Last updated: September 14, 2026tiCrypt 2.17.9

Create and Manage Drives

An encrypted drive is a virtual disk whose contents are encrypted with a key held by you, not by the server. A drive is not a folder in the Vault. The Vault stores individual encrypted files that you upload and download one at a time; a drive is a block device that a virtual machine mounts as an ordinary filesystem and writes to directly. Drives are the only thing that carries your data from one VM session to the next.

Why data lives on drives rather than in the VM

A virtual machine resets on every restart. tiCrypt VMs boot from a clean image, so nothing written to the guest operating system survives a shutdown. That is a deliberate defence against persistent malware, but it means a machine on its own has nowhere to keep your work. A drive is the piece that persists.

Software needs a filesystem, not a file store. Analysis tools open, seek, and append to files using ordinary system calls. They cannot work against a store that requires an explicit upload-and-download step. Mounting a drive gives applications a normal filesystem while the contents stay encrypted at rest, so no tool needs to be aware of tiCrypt at all.

The format is a permanent decision. A drive's format determines which machines can mount it: NTFS for Windows, and EXT4, BTRFS, XFS, or ZFS for Linux. You cannot reformat a drive to move it between operating systems, and NTFS drive names cannot be changed after creation because Windows BitLocker ties the encryption to the device and its name. Choose the format and the name for the machine you intend to run, not the one you are running today.

The first attached drive is special. The first drive attached to a configuration is the home drive, and it carries the VM's user database. Accounts, roles, and permissions travel with it, so moving a home drive to another configuration brings its users along. See VM Roles and Permissions.

Where drives appear inside the VM

Drives are mounted under /drives/. The first drive attached to a configuration is mounted at /drives/drive1 and is the home drive. Every drive also carries a symlink named after the drive itself, so a drive named lab-data is reachable at /drives/lab-data.

Numbers are assigned as drives are attached, and detaching a drive does not renumber the ones that remain. Both paths are stable, so either works in a script; prefer the name in anything you write down or share, because it says which drive you meant.

Drives can be attached to and detached from a VM while it is running. That is a different operation from editing the configuration, which requires the VM to be stopped.

This is the path that matters for any script you write. A job that writes its output anywhere outside /drives/ writes to the guest filesystem, which is discarded when the machine stops. Batch jobs are the common case: worker VMs are destroyed when the job ends, so results left outside /drives/ are gone before you read them.

The mount is performed by the VM Controller at boot rather than through /etc/fstab, which is why a drive appears without any entry in the image. The slot a drive is assigned is also shown under Extra Drives when you create the VM.

Before you begin

• You have the Create drives and View drive keys permissions.
• You know which operating system will mount the drive, because the format cannot be changed later.
• Your team has storage quota remaining. Drive capacity is drawn from the team allocation.

Create a New Drive

Method One

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Drives section on the top left panel.
3. Click the Create new drive in the top right corner.
4. In the prompt, enter the drive name and capacity in GB or TB.
5. Select the drive format from:
   EXT4 (Linux)
   BTRFS (Linux)
   XFS (Linux)
   ZFS (Linux)
   NTFS (Windows).
   
6. Add an optional owner, team, optional project, and realm.
7. Click Create.

Method Two

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Virtual Machines section on the top left panel.
3. In the left panel, select the virtual machine to create a new drive in.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, select the Drives section in the left panel.
6. Click Attach drive(s) icon in the top panel.
7. In the prompt, select Create a new drive.
8. In the prompt, enter the drive name and capacity in GB or TB.
9. Select the drive format from:
   EXT4 (Linux)
   BTRFS (Linux)
   XFS (Linux)
   ZFS (Linux)
   NTFS (Windows).
   
10. Add an optional owner, team, optional project, and realm.
11. Click Create.

note

• Your drive capacity depends on your allocated team resources.
• Your drive format determines what kind of VM the drive can be attached to.
• Click the Advanced options button to set the permission management status and the Cache & IO strategy for the drive.

Confirmations, Errors & Solutions

Created Drive Successfully

Created drive drive-name.

Selected NTFS (Windows) Drive Format

NTFS drive names cannot be changed after creation because Windows BitLocker ties the encryption to the device and its name. Choose the drive name carefully during creation.

Did Not Select Optional Drive Owner

Leaving this blank means you will be the owner.

Enabled No Permission Management

In Create new drive prompt, under Advanced Options you selected Enable option.

If you select this option, tiCrypt will not manage permissions for this drive. No access directories can be created on the drive and the data is not available to regular users. This option is useful if you want applications such as databases to store their data on this drive.

Did Not Enter Drive Name

You must enter a name for the drive.

Enter Drive Name

In the Create new drive prompt, enter the drive name in the Name field.

Did Not Enter Drive Capacity

You must enter a capacity for the drive.

Enter Drive Capacity

In the Create new drive prompt, enter the drive capacity in the Capacity field.

Did Not Select Drive Team

You must select a team from the autocomplete.

Select Drive Team

In the Create new drive prompt, under Relation section, enter the drive team in the Team field.

Unable to Select Backup Settings

Your back-up settings are inactive upon drive creation.

Select Libvirt Realm

In the Create new drive prompt, under the Realm section, select Libvirt as the realm.

Unable to Create Drives

Drive creation failed: Unable to perform action, missing permissions.

Create Drive Button Inactive

Create button is inactive in Drive Creation prompt.

Ask Admin for Drive Creation Permissions

Ask your admin to allow you to create drives.

To Admin

To allow a user to create drives:

1. In the Management section, click the Users section in the left panel.
2. Select the appropriate user to update permissions.
3. Click the Open Overlay button in the top right.
4. In the new window, go to the Manual permission management section.
5. Under Basic VM Interaction section, tick the Create drives permission.
6. Once done, click Save in the top center.

Attach an Existing Drive to an Existing VM

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Virtual Machines section on the top left panel.
3. In the left panel, select the virtual machine to attach the drives to.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, select the Drives section in the left panel.
6. Click Attach drive(s) icon in the top panel.
7. In the prompt, select Add a new drive.
8. Next, select the drive and the drive type.
9. Optionally, tick the box Add drive(s) to the VM configuration and share drive(s) with co-owners.
10. Click Attach and mount.

info

• A read-write drive can only be attached to a single VM. A read-only drive can be attached to multiple VMs.
• To automatically share the newly created or attached drive with the VM co-owners, tick Add drive(s) to the VM configuration and share drive(s) with co-owners box.

Confirmations, Errors & Solutions

Attached Drive Successfully

Attach/mount drive-name to vm-name(total-attaching-time).

Unable to Attach Drive

Failed at attaching-time: cannot format/encrypt read-only drive: drive-name.

If the drive is re-attached read-only or read-write, the following error appears in the prompt.

Timeout Failure to Attach Drive

Failed at attaching-time: Timeout waiting for item drive-string-id to satisfy predicate.

Ask Drive Owner to Change Drive Team

Ask the drive owner to change the drive team or increase the team quota.

To Drive Owner

To change drive team:  

1. In the Drives section, select the drive where you want to change the drive team.
2. Click the Edit drive button in the top panel list.
3. In the new window, under Relation section, select a new team.
4. Click Update.

To increase drive team quota follow the steps in  

Edit Teams' Quotas.

Missing Permissions To Attach/Mount Drive

First attempt to attach/mount home drive failed (will retry once): Unable to perform this action, missing permissions.

Ask Admin to Allow You to Attach/Mount Drives

Ask your admin to update your permissions for attaching and mounting drives.

To Admin

To update drive attach/mount permission for a user:  

1. Go to the Management icon in the top left taskbar.
2. Navigate to the Users section.
3. Click the Users in the top left panel.
4. Select the user whose permissions you want to update.
5. Click the Open Full Menu button in the top right panel.
6. Select Open Overlay.
7. In the new window, navigate to Miscellaneous.
8. Click Manual permission management in the left panel.


9. Under Basic VM Interaction, tick the following permissions.
View drives
View drive keys (necessary to share/attach)
Attach drives to VMs
Detach drives from VMs
10. Once done, click the Save button above.

Remount an Existing Drive in an Existing VM

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Virtual Machines section on the top left panel.
3. In the left panel, select the virtual machine to remount the drive into.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, select the Drives section in the left panel.
6. Select the drive(s) to remount.
7. Click the Remount drive(s) icon in the top panel.

Mount All Existing Drives in an Existing VM

bulk-action

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Virtual Machines section on the top left panel.
3. In the left panel, select the virtual machine to mount all drives into.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, select the Drives section in the left panel.
6. Click Mount all Drives icon in the top panel.

Confirmations, Errors & Solutions

Mounted All Drives Successfully

Mount all drives on vm-name (total-mounting-time).

Timeout Failure to Mount All Drives

Failed at mount-all-attaching-time: Timeout waiting for item drive-string-id to satisfy predicate.

Ask Drive Owner(s) to Change All Drive Types To Ready

Ask the drive owner(s) to change all drives in the VM to a ready state.

To Drive Owner
You cannot change states of ReadOnly or ReadWrite drives. If your drives failed to mount in VM, you must create a new drive from scratch. Additionally, you might want to migrate the unused drive(s) to a different storage pool for data management.

To create a new drive follow the steps in  

Create a New Drive.

To migrate an existing drive to a different storage pool follow the steps in  

Migrate a Drive to a Different Storage Pool.

Detach a Drive from an Existing VM

1. Go to the Virtual Machines icon in the top left taskbar.
2. Click the Virtual Machines section on the top left panel.
3. In the left panel, select the virtual machine to detach the drive from.
4. Click the VM Settings and Details option in the bottom center.
5. In the new window, select the Drives section in the left panel.
6. From the list, select the drive you want to detach.
7. Click the Open Full Menu button by the selected drive in the left panel list.
8. Select Detach drive(s).
9. In the prompt, click Yes to proceed.

warning

Detaching a drive revokes user access and stops applications running from the drive.