To decrypt files from a full disk encrypted Linux drive to an external USB drive in Pop!_OS, you must first ensure the internal drive is unlocked and mounted at boot. Then, simply copy the files using standard tools like cp or rsync. The operating system automatically handles decryption on-the-fly for the user session, making the process transparent without requiring manual cryptographic operations.
Understanding Full Disk Encryption Behavior
When you enable Full Disk Encryption (FDE) during the installation of Pop!_OS, the entire partition is encrypted using LUKS (Linux Unified Key Setup). This means that no data can be read or written unless the encryption key is provided at boot time. Once you enter your password and the system successfully unlocks the volume, the underlying block device is decrypted and presented as a standard file system to the kernel.
This architectural design ensures that security is maintained while the machine is off or locked, but it does not require ongoing manual intervention for every file operation. For the active user session, the files appear as if they are stored on a regular, unencrypted drive. Consequently, copying files to another location, such as an external USB drive formatted with NTFS, is treated exactly like copying any other data within your home directory.
Preparing the External USB Drive
Before initiating the transfer, it is crucial to verify that your external USB drive is properly recognized and has sufficient space. Connect the drive to your Pop!_OS machine and open the Files application (GNOME Files/Nautilus). You should see the external drive listed in the sidebar under "Other Locations" or directly in the main window depending on your configuration.
If the drive is new or previously formatted for Windows, it likely uses the NTFS file system. Pop!_OS supports NTFS out of the box via the ntfs-3g driver, which allows both reading and writing. However, always check the available space by right-clicking the drive and selecting Properties. Ensure there is enough room for all the files you intend to transfer, including overhead for metadata.
If the drive does not appear, you may need to mount it manually. Open a terminal and use the command lsblk to identify the device name, typically something like sdb1. Create a mount point with sudo mkdir /mnt/usb and then mount it using sudo mount /dev/sdb1 /mnt/usb. Verify accessibility by listing the contents with ls /mnt/usb.
Copying Files Using the Graphical Interface
The simplest method for most users is to use the graphical file manager. Navigate to the folder containing the files you wish to decrypt and export. Since the internal drive is already unlocked, these files are accessible in their plain text form. Select the desired files or folders, right-click, and choose Copy.
Navigate to the external USB drive in the sidebar or address bar. Right-click inside the destination folder and select Paste. The system will begin transferring the data. Because the source files are being read in plaintext due to the active decryption layer, and the destination is a standard file system, no additional decryption steps are required. The integrity of the files is preserved because the bits read from the decrypted volume are identical to the original unencrypted data.
For large transfers, monitor the progress bar in the file manager. If the transfer seems slow, it may be due to the speed of the USB port (e.g., USB 2.0 vs. USB 3.0) or the type of storage media (HDD vs. SSD). Refer to related troubleshooting guides if you encounter performance issues, such as those discussed in Fix Extremely Slow Boot Times in Pop!_OS 22.04 with Dual Boot Fedora Atomic, although that focuses on boot speed, general I/O bottlenecks can sometimes share similar diagnostic paths.
Copying Files Using the Command Line
For advanced users or scripts, the command line offers more control and feedback. Use the cp command for simple copies or rsync for more robust transfers that support resuming interrupted processes. To copy a directory recursively, you might use:
cp -r /path/to/source/folder /path/to/external/drive/destinationUsing rsync provides a progress bar and verifies data integrity after the transfer:
rsync -avz /path/to/source/folder/ /path/to/external/drive/destination/Note the trailing slash in the source path; this ensures the contents of the directory are copied rather than the directory itself. Always verify the destination files after the transfer completes by comparing file sizes or checksums if high fidelity is required.
Safety and Best Practices
While the decryption happens automatically, always ensure your system is stable during the copy process. Sudden power loss or unplugging the USB drive mid-transfer can corrupt the data on the external drive. It is also advisable to eject the USB drive safely through the file manager or using the umount command before physically disconnecting it.
If you encounter permission errors, ensure you are running the commands as your user account, not root, unless specifically necessary. In rare cases where you cannot access certain system directories, you may need to adjust permissions, but for personal files in /home, standard user privileges are sufficient.
Frequently Asked Questions
Do I need to manually decrypt each file?
No, manual decryption is not required. Once the system is booted and the full disk encryption is unlocked with your password, all files are accessible in plaintext. Copying them to an external drive is a standard file operation.
Will the external drive become encrypted after copying?
No, the external drive will remain in its original format (e.g., NTFS, FAT32, or exFAT). The files copied onto it will be unencrypted because they were read from the decrypted internal volume. They will only be readable on machines that can mount the specific file system.
What if the external drive is not recognized?
Check if the drive is powered on and connected securely. Use lsblk in the terminal to see if the kernel detects the device. If detected but not mounted, create a mount point and use sudo mount to attach it manually.
Can I copy files while the system is locked?
No, you cannot access files while the system is locked because the disk remains encrypted. You must unlock the drive at login to perform any file operations. Copying requires the active decryption keys held in memory.
Is it safe to leave the USB drive plugged in after copying?
It is generally safe, but for best practices, you should eject the drive safely via the GUI or umount command to prevent data corruption. Leaving it plugged in does not compromise the security of the internal encrypted drive.