPTION A: Copy via Computer (Easier)
+        1. Connect USB device to your Mac/PC
+        2. Mount the encrypted partition with VeraCrypt
+        3. Create a smaller VeraCrypt container file inside
+        4. Transfer that container to your iPhone via:
+           - AirDrop (Mac to iPhone)
+           - iCloud Drive
+           - iTunes File Sharing
+        5. Open in Crypto Disks app
+
+        OPTION B: Use Wi-Fi File Transfer
+        1. Use Crypto Disks' built-in file transfer
+        2. Transfer container file from computer
+        3. Open in app
+
+Step 3: Mount in Crypto Disks App
+        • Open Crypto Disks app
+        • Select "Add Disk Image"
+        • Choose your transferred container
+        • Enter password and PIM
+        • Access your files
+
+⚠️ IMPORTANT iOS LIMITATIONS:
+   • Cannot directly mount USB partition (Apple restriction)
+   • Must use container FILES, not raw partitions
+   • Requires copying/transferring container to iPhone
+   • Best for occasional access, not primary use
+
+----------------------------------------------------------------------
+iOS WORKAROUND: Emergency Access Only
+----------------------------------------------------------------------
+
+If you don't want to pay for Crypto Disks, here are free alternatives:
+
+Option A: Use a Computer as Bridge
+        1. Mount the encrypted storage on your Mac/PC
+        2. Copy files you need to iCloud or Files app
+        3. Access those files from your iPhone
+        4. Delete copies when done (IMPORTANT for security!)
+
+Option B: Use Remote Access
+        1. Mount encrypted storage on your home computer
+        2. Set up secure remote access (VPN + file sharing)
+        3. Access files remotely from iPhone
+        4. More complex but maintains security
+
+Option C: Take Photos of Documents
+        1. If you just need to VIEW travel docs in emergency
+        2. Take photos/screenshots on computer
+        3. Store in encrypted note app (Apple Notes with lock)
+        4. Delete after trip
+
+NOTE: These workarounds compromise security slightly.
+      Crypto Disks app is the most secure iOS solution.
+
+======================================================================
+IMPORTANT SECURITY NOTES FOR MOBILE
+======================================================================
+
+⚠ Screen Lock
+   • Always have a PIN/password on your phone
+   • If someone steals your phone while storage is mounted,
+     they can access your files
+
+⚠ App Permissions
+   • Only grant necessary permissions to encryption apps
+   • Be cautious with "file access" permissions
+
+⚠ Public WiFi
+   • Don't use public WiFi when accessing sensitive files
+   • Or use a VPN if you must
+
+⚠ Battery Concerns
+   • Don't let your phone die while storage is mounted
+   • Always properly close/dismount before battery runs out
+
+⚠ Background Apps
+   • Close the encryption app properly when done
+   • Don't just switch to another app
+   • Storage might stay mounted in background
+
+⚠ Phone Updates
+   • Close encrypted storage before major OS updates
+   • Updates might interrupt and cause corruption
+
+======================================================================
+TROUBLESHOOTING - ANDROID
+======================================================================
+
+"Cannot find USB device"
+  • Try a different OTG adapter
+  • Check if your phone supports USB OTG
+  • Some phones need USB settings changed (File Transfer mode)
+
+"Wrong password" (but password is correct)
+  • Make sure you selected "VeraCrypt" as encryption type
+  • Verify PIM value (2000 or 5000)
+  • Some apps don't support all VeraCrypt settings
+
+"App crashes when mounting"
+  • Try a different encryption app (EDS vs VeraCrypt)
+  • Check if partition is already mounted
+  • Restart phone and try again
+
+"Can't edit files, only view"
+  • This is normal for some apps
+  • Copy file to phone storage
+  • Edit it there
+  • Copy back when done
+
+"Storage disconnected unexpectedly"
+  • Check USB connection
+  • Some phones cut power to USB to save battery
+  • Disable battery optimization for the encryption app
+
+======================================================================
+LIMITATIONS OF MOBILE ACCESS
+======================================================================
+
+Things that DON'T work well on mobile:
+  ✗ Editing large files directly on encrypted storage
+  ✗ Running programs/apps from encrypted storage
+  ✗ Fast file operations (mobile is slower than desktop)
+  ✗ iOS access (not supported at all)
+
+Things that WORK WELL on mobile:
+  ✓ Viewing documents (PDFs, photos, etc.)
+  ✓ Copying individual files to phone
+  ✓ Sharing files to other apps
+  ✓ Emergency access when no computer available
+  ✓ Quick lookup of information
+
+RECOMMENDATION:
+  Use mobile access for emergencies and viewing only.
+  Use desktop (Linux/Windows) for actual file management.
+
+======================================================================

tools/README.txt

@@ -0,0 +1,194 @@
+======================================================================
+              SECURE STORAGE - QUICK START GUIDE
+======================================================================
+
+WHAT'S ON THIS DEVICE:
+  • Encrypted storage partition for sensitive documents
+  • Portable VeraCrypt (works on ANY computer - no installation!)
+  • Helper scripts (Linux/Mac)
+  • Instructions for Windows and mobile devices
+
+======================================================================
+ACCESSING YOUR FILES - QUICK GUIDE
+======================================================================
+
+LINUX / MAC:
+  1. Open terminal in this folder
+  2. Run: sudo ./mount_storage.sh
+  3. Enter your password
+  4. Files appear in: ~/SecureStorage
+
+WINDOWS:
+  1. Open "WINDOWS_INSTRUCTIONS.txt" on this device
+  2. Follow the step-by-step guide
+  3. Use portable VeraCrypt from "VeraCrypt" folder (no install needed!)
+
+ANDROID:
+  1. Install "EDS Lite" from Google Play Store (FREE)
+     https://play.google.com/store/apps/details?id=com.sovworks.projecteds
+  2. Connect USB with OTG adapter
+  3. Open "MOBILE_INSTRUCTIONS.txt" for step-by-step guide
+
+iOS (iPhone/iPad):
+  1. Install "Crypto Disks" from App Store (~$4.99)
+     https://apps.apple.com/us/app/crypto-disks-store-private/id889549308
+  2. See "MOBILE_INSTRUCTIONS.txt" for setup
+  ⚠ iOS has limitations - requires copying files, can't mount USB directly
+
+======================================================================
+IMPORTANT: HOW TO SAFELY LOCK YOUR STORAGE
+======================================================================
+
+LINUX / MAC:
+  1. Close ALL programs using the secure storage
+  2. Run: sudo ./lock_storage.sh
+  3. Wait for "SUCCESS" message
+  4. Safe to remove device
+
+WINDOWS:
+  1. Close all files
+  2. In VeraCrypt, select the drive
+  3. Click "Dismount"
+  4. Use "Safely Remove Hardware"
+
+⚠ CRITICAL: ALWAYS lock/dismount before removing!
+   Otherwise you risk losing your data.
+
+======================================================================
+PORTABLE VERACRYPT - NO INSTALLATION REQUIRED!
+======================================================================
+
+Inside the "VeraCrypt" folder on this device:
+
+• VeraCrypt-Portable-Windows.exe
+    → Double-click to run on ANY Windows PC
+    → Works without admin rights on most systems
+
+• VeraCrypt-Portable-Linux.AppImage
+    → Run on ANY Linux system (no install!)
+    → Command: ./VeraCrypt-Portable-Linux.AppImage
+    → AppImage = portable, works on all Linux distributions
+
+• veracrypt-Ubuntu-22.04-amd64.deb
+    → System-wide installer for Ubuntu/Debian
+    → Install with: sudo dpkg -i veracrypt-Ubuntu-22.04-amd64.deb
+    → Use this if you prefer installed version over AppImage
+
+• VeraCrypt-MacOS.dmg
+    → Install on Mac (one-time)
+    → Works on any Mac after that
+
+This means you can access your encrypted files on ANY computer
+even if VeraCrypt is not installed!
+
+======================================================================
+YOUR PASSWORD
+======================================================================
+
+⚠ There is NO password recovery! If you forget it, data is GONE.
+
+Password details:
+  • Case-sensitive (Abc123 ≠ abc123)
+  • Minimum 20 characters recommended
+  • Mix of letters, numbers, symbols
+  • Write it down and keep it SAFE (not on this device!)
+
+If you set a PIM value:
+  • Standard setup: PIM = 2000
+  • Paranoid setup: PIM = 5000
+  • VeraCrypt will ask for this when mounting
+
+======================================================================
+TROUBLESHOOTING
+======================================================================
+
+PROBLEM: "Cannot find TOOLS partition"
+FIX: Ensure device is fully connected; try different USB port
+
+PROBLEM: "Wrong password" (but you know it's correct)
+FIX: Check if CAPS LOCK is on; verify PIM value
+
+PROBLEM: "Volume already mounted"
+FIX: Close any VeraCrypt windows and run:
+     • Linux/Mac: sudo veracrypt -d
+     • Windows: Dismount all in VeraCrypt
+
+PROBLEM: "Permission denied" when accessing files
+FIX:
+     • Linux/Mac: Re-run mount script (it sets permissions)
+     • Windows: Check if you ran VeraCrypt as administrator
+
+PROBLEM: "Files appear but I can't edit them"
+FIX:
+     • Linux/Mac: Run: sudo chown -R $USER ~/SecureStorage
+     • Windows: Right-click → Properties → Security → Edit
+
+PROBLEM: Device not detected on Android
+FIX:
+     • Check USB OTG adapter is working
+     • Enable "File Transfer" mode in USB settings
+     • Try different OTG adapter
+
+======================================================================
+FILE LOCATIONS AFTER MOUNTING
+======================================================================
+
+Linux/Mac:     ~/SecureStorage
+               (In your home folder)
+
+Windows:       Z:\ (or whatever drive letter you selected)
+               Shows in "This PC"
+
+Android:       Accessible within EDS Lite or VeraCrypt app
+
+======================================================================
+SECURITY NOTES
+======================================================================
+
+✓ Your files use military-grade encryption
+✓ AES-Twofish-Serpent triple cascade (strongest available)
+✓ Even supercomputers cannot crack this encryption
+
+⚠ The password is the ONLY key
+⚠ No backdoors, no recovery, no "forgot password" option
+⚠ Keep password safe but separate from this device
+
+Best practices:
+  • Always dismount before removing device
+  • Don't leave mounted when unattended
+  • Use strong unique password
+  • Don't store password on this device
+  • Lock your computer when storage is mounted
+
+======================================================================
+ADVANCED: MANUAL MOUNTING (if scripts fail)
+======================================================================
+
+LINUX/MAC:
+  1. Find encrypted partition:
+       lsblk -o NAME,SIZE,LABEL,FSTYPE
+       (Look for partition WITHOUT filesystem label)
+
+  2. Mount with VeraCrypt:
+       sudo veracrypt /dev/sdX2 ~/SecureStorage
+       (Replace sdX2 with your partition)
+
+  3. Enter password and PIM when prompted
+
+WINDOWS:
+  1. Open portable VeraCrypt
+  2. Select any drive letter
+  3. Click "Select Device"
+  4. Choose partition WITHOUT label (not the TOOLS one)
+  5. Click "Mount"
+  6. Enter password
+
+======================================================================
+NEED MORE HELP?
+======================================================================
+
+• Windows users: See WINDOWS_INSTRUCTIONS.txt
+• Mobile users: See MOBILE_INSTRUCTIONS.txt
+• VeraCrypt documentation: https://www.veracrypt.fr/en/Documentation.html
+
+======================================================================

tools/WINDOWS_INSTRUCTIONS.txt

@@ -0,0 +1,93 @@
+======================================================================
+           SECURE STORAGE - WINDOWS INSTRUCTIONS
+======================================================================
+
+REQUIREMENTS:
+  • This secure storage device connected
+  • NO SOFTWARE INSTALLATION NEEDED!
+
+======================================================================
+HOW TO ACCESS YOUR SECURE FILES (WINDOWS)
+======================================================================
+
+OPTION 1: USE PORTABLE VERACRYPT (RECOMMENDED - NO INSTALL!)
+
+Step 1: Open the VeraCrypt folder on this USB drive
+
+Step 2: Double-click "VeraCrypt-Portable-Windows.exe"
+        • It runs directly - no installation!
+        • Works on most Windows PCs without admin rights
+        • If blocked, right-click → "Run anyway"
+
+Step 3: The VeraCrypt window opens
+
+----------------------------------------------------------------------
+
+OPTION 2: USE INSTALLED VERACRYPT (if you prefer)
+
+Step 1: Install VeraCrypt (if not already installed)
+        • Go to https://www.veracrypt.fr/en/Downloads.html
+        • Download VeraCrypt for Windows
+        • Run the installer
+
+Step 2: Open VeraCrypt from Start Menu
+        • Search for "VeraCrypt" in Start Menu
+        • Click "VeraCrypt" to launch
+
+----------------------------------------------------------------------
+
+CONTINUING (after opening VeraCrypt either way):
+
+Step 3: Select a drive letter
+        • In VeraCrypt window, click any drive letter (e.g., Z:)
+
+Step 4: Select Volume
+        • Click "Select Device..." button
+        • Find your USB device (look for the partition WITHOUT a filesystem)
+        • Usually it's the second-to-last partition
+        • Click OK
+
+Step 5: Click "Mount" button
+        • Enter your password when prompted
+        • For PIM: leave blank or enter the PIM you set (2000 or 5000)
+        • Click OK
+
+Step 6: Access your files
+        • Open File Explorer
+        • Look for new drive (e.g., Z:)
+        • Your files are there!
+
+======================================================================
+HOW TO SAFELY LOCK YOUR STORAGE (WINDOWS)
+======================================================================
+
+Step 1: Close ALL programs using the secure storage
+        • Save documents
+        • Close File Explorer windows
+        • Close any apps with open files
+
+Step 2: In VeraCrypt window
+        • Select the mounted drive (e.g., Z:)
+        • Click "Dismount" button
+
+Step 3: Safe to remove
+        • Click "Safely Remove Hardware" in system tray
+        • Select your USB device
+        • Remove when Windows says it's safe
+
+======================================================================
+IMPORTANT NOTES
+======================================================================
+
+⚠ ALWAYS dismount before removing the device!
+   Otherwise you risk data corruption.
+
+⚠ If you forget your password, your data is GONE.
+   There is NO password recovery.
+
+⚠ Partition to select:
+   • Look in VeraCrypt's "Select Device" window
+   • Choose the partition WITHOUT a label/filesystem
+   • It's usually NOT the one labeled "TOOLS"
+
+======================================================================

tools/lock_storage.sh

@@ -0,0 +1,88 @@
+#!/bin/bash
+# Script to safely lock secure storage
+
+echo "======================================================================"
+echo "                    SECURE STORAGE LOCK TOOL"
+echo "======================================================================"
+echo ""
+
+# Mount point location
+MOUNT_POINT="$HOME/SecureStorage"
+
+# Check if storage is mounted
+if mountpoint -q "$MOUNT_POINT" 2>/dev/null || [ -d "$MOUNT_POINT" ] && sudo veracrypt --text --list | grep -q "$MOUNT_POINT"; then
+    echo "Step 1: Checking for open files..."
+
+    # Check if any processes are using the mount
+    OPEN_FILES=$(sudo lsof "$MOUNT_POINT" 2>/dev/null | tail -n +2)
+    if [ -n "$OPEN_FILES" ]; then
+        echo ""
+        echo "⚠ WARNING: Files or programs are still using the secure storage!"
+        echo ""
+        echo "Open files/processes:"
+        echo "$OPEN_FILES"
+        echo ""
+        echo "You should close these programs first to avoid data loss."
+        echo ""
+        read -p "Force close and lock anyway? (y/N): " FORCE
+        if [ "$FORCE" != "y" ] && [ "$FORCE" != "Y" ]; then
+            echo ""
+            echo "Lock cancelled. Please:"
+            echo "  1. Close all programs using the secure storage"
+            echo "  2. Save any open documents"
+            echo "  3. Run this script again"
+            exit 1
+        fi
+        echo ""
+        echo "Forcing lock (files will be closed)..."
+    else
+        echo "✓ No open files detected"
+    fi
+
+    echo ""
+    echo "Step 2: Syncing pending writes to disk..."
+    sync
+    echo "✓ All data written to disk"
+
+    echo ""
+    echo "Step 3: Dismounting encrypted volume..."
+
+    # Dismount the encrypted volume
+    if sudo veracrypt --text --dismount "$MOUNT_POINT" 2>/dev/null; then
+        rmdir "$MOUNT_POINT" 2>/dev/null
+        echo "✓ Volume dismounted"
+        echo ""
+        echo "======================================================================"
+        echo "                           SUCCESS!"
+        echo "======================================================================"
+        echo ""
+        echo "Secure storage is now locked and encrypted."
+        echo "Your data is safe to remove the device."
+        echo ""
+        echo "======================================================================"
+    else
+        echo ""
+        echo "======================================================================"
+        echo "                       DISMOUNT FAILED"
+        echo "======================================================================"
+        echo ""
+        echo "Possible reasons:"
+        echo "  • Files still in use (close all programs)"
+        echo "  • Permission denied"
+        echo "  • Volume not mounted with this script"
+        echo ""
+        echo "Troubleshooting:"
+        echo "  1. Check what's using it: sudo lsof $MOUNT_POINT"
+        echo "  2. Force dismount all: sudo veracrypt -d"
+        echo "  3. Kill processes: sudo fuser -km $MOUNT_POINT"
+        echo ""
+        exit 1
+    fi
+else
+    echo "ℹ Secure storage is not currently mounted."
+    echo ""
+    echo "Nothing to lock - your data is already secured."
+    echo ""
+    echo "If you want to access it, run:"
+    echo "    sudo ./mount_storage.sh"
+fi

tools/mount_storage.sh

@@ -0,0 +1,137 @@
+#!/bin/bash
+# Script to mount secure storage partition
+
+echo "======================================================================"
+echo "                    SECURE STORAGE MOUNT TOOL"
+echo "======================================================================"
+echo ""
+
+# Function to find the documents partition (second-to-last partition on drive)
+find_docs_partition() {
+    # Look for drives with TOOLS partition (our indicator)
+    local tools_drive=$(lsblk -ln -o NAME,LABEL | grep "TOOLS" | awk '{print $1}' | head -1)
+
+    if [ -z "$tools_drive" ]; then
+        echo "ERROR: Could not find TOOLS partition."
+        echo "Please ensure the secure storage device is connected."
+        return 1
+    fi
+
+    # Get the base drive name (remove partition number)
+    local base_drive=$(echo "$tools_drive" | sed 's/[0-9]*$//' | sed 's/p$//')
+
+    # Get all partitions on this drive
+    local partitions=$(lsblk -ln -o NAME "/dev/$base_drive" | grep "^$base_drive" | tail -n +2)
+    local part_count=$(echo "$partitions" | wc -l)
+
+    if [ "$part_count" -lt 2 ]; then
+        echo "ERROR: Not enough partitions found."
+        return 1
+    fi
+
+    # Get second-to-last partition (documents partition)
+    local docs_part=$(echo "$partitions" | tail -n 2 | head -n 1)
+    echo "/dev/$docs_part"
+    return 0
+}
+
+echo "Step 1: Detecting secure storage device..."
+DOCS_PARTITION=$(find_docs_partition)
+
+if [ $? -ne 0 ]; then
+    echo ""
+    echo "======================================================================"
+    echo "AUTO-DETECTION FAILED - MANUAL MODE"
+    echo "======================================================================"
+    echo ""
+    echo "Available partitions:"
+    lsblk -o NAME,SIZE,TYPE,LABEL,FSTYPE | grep -v "loop"
+    echo ""
+    echo "TIP: Look for a partition WITHOUT a filesystem (blank FSTYPE)"
+    echo "      This is usually your encrypted documents partition."
+    echo ""
+    read -p "Enter the partition path (e.g., /dev/sdb1): " DOCS_PARTITION
+
+    if [ -z "$DOCS_PARTITION" ]; then
+        echo "ERROR: No partition specified."
+        exit 1
+    fi
+
+    if [ ! -b "$DOCS_PARTITION" ]; then
+        echo "ERROR: $DOCS_PARTITION is not a valid block device."
+        exit 1
+    fi
+fi
+
+echo "✓ Found encrypted partition: $DOCS_PARTITION"
+echo ""
+
+echo "Step 2: Creating mount point..."
+# Mount in user's home directory for easy access
+MOUNT_POINT="$HOME/SecureStorage"
+mkdir -p "$MOUNT_POINT"
+echo "✓ Mount point ready at: $MOUNT_POINT"
+echo ""
+
+echo "Step 3: Mounting encrypted volume..."
+echo "You will now be prompted for your encryption password."
+echo ""
+
+# Mount the encrypted volume
+if sudo veracrypt --text --mount "$DOCS_PARTITION" "$MOUNT_POINT"; then
+    echo ""
+    echo "Setting correct permissions..."
+
+    # Change ownership of the mount point to current user
+    # This allows the user to read/write files
+    sudo chown $USER:$USER "$MOUNT_POINT"
+
+    # If there are already files, change their ownership too
+    if [ "$(ls -A $MOUNT_POINT 2>/dev/null)" ]; then
+        sudo chown -R $USER:$USER "$MOUNT_POINT"/*
+    fi
+
+    echo "✓ Permissions set for user access"
+
+    echo ""
+    echo "======================================================================"
+    echo "                           SUCCESS!"
+    echo "======================================================================"
+    echo ""
+    echo "Your secure storage is now accessible at:"
+    echo "    $MOUNT_POINT"
+    echo ""
+    echo "Easy access:"
+    echo "  • Open file manager and go to Home folder"
+    echo "  • Look for 'SecureStorage' folder"
+    echo "  • Or in terminal: cd ~/SecureStorage"
+    echo ""
+    echo "You can now:"
+    echo "  • Drag and drop files"
+    echo "  • Edit documents"
+    echo "  • Create new folders"
+    echo ""
+    echo "IMPORTANT: When finished, run:"
+    echo "    sudo ./lock_storage.sh"
+    echo ""
+    echo "======================================================================"
+else
+    echo ""
+    echo "======================================================================"
+    echo "                       MOUNT FAILED"
+    echo "======================================================================"
+    echo ""
+    echo "Possible reasons:"
+    echo "  • Wrong password"
+    echo "  • Wrong partition selected"
+    echo "  • Volume already mounted"
+    echo "  • veracrypt not installed"
+    echo ""
+    echo "Troubleshooting:"
+    echo "  1. Check if already mounted: mount | grep secure_storage"
+    echo "  2. Try unmounting first: sudo veracrypt -d"
+    echo "  3. Verify veracrypt: which veracrypt"
+    echo ""
+    rmdir "$MOUNT_POINT" 2>/dev/null
+    exit 1
+fi

tools/veracrypt/DOWNLOAD_INSTRUCTIONS.md

@@ -0,0 +1,93 @@
+# Portable VeraCrypt Setup Instructions
+
+Before running the main tool, you need to download portable VeraCrypt binaries.
+These will be copied to the TOOLS partition so the device works on any computer.
+
+## Required Downloads
+
+Download the following files and place them in this directory (`tools/veracrypt/`):
+
+### 1. Windows Portable (REQUIRED)
+- **File**: `VeraCrypt Portable.exe`
+- **URL**: https://www.veracrypt.fr/en/Downloads.html
+- **Section**: "Portable" under Windows
+- **Size**: ~30 MB
+- **Rename to**: `VeraCrypt-Portable-Windows.exe`
+
+### 2. Linux Portable (REQUIRED)
+- **Option A - GUI version**:
+  - Download from: https://www.veracrypt.fr/en/Downloads.html
+  - Generic Installer: `veracrypt-*-setup.tar.bz2`
+  - Extract and place: `veracrypt-*-setup-gui-x64`
+  - **Rename to**: `VeraCrypt-Portable-Linux`
+
+- **Option B - Console only**:
+  - Download: `veracrypt-*-setup-console-x64`
+  - **Rename to**: `VeraCrypt-Portable-Linux-Console`
+
+### 3. macOS Portable (OPTIONAL)
+- **File**: `VeraCrypt_*.dmg`
+- **URL**: https://www.veracrypt.fr/en/Downloads.html
+- **Note**: Not truly "portable" but can be included for reference
+- **Rename to**: `VeraCrypt-MacOS.dmg`
+
+### 4. Android APK (OPTIONAL but recommended)
+- **Source**: https://github.com/veracrypt/VeraCrypt/releases
+- **Alternative**: EDS Lite from Play Store (can't include, user must download)
+- **Note**: Android apps can't be "portable" but having APK helps
+
+## Quick Download Script
+
+Run this to download automatically (Linux):
+
+```bash
+cd tools/veracrypt/
+
+# Windows Portable
+wget https://launchpad.net/veracrypt/trunk/1.26.7/+download/VeraCrypt_Portable_1.26.7.exe \
+  -O VeraCrypt-Portable-Windows.exe
+
+# Linux Console
+wget https://launchpad.net/veracrypt/trunk/1.26.7/+download/veracrypt-console-1.26.7-Ubuntu-22.04-amd64.deb \
+  -O veracrypt-linux.deb
+ar x veracrypt-linux.deb
+tar xf data.tar.xz
+cp usr/bin/veracrypt VeraCrypt-Portable-Linux
+chmod +x VeraCrypt-Portable-Linux
+rm -rf usr/ *.tar.* *.deb
+
+# macOS
+wget https://launchpad.net/veracrypt/trunk/1.26.7/+download/VeraCrypt_1.26.7.dmg \
+  -O VeraCrypt-MacOS.dmg
+
+echo "✓ Downloads complete!"
+```
+
+## Verification
+
+After downloading, your `tools/veracrypt/` directory should contain:
+
+```
+tools/veracrypt/
+├── DOWNLOAD_INSTRUCTIONS.md (this file)
+├── VeraCrypt-Portable-Windows.exe  (~30 MB)
+├── VeraCrypt-Portable-Linux        (~3-5 MB)
+└── VeraCrypt-MacOS.dmg             (~40 MB) [optional]
+```
+
+## Notes
+
+- **Total size**: ~70-80 MB for all platforms
+- **License**: VeraCrypt is open source (Apache 2.0 / TrueCrypt License 3.0)
+- **Updates**: Check veracrypt.fr periodically for newer versions
+- These portable versions allow accessing your encrypted partition on ANY computer without installing software
+
+## After Downloading
+
+Once you have the files in place, run the main setup script:
+
+```bash
+sudo python3 covert_sd_card_tool.py -d /dev/sdX -a -t /path/to/tails.iso
+```
+
+The script will automatically copy these portable versions to the TOOLS partition.