sodcalculator

10 Tech How-To

Fix Ventoy Errors Booting VeraCrypt Encrypted Windows VHD

Guide 10-16509 · Updated · Step by step

If you are getting errors when trying to boot a VeraCrypt-encrypted Windows VHD (Virtual Hard Disk) through Ventoy, the fix usually involves disabling Secure Boot, using the correct Ventoy image (the non-secure-boot version), and ensuring the VHD is properly configured for Windows to boot from it. Follow the steps below to resolve the most common boot failures.

Background: How Ventoy and VeraCrypt Interact

Ventoy is an open-source tool that creates a bootable USB drive capable of booting multiple ISO, WIM, IMG, VHD(x), and EFI files directly from the drive. It works by presenting a menu at boot time, allowing you to select which image to load. VeraCrypt is a disk encryption tool that can encrypt entire drives, partitions, or create encrypted containers. When you combine the two—booting an encrypted Windows VHD via Ventoy—you are essentially asking the firmware to load a bootloader that then reads an encrypted virtual disk. This introduces several layers of complexity, and errors can occur at any stage.

Ventoy itself does not decrypt anything; it simply passes control to the bootloader inside the VHD. For a VeraCrypt-encrypted VHD, the Windows Boot Manager (bootmgr) must be able to read the VHD, and then VeraCrypt’s bootloader (usually installed on the system partition) must prompt for the password before Windows loads. This chain is fragile, and even small misconfigurations can cause boot failures.

Common Errors and Their Causes

When booting a VeraCrypt-encrypted Windows VHD via Ventoy, you might encounter errors such as:

  • “Boot failed” or “No bootable device” – This often means Ventoy cannot find the bootloader in the VHD, or the VHD is not recognized as a valid boot device.
  • “Verification failed: (0x1A) Security Violation” – This is a Secure Boot error. Ventoy’s default bootloader (grub2) is not signed by Microsoft, so Secure Boot blocks it.
  • “Windows failed to start. A recent hardware or software change might be the cause” – This could indicate that the VHD is corrupted, or that the boot configuration data (BCD) inside the VHD is incorrect.
  • “VeraCrypt Boot Loader: Error: Invalid volume specified” – This suggests that VeraCrypt cannot find the encrypted volume it expects, possibly because the drive letters or partition layout changed when booting via USB.

Step-by-Step Fix: Disable Secure Boot and Use the Right Ventoy Image

The most reliable way to fix Ventoy errors when booting a VeraCrypt-encrypted Windows VHD is to disable Secure Boot and use the non-secure-boot version of Ventoy. Here’s how:

  1. Disable Secure Boot in your BIOS/UEFI settings. Restart your computer, enter the firmware setup (usually by pressing F2, Del, or Esc during boot), locate the Secure Boot option (often under “Boot” or “Security” tab), set it to “Disabled”, and save changes. This is required because Ventoy’s default bootloader is not signed by Microsoft.
  2. Download the Ventoy ZIP file (not the exe installer) from the official GitHub releases. Look for a file named like ventoy-1.0.XX-windows.zip (or Linux equivalent). Extract it to a folder.
  3. Run Ventoy2Disk.exe (or VentoyGUI.x86_64 on Linux) as administrator. Select your USB drive, click “Install” to install Ventoy. This will format the drive, so back up any data first.
  4. After installation, copy your VeraCrypt-encrypted Windows VHD file (e.g., Windows.vhd) to the USB drive. You can place it in the root or in a folder.
  5. Boot from the USB drive. Ventoy should display a menu with your VHD file. Select it and press Enter.
  6. If you still get a Secure Boot error, try the “Ventoy Secure Boot” option in the Ventoy menu (if available). Some versions of Ventoy include a signed shim that can boot with Secure Boot enabled, but this is less reliable with encrypted VHDs. If it fails, disable Secure Boot as in step 1.

How to Properly Create a VeraCrypt-Encrypted Windows VHD

Many boot errors stem from a poorly created VHD. Here are the key requirements for a bootable VeraCrypt-encrypted Windows VHD:

  • Use a fixed-size VHD, not dynamically expanding. Dynamic VHDs can cause boot issues because the host system may not allocate the full size, leading to read errors. In Disk Management, choose “Fixed size” when creating the VHD.
  • Install Windows to the VHD using the Windows installation media. Boot from a Windows ISO, open Command Prompt (Shift+F10), and use Diskpart to create and attach the VHD, then install Windows to it. This ensures the boot files are correctly placed.
  • Encrypt the VHD with VeraCrypt after installing Windows, but before booting it via Ventoy. Use VeraCrypt to encrypt the partition inside the VHD. You must also install the VeraCrypt bootloader to the system partition of the VHD (or to the MBR of the VHD if it’s standalone). This bootloader will prompt for the password at boot.
  • Ensure the VHD has a proper MBR or GPT partition table. For compatibility with Ventoy, MBR is often simpler. If using GPT, ensure your firmware supports it.

Alternative: Use a Separate Bootloader or WIM File

If you continue to have issues with a VHD, consider these alternatives:

  • Boot a Windows PE (WinPE) ISO that contains VeraCrypt. You can create a WinPE ISO with VeraCrypt portable, boot it via Ventoy, and then manually mount the encrypted VHD and launch Windows from it. This is more complex but can work.
  • Use a non-encrypted VHD and encrypt only the data partition inside. The system partition (where bootmgr lives) remains unencrypted, while your data is protected. This avoids the VeraCrypt bootloader complication.
  • Convert the VHD to a WIM image and boot it via Ventoy. Ventoy supports booting WIM files directly. You can capture the Windows installation from the VHD using DISM and then boot the WIM. However, this loses the persistence of the VHD.

Frequently Asked Questions

Why does Secure Boot cause a “Security Violation” error with Ventoy?

Secure Boot only allows bootloaders signed by a trusted certificate (usually Microsoft) to run. Ventoy’s default bootloader (GRUB2) is not signed, so when Secure Boot is enabled, the firmware blocks it and shows a security violation. Disabling Secure Boot or using Ventoy’s signed shim (if available) resolves this.

Can I boot a VeraCrypt-encrypted VHD on a computer with Secure Boot enabled?

It is possible if you use Ventoy’s “Secure Boot” menu option, which uses a signed shim. However, the VeraCrypt bootloader itself may also be unsigned, so you may need to add it to the MOK (Machine Owner Key) list. This is complex and often unreliable; disabling Secure Boot is the simplest solution.

Why does the VHD boot fine on a physical machine but not via Ventoy?

When booting via Ventoy, the VHD is presented as a virtual disk on a USB drive. The Windows boot manager may not have the correct drivers to read the USB controller, or the drive letters may change, causing VeraCrypt to fail to find the volume. Ensure the VHD is a fixed-size and that Windows has generic USB storage drivers included.

What is the difference between a VHD and VHDX for this purpose?

VHD is the older format with a maximum size of 2 TB, while VHDX is newer, supports larger sizes, and is more resilient to corruption. For booting via Ventoy, both should work, but VHDX is generally recommended for modern Windows (10/11). However, VeraCrypt may have issues with VHDX if the host system doesn’t support it; test with VHD first if you encounter problems.

Is it safe to disable Secure Boot?

Disabling Secure Boot reduces protection against bootkits and rootkits, but for a system that only boots trusted media (like your Ventoy USB), the risk is minimal. If you are concerned, you can re-enable Secure Boot after booting, but then you won’t be able to boot the encrypted VHD again without repeating the process.

Final Thoughts and Troubleshooting Tips

If you have followed all the steps and still get errors, try these last-resort measures:

  • Update Ventoy to the latest version. Newer versions often fix boot compatibility issues.
  • Test the VHD on a different USB port (preferably USB 2.0) and a different computer. Some firmware has quirks with USB 3.0 controllers.
  • Check the VHD integrity. In Windows, you can run chkdsk on the VHD after attaching it to a working system (via Disk Management).
  • Use Ventoy’s “Memdisk” mode. When the VHD is selected in the Ventoy menu, press Ctrl+M to boot it in memdisk mode, which loads the entire VHD into RAM. This can bypass some USB driver issues, but requires enough RAM to hold the VHD.

Booting a VeraCrypt-encrypted Windows VHD via Ventoy is not officially supported by either project, so some trial and error is expected. By disabling Secure Boot, using a properly created fixed-size VHD, and ensuring the VeraCrypt bootloader is correctly installed, the majority of errors can be resolved.

Related

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →