Switch bootloader order MBR: GRUB before VeraCrypt in Legacy dual boot

Question

How do I switch the order of GRUB to before VeraCrypt on a BIOS system, such that Ubuntu is accessible again with full disc encryption?

---

The following was executed:

1. Installed Windows 10 Pro N on a single disk
2. Installed dual boot Ubuntu 20.04 on the same disk, which installs GRUB bootloader
3. Installed VeraCrypt on Windows and performed complete system disk encryption
   • Full disk encryption installs the VeraCrypt bootloader, which is placed in front of the GRUB bootloader on the Master Boot Record (MBR), meaning the GRUB bootloader towards Ubuntu is not available anymore/skipped. In the VeraCrypt bootloader one can either:
     • Press ESC, which does not turn towards GRUB, indicating the Windows 10 install is corrupted since it's encrypted
     • Enter password correctly, which directly skips the GRUB bootloader, successfully loading Windows 10 and resulting in Ubuntu 20.04 not being accessible/bootable anymore because the GRUB bootloader is skipped
       
       
4. Tried switching the bootloader so the GRUB loader was above Veracrpyt with bcdedit:

   BcdEdit /enum
   
     Windows Boot Manager
     --------------------
     identifier              {bootmgr}
     device                  partition=\Device\HarddiskVolume1
     description             Windows Boot Manager
     locale                  en-US
     inherit                 {globalsettings}
     default                 {current}
     resumeobject            {f1c50cdb-e01f-11ea-8662-d17332f8934a}
     displayorder            {current}
     toolsdisplayorder       {memdiag}
     timeout                 30
   
     Windows Boot Loader
     -------------------
     identifier              {current}
     device                  partition=C:
     path                    \Windows\system32\winload.exe
     description             Windows 10
     locale                  en-US
     inherit                 {bootloadersettings}
     recoverysequence        {f1c50cdd-e01f-11ea-8662-d17332f8934a}
     displaymessageoverride  Recovery
     recoveryenabled         Yes
     allowedinmemorysettings 0x15000075
     osdevice                partition=C:
     systemroot              \Windows
     resumeobject            {f1c50cdb-e01f-11ea-8662-d17332f8934a}
     nx                      OptIn
     bootmenupolicy          Standard
   

   • I have not yet identified whether the GRUB bootloader is in here, as I think current is the VeraCrypt bootloader that points towards the Windows bootloader with

     resumeobject {f1c50cdb-e01f-11ea-8662-d17332f8934a}
     

     I would think that if I can find the object ID of the GRUB boot loader, I could refer to that from resumeobject, or create a new GRUB boot loader entry to add in front of current, but have not yet determined how to use bcdedit to create a new entry, moving the GRUB boot loader to the front.

Answer 1

Try solving the problem from Linux (not Windows) side. It is usually more straightforward.

1. Boot into your Ubuntu. If your bootloader is messed up, you can do so using a bootloader on a live CD. Some minimal knowledge of GRUB commands is needed but you can always bring up the live CD bootloader and use it to boot into your HDD linux installation.
2. Make a backup of your MBR and store it somewhere within your filesystem where it is easily accessible. Make sure it is stored un an unecnrypted partition... I would use dd to make a backup. Give a backup file a reasonable name. Something like veracrypt.mbr would do
3. Repair your GRUB. This is easily done from inside your linux installation. There are multiple articles on the interwebz that explain how it is done. At this point GRUB stage 1 will be written to MBR.
4. Manually add an entry to your grub.cfg which would chainload veracrypt.mbr created in step 2

After these steps you will end up with the following:

• MBR will contain GRUB stage 1. VeraCrypt nasty stuff will be wiped from it
• You will be able to boot your linux from GRUB
• GRUB will contain an entry which will allow you to chainload VeraCrypt

If you want to play it safe, then before proceeding with step 3 which will replace VeraCrypt bootloader in your MBR with GRUB stage 1 you can try to test your setup from GRUB on live CD and see if it works. Just bring up live CD bootloader, drop to command mode and try to chainload your veracrypt.mbr from there. Take a note of command sequence that worked for you. Then proceed with step 3...