这是一项非常危险的操作,应该谨慎执行.
在最简化的级别,有一个名为cryptsetup-reencrypt的实用程序允许此操作.它明确地在其手册页中调用:
WARNING: The cryptsetup-reencrypt program is not resistant to
hardware or kernel failures during reencryption (you can lose your
data in this case).
ALWAYS BE SURE YOU HAVE RELIABLE BACKUP BEFORE USING THIS TOOL.
The reencryption can be temporarily suspended (by TERM signal or by
using ctrl+c) but you need to retain temporary files named
LUKS-.[log|org|new]. LUKS device is unavailable until
reencryption is finished though.
根据手册页的“示例”部分:
Remove LUKS encryption completely
cryptsetup-reencrypt /dev/sdb1 --decrypt
这可能需要从“实时”环境(这意味着完全运行的短暂Linux环境,如Fedora Live或Ubuntu Live提供的环境)完成.
作为此工作流的替代方法,您还可以采用更明确的方式备份数据,删除分区并重新创建分区. Arch Linux提供了有关此工作流程的出色文档以及其他故障排除步骤:
同样,应该强调的是,这不是一个简单的操作,并且在发生灾难性故障时,所有数据的备份都是最重要的.