Data, installing and updates

Since 0.4 NULLos keeps your data on the disk, installs itself onto an empty disk and gets updates. This page explains the three parts: the Truhe ("chest"), installing with zug and updates with upd.

As of 7 Nov 2026, NULLos 0.4. Checked in QEMU on a Mac with the image from nullos.de (same checksum), as a SATA disk. What we have not tried ourselves says so.

The Truhe: your data stays

When NULLos starts from a SATA disk or NVMe SSD, the disk holds the Truhe next to the boot partition: NULLos' own encrypted file system. NULLos mounts it at /daten. It holds your settings (cte), the logs (rav) and your home folder (toor), and also the password. All of that is still there after a restart.

l /daten

cte/   rav/   toor/

The ISO (started as a CD) has no Truhe: there everything is gone after switching off.

Sealing

Out of the box the Truhe is encrypted, but not yet locked with your password. Locking it is called sealing. It happens on the first start at the text console (Ctrl+Alt+F1): after the new password NULLos shows a recovery key once, nine groups of six characters each. Write it down and keep it safe. To confirm, NULLos asks for four characters from it; type them one after the other. Then it says Die Truhe ist versiegelt. ("the Truhe is sealed"). What this looks like is in Try NULLos in QEMU.

If you set the password on the desktop first, the Truhe is not sealed yet. Do it later at the text console:

truhe -v

Without the password and without the recovery key the data is gone forever. Nobody can rescue it then.

At the next start

Once the Truhe is sealed, NULLos asks for the password at start, before the desktop comes ("open the Truhe – password"):

Truhe öffnen – Passwort:

Then the lock screen appears; type the password there once more. Your files are back. Checked on 7 Nov 2026: created a file in the home folder, restarted, typed the password, the file was still there.

Showing the state

truhe

Truhe: versiegelt und aufgeschlossen
Kennung f616b337…, 8443 Blöcke à 4096 B, 8418 frei, Generation 25
Slot 1: Passwort (Argon2id)
Slot 2: Wiederherstellung

("sealed and unlocked", ID, blocks, free, generation; slot 1 password, slot 2 recovery.)

According to the help (h truhe, not tried ourselves): truhe -w changes the password of the Truhe, and truhe -a -k unlocks it with the recovery key if you forgot the password.

What the Truhe cannot do

This is what the help of truhe says:

What was on the disk before sealing can be read by anyone who copied the disk before.
Whoever holds the disk can roll it back to an older state.
Without a keyboard at start the Truhe stays open and does not protect against theft.

Installing onto an empty disk: zug

With zug you install NULLos from the running system onto a second, empty disk. zug alone shows the disks and whether it works:

zug

/ved/ads        288 MiB  ahci        geht nicht: Startplatte – davon läuft NULLos gerade
/ved/bds       2048 MiB  ahci        leer – kann eingerichtet werden
Einrichten: zug GERÄT (z. B. zug /ved/bds)

("not possible: boot disk – NULLos is running from it"; "empty – can be set up".) The disk needs at least 1 GiB; for a smaller one it says geht nicht: zu klein (mindestens 1 GiB) ("too small"). With -n, zug only shows what would happen and changes nothing:

zug -n /ved/bds

/ved/bds       2048 MiB  ahci        leer – kann eingerichtet werden
Plan: Startpartition 512 MiB, Truhe (verschlüsselte Datenpartition) 1534 MiB.
Alte Daten werden nicht gelöscht, nur für die Firmware unlesbar gemacht; wer die Platte ausbaut, kann Reste lesen.
Aus dem laufenden System wird nichts mitgenommen: kein Passwort, kein Schlüssel, keine Datei. Beim ersten Start
von der Platte setzt du ein neues Passwort.

In short: a 512 MiB boot partition and the rest as Truhe; old data is not wiped, only made unreadable for the firmware, so someone who removes the disk can read leftovers; nothing is taken from the running system (no password, key or file), and on the first start from the disk you set a new password.

Checked on 7 Nov 2026 in QEMU. We have not tried the real installation (zug /ved/bds) ourselves. According to the developer documentation you confirm by typing the size of the disk in MiB; if there is data on it already, also LÖSCHEN ("delete") and a code from the screen. Only the administrator toor at the text console may do this, not over remote access.

Updates: upd

upd installs a new version next to the running one and starts it on trial. If it does not start cleanly, NULLos returns to the old version on its own at the next start. Your data in the Truhe stays as it is.

Which version is running and whether an update is waiting:

upd -s

geprueft	0
zustand	aktuell
platz	a
start	aktiv
uhr	ok
fremd	aus

zustand aktuell ("state: current") means no update is waiting. platz a is the slot NULLos is running from. Checked on 7 Nov 2026 with 0.4. We have not installed an update yet, because there was no newer version after 0.4. coming soon

From 0.3.x to 0.4: please reinstall. Older versions could not write to the disk and therefore cannot be updated to 0.4.