Overview
I migrated my main machine from Windows 10 to Arch Linux with zero data loss, and used the migration window to add full-disk encryption at the same time. Migrations are where things go wrong — destructive operations destroy data permanently, hardware refuses to cooperate, and a failed cutover means downtime and expensive recovery. The whole point was to do a high-risk transition deliberately enough that none of that happened.
How I Did It
1 · Plan and back up
Before touching anything destructive, I inventoried the data, apps, and configs to preserve, identified Windows-only software that would need Linux alternatives or a VM, then made a verified, encrypted backup to external storage (VeraCrypt) with a rollback plan. The rule: no irreversible step until the backup is proven good.
2 · Install with encryption from the start
A custom partition layout with separate boot, root, and home, then LUKS full-disk encryption deployed during the install — passphrase at boot, encrypted swap so nothing leaks to memory dumps, and GRUB configured with the right initramfs hooks for an encrypted root. Doing encryption now meant it didn't need to be a second project later.
3 · Make the hardware work
This was the messy part. The MSI GS66 Stealth needed NVIDIA proprietary drivers and Optimus GPU switching configured by hand for sane laptop power management, plus TLP for battery life. Several USB-creation tools produced media that wouldn't boot before I found one that did — the kind of friction that's invisible until you hit it.
4 · Restore, harden, verify
Restored data from the encrypted backup, set up the desktop and dev environment, kept a VirtualBox Windows VM for the few apps that needed it, then hardened: default-deny firewall, AppArmor profiles, Firejail for risky software. Last step was confirming every critical file came across intact — verifying zero data loss rather than assuming it.
Results
Zero data loss — every critical file preserved and verified.
Planned window, no surprise downtime.
All hardware functional, including discrete GPU and power management.
Security improved in the same pass via full-disk encryption.
What I Took From It
The migration succeeded because of the boring parts: a thorough pre-flight audit, a backup I actually trusted, and validating each phase before moving to the next so errors couldn't compound. If I did it again I'd test the boot media on the target hardware first and line up the Windows-app alternatives earlier. The same methodology scales straight up to fleet and server migrations — and folding encryption into the migration window is how you get a security upgrade without standing up a separate project for it.
Evidence & availability
Built and run on my own hardware, so there's nothing client-confidential here — which means I can show the working parts. Configuration, scripts, and a full walkthrough are available on request.