Encrypted LVM in Debian Install - Is whole disk encrypted?

Question

I just installed Debian 9 with desktop environment to see if I can live using linux fairly exclusively. One item during the installation process to encrypt the LVM. I selected to do so and put in a passphrase. When the computer boots it prompts me for sda5_crypt passphrase as planned.

However, is the entire hard drive encrypted or is only certain part of it encrypted that allows it to boot the drive that contains Debian? In other words, is my HOME directory encrypted when my computer is shut off or do I need to go through other measures in encrypting sensitive parts of the hard drive/partitions OR with the "encrypted LVM" option during installation it encrypts my home directory, etc directory, var, lib, etc?

Answer 1

Assuming you used the 'Guided - Use entire disk and Setup LVM' YES the entire drive (well the LVM itself if that is not the entire drive, minus the /boot' and potentially/boot/efi` partitions).

As such the /home partition is thus part of the default setup in the LVM and indeed encrypted when the machine is shutdown, a key distinction here is 'shutdown' NOT 'suspended' or 'hibernated' as during these states details can/do live in the ram, while this may be non trivial for the average user to attempt leveraging on another user, it is still worth stating.

For Clarity, a default Debian install using the prescribed install logic has the following:

/boot -- unencrypted by default /boot/efi -- unencrypted, even if separated from /boot / (root) -- encrypted, contains `/etc`, `/var`, `/usr/*`,`/opt` and all subdirectories contained in any of those directories mentioned. swap --encrypted, nowadays this is a swapfile mounted at a tmpfs mountpoint on MOST Linux OSes /home -- encrypted, depends on the option in the guided that you take when prompted if this is separated or nested inside / -- in either case it defaults to encrypted in this case