Build: avoid awk warning in version extraction

Update Language.de.xml (#1742 )
* Update Language.de.xml - Translation completed * Update Language.de.xml
2026-08-29 12:17:16 +00:00 · 2026-05-21 23:31:45 +09:00 · 2026-05-21 08:27:49 +09:00 · 2026-05-20 08:38:42 +02:00 · 2026-05-20 14:33:06 +09:00 · 2026-05-20 14:07:47 +09:00
155 changed files with 2659 additions and 860 deletions
@@ -188,7 +188,7 @@ jobs:

    - name: Cleanup old caches
      uses: actions/github-script@v6
-      if: always()
+      if: ${{ always() && github.event_name == 'push' && github.ref == 'refs/heads/master' }}
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }}
        script: |
@@ -18,7 +18,14 @@ src/Main/veracrypt
 *.ossse3
 *.oshani
 *.oaesni
+*.oavx2
 *.oarmv8crypto
+src/Setup/Linux/packaging/
+src/Setup/Linux/usr/
+src/Setup/Linux/veracrypt.AppDir/usr/
+src/Setup/Linux/veracrypt.AppDir/veracrypt.png
+src/Setup/Linux/veracrypt_*.tar.gz
+src/Setup/Linux/veracrypt-*-setup-*

 # VC macOS build artifacts
 src/Main/VeraCrypt
@@ -34,6 +41,13 @@ src/Setup/MacOSX/*.pkg
 src/wxrelease
 src/wxdebug

+# Arch Linux package build artifacts
+src/Build/Packaging/arch/pkg/
+src/Build/Packaging/arch/src/
+src/Build/Packaging/arch/PKGBUILD.release
+src/Build/Packaging/arch/*.pkg.tar*
+src/Build/Packaging/arch/*.log
+
 src/.vs

 src/Boot/Windows/obj
@@ -110,4 +124,4 @@ src/Setup/Release
 src/Setup/PortableRelease

 src/SetupDLL/Debug
-src/SetupDLL/Release
+src/SetupDLL/Release
@@ -128,6 +128,15 @@ built using the 'NOGUI' parameter:

 `$ make NOGUI=1 WXSTATIC=1`

+## Arch Linux package build:
+
+Arch Linux users can build and install a package from the current checkout with
+makepkg:
+
+`$ cd src/Build/Packaging/arch`
+
+`$ makepkg -si`
+
 On MacOSX, building a console-only executable is not supported.

 ## Mac OS X specifics:
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -6,7 +6,7 @@ Information about Corsican localization:
 	https://github.com/veracrypt/VeraCrypt/blob/master/Translations/Language.co.xml

 2. History of Corsican translation for VeraCrypt:
-	- Updated in 2026 by Patriccollu di Santa Maria è Sichè: May 2nd (1.26.28), May 9th (1.26.28)
+	- Updated in 2026 by Patriccollu di Santa Maria è Sichè: May 2nd (1.26.28), May 9th (1.26.28), May 13th (1.26.28)
 	- Updated in 2025 by Patriccollu di Santa Maria è Sichè: May 5th (1.26.21), May 25th (1.26.24), June 26th (1.26.27),
 	          Aug. 31st (1.26.27), Sep. 27th (1.26.27)
 	- Updated in 2024 by Patriccollu di Santa Maria è Sichè: Aug. 2nd (1.26.13), Aug. 10th (1.26.13)
@@ -1689,8 +1689,9 @@ Information about Corsican localization:
 	    <entry lang="co" key="PIM_ARGON2_LARGE_WARNING">Avete sceltu un valore PIM Argon2 chì hè più maiò chè u valore predefinitu di VeraCrypt.\nSappiate chì què pò richiede più memoria è aumenterà a durata di muntatura.</entry>
 	    <entry lang="co" key="PIM_ARGON2_SMALL_WARNING">Avete sceltu un valore PIM Argon2 più chjucu chè u valore predefinitu di VeraCrypt. Sappiate chì, s’è a vostra parolla d’intesa ùn hè abbastanza forta, què pò riduce u livellu di sicurità.\n\nCunfirmate chì vò impiegate una parolla d’intesa forta ?</entry>
 	    <entry lang="co" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">A parolla d’intesa deve cuntene omancu 20 caratteri per pudè impiegà u valore PIM Argon2 specificatu.\nE parolle d’intesa più corte ponu solu esse impiegate s’è u PIM Argon2 hè uguale à 12 o superiore.</entry>
-	    <entry lang="co" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Muntà i vulumi NTFS cù u pilotu ntfs3 di u nocciulu Linux</entry>
-	    <entry lang="co" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Solu Linux. Quandu st’ozzione hè attivata, VeraCrypt esamineghja l’apparechju virtuale dicifratu cù « blkid -p » è munta i sistemi di schedarii NTFS scuperti cù ntfs3 invece di u terminale NTFS predefinitu. S’è a scuperta NTFS ùn riesce, VeraCrypt impiegheghja a selezzione autumatica nurmale di sistema di schedarii. S’è ntfs3 hè indispunibule, o bluccatu da a distribuzione, a muntatura pò fiascà. St’ozzione d’accettazione pò evità i blucchime d’interruzzione o d’invernazione cagiunati da sistemi di schedarii FUSE cù spaziu d’utilizatore senza risposta.</entry>
+	    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+	    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
 	    <entry lang="co" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Fiascu di a smuntatura nurmale di u vulume {0}. Què pò accade quandu qualchì appiecazione hà sempre schedarii o cartulari aperti nant’à u vulume, o quandu l’apparechju di salvaguardia hè statu discunnessu è chì a muntatura hè diventata instabile.\n\nS’è l’apparechju hè sempre cunnessu, sceglie Nò, chjode l’appiecazioni chì impieganu u vulume è pruvà torna à smuntallu.\n\nS’è l’apparechju hè statu discunnessu o s’è a muntatura hè instabile, VeraCrypt pò fà un tentativu di nettata d’urgenza stacchendu u sistema di schedarii di manera attimpata è cacciendu - o pianificà a cacciatura di - l’oggetti di u nocciulu VeraCrypt. E scritture in attesa ponu esse fiascate, i dati ponu esse persi, è a nettata pò stà in attesa fin’à ciò chì l’appiecazioni chjodinu i schedarii aperti. Verificà u sistema di schedarii cù « fsck » o cù l’attrezzu di riparazione adequatu prima d’impiegallu torna.\n\nCuntinuà ?</entry>
 	    <entry lang="co" key="LINUX_EMERGENCY_UNMOUNTED">A nettata d’urgenza per u vulume {0} hè stata lanciata. S’è u vulume hè statu discunnessu, o a muntatura era instabile, o ancu ci era scritture in attesa, verificà u sistema di schedarii cù « fsck » o cù l’attrezzu di riparazione adequatu prima d’impiegallu torna.</entry>
 	    <entry lang="co" key="FORMAT_STAGE_WRITING_DATA">Creazione di i dati di u vulume. Aspittate per piacè.</entry>
@@ -1703,11 +1704,11 @@ Information about Corsican localization:
 	    <entry lang="co" key="FORMAT_STAGE_PREPARING_TEMP_DEVICE">Cumpiimentu di a creazione di u vulume : appruntata di l’apparechju timpurariu.</entry>
 	    <entry lang="co" key="FORMAT_STAGE_CREATING_FILESYSTEM">Cumpiimentu di a creazione di u vulume : creazione di u sistema di schedarii impieghendu {0}.</entry>
 	    <entry lang="co" key="FORMAT_STAGE_DISMOUNTING_TEMP_VOLUME">Cumpiimentu di a creazione di u vulume : smuntatura di u vulume timpurariu.</entry>
-	    <entry lang="en" key="MACOSX_APFS_SYNTHESIZED_DEVICE">The selected device '{0}' is an APFS synthesized container or volume and cannot be used as a raw VeraCrypt volume host.\n\nSelect the physical APFS store partition{1} instead.</entry>
-	    <entry lang="en" key="MACOSX_DEVICE_SYSTEM_PARTITION">The selected device '{0}' is a macOS system/support partition and cannot be used as a VeraCrypt volume host.</entry>
-	    <entry lang="en" key="MACOSX_APFS_SYSTEM_STORE">The selected APFS physical store '{0}' contains the currently mounted macOS system volume and cannot be used as a VeraCrypt volume host.</entry>
-	    <entry lang="en" key="MACOSX_DEVICE_NOT_WRITABLE">macOS reports the selected device '{0}' as read-only. Select a writable physical partition or disk.</entry>
-	    <entry lang="en" key="MACOSX_APFS_EROFS_HINT">macOS reported the selected device as read-only. If this is an APFS disk, make sure you selected the physical APFS store partition, not an APFS synthesized volume. Use Disk Utility or 'diskutil list' to identify the physical partition, then retry.</entry>
+	    <entry lang="co" key="MACOSX_APFS_SYNTHESIZED_DEVICE">L’apparechju selezziunatu « {0} » hè un cuntenidore o un vulume APFS sintetizatu è ùn pò micca esse impiegatu cum’è un ospite di vulume VeraCrypt di basa.\n\nSelezziunate piuttostu a partizione{1} d’allucamentu APFS fisica.</entry>
+	    <entry lang="co" key="MACOSX_DEVICE_SYSTEM_PARTITION">L’apparechju selezziunatu « {0} » hè una partizione macOS di u sistema o d’assistenza è ùn pò micca esse impiegata cum’è un ospite di vulume VeraCrypt.</entry>
+	    <entry lang="co" key="MACOSX_APFS_SYSTEM_STORE">L’allucamentu fisicu APFS selezziunatu « {0} » cuntene u vulume di u sistema macOS muntatu attualmente è ùn pò micca esse impiegatu cum’è un ospite di vulume VeraCrypt.</entry>
+	    <entry lang="co" key="MACOSX_DEVICE_NOT_WRITABLE">macOS signaleghja l’apparechju selezziunatu « {0} » cum’è essendu in lettura sola. Selezziunate una partizione fisica o un discu induve si pò scrive.</entry>
+	    <entry lang="co" key="MACOSX_APFS_EROFS_HINT">macOS hà signalatu l’apparechju selezziunatu cum’è essendu in lettura sola. S’ellu hè un discu APFS, assicuratevi chì ghjè a partizione d’allucamentu APFS fisica chì hè selezziunata, è micca un vulume APFS sintetizatu. Impiegate l’attrezzu di discu o « diskutil list » per identificà a partizione fisica eppò pruvate torna.</entry>
 	</localization>
 	<xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
 		<xs:element name="VeraCrypt">
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1671,11 +1671,12 @@
    <entry lang="de" key="PIM_ARGON2_LARGE_WARNING">Sie haben einen Argon2-PIM-Wert gewählt, der größer ist als der Standardwert von VeraCrypt.\nBitte beachten Sie, dass dies mehr Arbeitsspeicher erfordern und zu einer deutlich langsameren Einbindung führen kann.</entry>
    <entry lang="de" key="PIM_ARGON2_SMALL_WARNING">Sie haben einen Argon2-PIM-Wert gewählt, der kleiner als der Standardwert von VeraCrypt ist. Bitte beachten Sie, dass ein zu schwaches Passwort die Sicherheit beeinträchtigen kann.\n\nBestätigen Sie, dass Sie ein sicheres Passwort verwenden?</entry>
    <entry lang="de" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Das Passwort muss mindestens 20 Zeichen lang sein, damit der angegebene Argon2-PIM verwendet werden kann.\nKürzere Passwörter können nur verwendet werden, wenn der Argon2-PIM-Wert 12 oder größer ist.</entry>
-    <entry lang="de" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">NTFS-Volumes mit dem NTFS3-Treiber des Linux-Kernels einbinden</entry>
-    <entry lang="de" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Nur Linux. Wenn diese Option aktiviert ist, überprüft VeraCrypt das entschlüsselte virtuelle Gerät mit 'blkid -p' und hängt erkannte NTFS-Dateisysteme mit 'ntfs3' anstelle des standardmäßigen NTFS-Backends ein. Wenn die NTFS-Erkennung fehlschlägt, verwendet VeraCrypt die normale automatische Dateisystemauswahl. Wenn 'ntfs3' nicht verfügbar ist oder von der Distribution blockiert wird, kann das Einbinden fehlschlagen. Diese Opt-in-Option kann Hänger beim Suspendieren oder im Ruhezustand vermeiden, die durch eingefrorene FUSE-Dateisysteme im Benutzerbereich verursacht werden.</entry>
+    <entry lang="de" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">NTFS-Volumes mit einem Linux-Kernel-Treiber einbinden</entry>
+    <entry lang="de" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Nur Linux. Wenn diese Option aktiviert ist und kein expliziter Dateisystemtyp angegeben wurde, untersucht VeraCrypt das entschlüsselte virtuelle Gerät mit 'blkid -p' und hängt erkannte NTFS-Dateisysteme mit einem verfügbaren NTFS-Treiber im Kernel ein, wobei Einhängehelfer wie ntfs-3g umgangen werden. VeraCrypt verwendet ntfs, wenn dieser eindeutig als moderner Lese-/Schreibtreiber identifiziert wird oder ab Linux-Kernel 7.1 erwartet wird, anderenfalls wird ntfs3 verwendet. Wenn die NTFS-Erkennung fehlschlägt, verwendet VeraCrypt die normale automatische Dateisystemauswahl. Wenn kein unterstützter NTFS-Treiber im Kernel verfügbar oder ladbar ist, schlägt das Einhängen fehl. Diese aktivierbare Option kann Hänger beim Suspendieren oder im Ruhezustand vermeiden, die durch eingefrorene FUSE-Dateisysteme im Benutzerbereich verursacht werden.</entry>
+    <entry lang="de" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">Es ist kein unterstützter NTFS-Kerneltreiber verfügbar oder ladbar. Um das standardmäßige NTFS-Backend des Systems zu verwenden, deaktivieren Sie die Einstellung für den NTFS-Kerneltreiber oder fordern Sie den NTFS-Treiber im Kernel nicht explizit an.</entry>
    <entry lang="de" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Das normale Aushängen des Volumes {0} ist fehlgeschlagen. Dies kann passieren, wenn Anwendungen noch Dateien oder Verzeichnisse auf dem Volume geöffnet haben oder wenn das zugrunde liegende Gerät getrennt wurde und die Einbindung veraltet ist.\n\nWenn das Gerät noch angeschlossen ist, wählen Sie „Nein“, schließen Sie die Anwendungen, die das Volume verwenden, und versuchen Sie erneut, das Volume auszuhängen.\n\nWenn das Gerät getrennt wurde oder die Einbindung veraltet ist, kann VeraCrypt eine Notfallbereinigung versuchen, indem es das Dateisystem verzögert trennt und VeraCrypt-Kernelobjekte entfernt oder deren Entfernung plant. Ausstehende Schreibvorgänge sind möglicherweise fehlgeschlagen, Daten können verloren gegangen sein, und die Bereinigung bleibt möglicherweise ausstehend, bis Anwendungen geöffnete Dateien schließen. Überprüfen Sie das Dateisystem mit 'fsck' oder dem entsprechenden Reparaturtool, bevor Sie es wieder verwenden.\n\nWeiter?</entry>
    <entry lang="de" key="LINUX_EMERGENCY_UNMOUNTED">Die Notfallbereinigung für das Volume {0} wurde gestartet. Falls das Volume getrennt wurde, die Einbindung veraltet war oder Schreibvorgänge ausstehend waren, überprüfen Sie das Dateisystem mit 'fsck' oder dem entsprechenden Reparaturtool, bevor Sie es erneut verwenden.</entry>
-    <entry lang="de" key="FORMAT_STAGE_WRITING_DATA">Volumendaten werden erstellt. Bitte warten.</entry>
+    <entry lang="de" key="FORMAT_STAGE_WRITING_DATA">Volume-Daten werden erstellt. Bitte warten.</entry>
    <entry lang="de" key="FORMAT_STAGE_WRITING_BACKUP_HEADER">Abschluss der Volume-Erstellung: Schreiben der Kopfdatensicherung.</entry>
    <entry lang="de" key="FORMAT_STAGE_FLUSHING_DATA">Abschluss der Volume-Erstellung: Daten werden auf die Festplatte geschrieben. Bei großen Volumes oder langsamen Speichergeräten bzw. USB-Speichern kann dies einige Minuten dauern.</entry>
    <entry lang="de" key="FORMAT_STAGE_FINISHED">Die Erstellung des Volumes wird abgeschlossen.</entry>
@@ -1685,11 +1686,11 @@
    <entry lang="de" key="FORMAT_STAGE_PREPARING_TEMP_DEVICE">Abschluss der Volume-Erstellung: Vorbereiten des temporären Geräts.</entry>
    <entry lang="de" key="FORMAT_STAGE_CREATING_FILESYSTEM">Abschluss der Volume-Erstellung: Erstellen des Dateisystems mit {0}.</entry>
    <entry lang="de" key="FORMAT_STAGE_DISMOUNTING_TEMP_VOLUME">Abschluss der Volume-Erstellung: Temporäres Volume wird ausgehängt.</entry>
-    <entry lang="en" key="MACOSX_APFS_SYNTHESIZED_DEVICE">The selected device '{0}' is an APFS synthesized container or volume and cannot be used as a raw VeraCrypt volume host.\n\nSelect the physical APFS store partition{1} instead.</entry>
-    <entry lang="en" key="MACOSX_DEVICE_SYSTEM_PARTITION">The selected device '{0}' is a macOS system/support partition and cannot be used as a VeraCrypt volume host.</entry>
-    <entry lang="en" key="MACOSX_APFS_SYSTEM_STORE">The selected APFS physical store '{0}' contains the currently mounted macOS system volume and cannot be used as a VeraCrypt volume host.</entry>
-    <entry lang="en" key="MACOSX_DEVICE_NOT_WRITABLE">macOS reports the selected device '{0}' as read-only. Select a writable physical partition or disk.</entry>
-    <entry lang="en" key="MACOSX_APFS_EROFS_HINT">macOS reported the selected device as read-only. If this is an APFS disk, make sure you selected the physical APFS store partition, not an APFS synthesized volume. Use Disk Utility or 'diskutil list' to identify the physical partition, then retry.</entry>
+    <entry lang="de" key="MACOSX_APFS_SYNTHESIZED_DEVICE">Das ausgewählte Gerät '{0}' ist ein synthetischer APFS-Container oder ein synthetisches APFS-Volume und kann nicht als Host für ein VeraCrypt-Raw-Volume verwendet werden.\n\nWählen Sie stattdessen die physische APFS-Speicherpartition{1} aus.</entry>
+    <entry lang="de" key="MACOSX_DEVICE_SYSTEM_PARTITION">Das ausgewählte Gerät '{0}' ist eine macOS-System-/Support-Partition und kann nicht als Host für ein VeraCrypt-Volume verwendet werden.</entry>
+    <entry lang="de" key="MACOSX_APFS_SYSTEM_STORE">Die ausgewählte physische APFS-Speicherpartition '{0}' enthält das derzeit eingebundene macOS-Systemvolume und kann nicht als VeraCrypt-Volume-Host verwendet werden.</entry>
+    <entry lang="de" key="MACOSX_DEVICE_NOT_WRITABLE">macOS meldet, dass das ausgewählte Gerät '{0}' schreibgeschützt ist. Wählen Sie eine beschreibbare physische Partition oder Festplatte aus.</entry>
+    <entry lang="de" key="MACOSX_APFS_EROFS_HINT">macOS hat das ausgewählte Gerät als schreibgeschützt gemeldet. Handelt es sich um eine APFS-Festplatte, stellen Sie sicher, dass Sie die physische APFS-Speicherpartition ausgewählt haben und nicht ein synthetisches APFS-Volume. Identifizieren Sie die physische Partition mit dem Festplatten-Dienstprogramm oder dem Befehl „diskutil list“ und versuchen Sie es dann erneut.</entry>
  </localization>
  <!-- XML-Schema -->
  <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1670,8 +1670,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -11,7 +11,7 @@
    <entry lang="nb" key="IDC_BROWSE">Bla &amp;gjennom...</entry>
    <entry lang="nb" key="IDC_DESKTOP_ICON">Legg til VeraCrypt-ikon på &amp;skrivebordet</entry>
    <entry lang="nb" key="IDC_DONATE">Doner nå...</entry>
-    <entry lang="nb" key="IDC_FILE_TYPE">Assosier .hc-fil&amp;utvidelsen med VeraCrypt</entry>
+    <entry lang="nb" key="IDC_FILE_TYPE">Tilknytt .hc-filutvidelsen &amp;med VeraCrypt</entry>
    <entry lang="nb" key="IDC_OPEN_CONTAINING_FOLDER">&amp;Åpne målplasseringen når ferdig</entry>
    <entry lang="nb" key="IDC_PROG_GROUP">Legg til VeraCrypt i &amp;Start-menyen</entry>
    <entry lang="nb" key="IDC_SYSTEM_RESTORE">Opprett system&amp;gjenopprettingspunkt</entry>
@@ -29,7 +29,7 @@
    <entry lang="nb" key="IDC_CIPHER_TEST">&amp;Test</entry>
    <entry lang="nb" key="IDC_DEVICE_TRANSFORM_MODE_FORMAT">Opprett kryptert volum og formater det</entry>
    <entry lang="nb" key="IDC_DEVICE_TRANSFORM_MODE_INPLACE">Krypter partisjonen på plass</entry>
-    <entry lang="nb" key="IDC_DISPLAY_KEYS">Vis genererte nøkler (deres deler)</entry>
+    <entry lang="nb" key="IDC_DISPLAY_KEYS">Vis genererte nøkler (deler av dem)</entry>
    <entry lang="nb" key="IDC_DISPLAY_POOL_CONTENTS">Vis poolinnhold</entry>
    <entry lang="nb" key="IDC_DOWNLOAD_CD_BURN_SOFTWARE">Last ned CD/DVD-brenneprogramvare</entry>
    <entry lang="nb" key="IDC_FILE_CONTAINER">Opprett en kryptert filbeholder</entry>
@@ -82,15 +82,15 @@
    <entry lang="nb" key="IDT_FORMAT_OPTIONS">Alternativer</entry>
    <entry lang="nb" key="IDT_HASH_ALGO">Hash-algoritme</entry>
    <entry lang="nb" key="IDT_HEADER_KEY">Hodenøkkel:</entry>
-    <entry lang="nb" key="IDT_LEFT">Venstre</entry>
+    <entry lang="nb" key="IDT_LEFT">Gjenstår</entry>
    <entry lang="nb" key="IDT_MASTER_KEY">Hovednøkkel:</entry>
    <entry lang="nb" key="IDT_MULTI_BOOT">Velg dette alternativet hvis det er installert to eller flere operativsystemer på denne datamaskinen.\n\nFor eksempel:\n- Windows XP og Windows XP\n- Windows XP og Windows Vista\n- Windows og Mac OS X\n- Windows og Linux\n- Windows, Linux og Mac OS X</entry>
    <entry lang="nb" key="IDT_NON_SYS_DEVICE">Krypterer en ikke-systempartisjon på en intern eller ekstern disk (f.eks. en minnepinne). Kan eventuelt opprette et skjult volum.</entry>
    <entry lang="nb" key="IDT_PARTIAL_POOL_CONTENTS">Gjeldende poolinnhold (delvis)</entry>
-    <entry lang="nb" key="IDT_PASS">Bestått</entry>
+    <entry lang="nb" key="IDT_PASS">Runde</entry>
    <entry lang="nb" key="IDT_PASSWORD">Passord:</entry>
-    <entry lang="nb" key="IDT_PIM">Volum PIM:</entry>
-    <entry lang="nb" key="IDT_OLD_PIM">Volum PIM:</entry>
+    <entry lang="nb" key="IDT_PIM">Volum-PIM:</entry>
+    <entry lang="nb" key="IDT_OLD_PIM">Volum-PIM:</entry>
    <entry lang="nb" key="IDT_PROGRESS">Fremdrift:</entry>
    <entry lang="nb" key="IDT_RANDOM_POOL">Tilfeldig pool:</entry>
    <entry lang="nb" key="IDT_SINGLE_BOOT">Velg dette alternativet hvis det bare er ett operativsystem installert på denne datamaskinen (selv om det har flere brukere).</entry>
@@ -112,7 +112,7 @@
    <entry lang="nb" key="IDC_BROWSE_FILES">Bla gjennom...</entry>
    <entry lang="nb" key="IDC_CACHE">Mellomlagre passord og nøkkelfil&amp;er i minnet</entry>
    <entry lang="nb" key="IDC_CLOSE_BKG_TASK_WHEN_NOVOL">Avslutt når det ikke er noen monterte volum</entry>
-    <entry lang="nb" key="IDC_CLOSE_TOKEN_SESSION_AFTER_MOUNT">&amp;Lukk token sesjon (logg ut) etter at et volum er montert</entry>
+    <entry lang="nb" key="IDC_CLOSE_TOKEN_SESSION_AFTER_MOUNT">&amp;Lukk tokensesjon (logg ut) etter at et volum er montert</entry>
    <entry lang="nb" key="IDC_COPY_EXPANDER">Inkluder VeraCrypt Volume Expander</entry>
    <entry lang="nb" key="IDC_COPY_WIZARD">Inkluder Veiviser for VeraCrypt-volumopprettelse</entry>
    <entry lang="nb" key="IDC_CREATE">Opprett</entry>
@@ -123,10 +123,10 @@
    <entry lang="nb" key="IDC_ENABLE_KEYFILES">Bruk nøkkelfiler</entry>
    <entry lang="nb" key="IDC_ENABLE_NEW_KEYFILES">Bruk nøkkelfiler</entry>
    <entry lang="nb" key="IDC_EXIT">A&amp;vslutt</entry>
-    <entry lang="nb" key="IDC_FAVORITES_HELP_LINK">Hjelp om favorittvolum</entry>
-    <entry lang="nb" key="IDC_FAVORITE_DISABLE_HOTKEY">Ikke monter valgt volum når hurtigtasten 'Monter Favorittvolumer' trykkes</entry>
+    <entry lang="nb" key="IDC_FAVORITES_HELP_LINK">Hjelp om favorittvolumer</entry>
+    <entry lang="nb" key="IDC_FAVORITE_DISABLE_HOTKEY">Ikke monter valgt volum når &amp;hurtigtasten 'Monter favorittvolumer' trykkes</entry>
    <entry lang="nb" key="IDC_FAVORITE_MOUNT_ON_ARRIVAL">Monter valgt volum når dets vertsenhet blir &amp;tilkoblet</entry>
-    <entry lang="nb" key="IDC_FAVORITE_MOUNT_ON_LOGON">Monter valgt volum ved pålog&amp;ning</entry>
+    <entry lang="nb" key="IDC_FAVORITE_MOUNT_ON_LOGON">Monter valgt volum ved påloggi&amp;ng</entry>
    <entry lang="nb" key="IDC_FAVORITE_MOUNT_READONLY">Monter valgt volum som skrivebeskytt&amp;et</entry>
    <entry lang="nb" key="IDC_FAVORITE_MOUNT_REMOVABLE">Monter valgt volum som fjern&amp;bart medium</entry>
    <entry lang="nb" key="IDC_FAVORITE_MOVE_DOWN">Flytt &amp;ned</entry>
@@ -135,8 +135,8 @@
    <entry lang="nb" key="IDC_FAVORITE_REMOVE">&amp;Fjern</entry>
    <entry lang="nb" key="IDC_FAVORITE_USE_LABEL_IN_EXPLORER">Bruk favorittetiketten som stasjonsetikett i Filutforsker</entry>
    <entry lang="nb" key="IDC_FAV_VOL_OPTIONS_GLOBAL_SETTINGS_BOX">Globale innstillinger</entry>
-    <entry lang="nb" key="IDC_HK_UNMOUNT_BALLOON_TOOLTIP">Vis ballongtips etter vellykket hurtigtast-demontering</entry>
-    <entry lang="nb" key="IDC_HK_UNMOUNT_PLAY_SOUND">Spill systemvarsellyd etter vellykket hurtigtast-demontering</entry>
+    <entry lang="nb" key="IDC_HK_UNMOUNT_BALLOON_TOOLTIP">Vis ballongtips etter vellykket demontering med hurtigtast</entry>
+    <entry lang="nb" key="IDC_HK_UNMOUNT_PLAY_SOUND">Spill systemvarsellyd etter vellykket demontering med hurtigtast</entry>
    <entry lang="nb" key="IDC_HK_MOD_ALT">Alt</entry>
    <entry lang="nb" key="IDC_HK_MOD_CTRL">Ctrl</entry>
    <entry lang="nb" key="IDC_HK_MOD_SHIFT">Skift</entry>
@@ -174,19 +174,19 @@
    <entry lang="nb" key="IDC_PRESERVE_TIMESTAMPS">Behold endringsdato på filbeholdere</entry>
    <entry lang="nb" key="IDC_RESET_HOTKEYS">Nullstill</entry>
    <entry lang="nb" key="IDC_SELECT_DEVICE">Velg en&amp;het...</entry>
-    <entry lang="nb" key="IDC_SELECT_FILE">Velg &amp;Fil...</entry>
-    <entry lang="nb" key="IDC_SELECT_PKCS11_MODULE">Velg &amp;Bibliotek...</entry>
+    <entry lang="nb" key="IDC_SELECT_FILE">Velg &amp;fil...</entry>
+    <entry lang="nb" key="IDC_SELECT_PKCS11_MODULE">Velg &amp;bibliotek...</entry>
    <entry lang="nb" key="IDC_SHOW_PASSWORD_CHPWD_NEW">Vis passord</entry>
    <entry lang="nb" key="IDC_SHOW_PASSWORD_CHPWD_ORI">Vis passord</entry>
    <entry lang="nb" key="IDC_TRAVEL_OPEN_EXPLORER">Åpne &amp;Filutforsker-vindu for montert volum</entry>
    <entry lang="nb" key="IDC_TRAV_CACHE_PASSWORDS">&amp;Mellomlagre passord i driverminne</entry>
    <entry lang="nb" key="IDC_TRUECRYPT_MODE">&amp;TrueCrypt-modus</entry>
-    <entry lang="nb" key="IDC_UNMOUNTALL">Demonter &amp;Alle</entry>
+    <entry lang="nb" key="IDC_UNMOUNTALL">Demonter &amp;alle</entry>
    <entry lang="nb" key="IDC_VOLUME_PROPERTIES">&amp;Volumegenskaper...</entry>
    <entry lang="nb" key="IDC_VOLUME_TOOLS">&amp;Volumverktøy...</entry>
    <entry lang="nb" key="IDC_WIPE_CACHE">&amp;Slett mellomlager</entry>
    <entry lang="nb" key="IDD_DEFAULT_MOUNT_PARAMETERS">VeraCrypt – monteringsparametere</entry>
-    <entry lang="nb" key="IDD_FAVORITE_VOLUMES">VeraCrypt – favorittvolum</entry>
+    <entry lang="nb" key="IDD_FAVORITE_VOLUMES">VeraCrypt – favorittvolumer</entry>
    <entry lang="nb" key="IDD_HOTKEYS_DLG">VeraCrypt – systemdekkende hurtigtaster</entry>
    <entry lang="nb" key="IDD_MOUNT_DLG">VeraCrypt</entry>
    <entry lang="nb" key="IDD_PASSWORDCHANGE_DLG">Endre passord eller nøkkelfiler</entry>
@@ -195,7 +195,7 @@
    <entry lang="nb" key="IDD_PREFERENCES_DLG">VeraCrypt – preferanser</entry>
    <entry lang="nb" key="IDD_SYSENC_SETTINGS">VeraCrypt – systemkrypteringsinnstillinger</entry>
    <entry lang="nb" key="IDD_TOKEN_PREFERENCES">VeraCrypt – preferanser for sikkerhetstoken</entry>
-    <entry lang="nb" key="IDD_TRAVELER_DLG">Oppsett for VeraCrypt reisedisk</entry>
+    <entry lang="nb" key="IDD_TRAVELER_DLG">Oppsett for VeraCrypt-reisedisk</entry>
    <entry lang="nb" key="IDD_VOLUME_PROPERTIES">Egenskaper for VeraCrypt-volum</entry>
    <entry lang="nb" key="IDM_ABOUT">Om</entry>
    <entry lang="nb" key="IDM_ADD_REMOVE_VOL_KEYFILES">Legg til / fjern nøkkelfiler fra volum...</entry>
@@ -302,13 +302,13 @@
    <entry lang="nb" key="IDT_TRAVEL_ROOT">Opprett reisediskfiler i (rotmappen til reisedisken):</entry>
    <entry lang="nb" key="IDT_VOLUME">Volum</entry>
    <entry lang="nb" key="IDT_WINDOWS_RELATED_SETTING">Windows</entry>
-    <entry lang="nb" key="IDC_ADD_KEYFILE_PATH">Legg til &amp;Sti...</entry>
+    <entry lang="nb" key="IDC_ADD_KEYFILE_PATH">Legg til &amp;sti...</entry>
    <entry lang="nb" key="IDC_AUTO">&amp;Autotest alle</entry>
    <entry lang="nb" key="IDC_CONTINUE">&amp;Fortsett</entry>
    <entry lang="nb" key="IDC_DECRYPT">&amp;Dekrypter</entry>
    <entry lang="nb" key="IDC_DELETE">&amp;Slett</entry>
    <entry lang="nb" key="IDC_ENCRYPT">&amp;Krypter</entry>
-    <entry lang="nb" key="IDC_EXPORT">&amp;Eksport...</entry>
+    <entry lang="nb" key="IDC_EXPORT">&amp;Eksporter...</entry>
    <entry lang="nb" key="IDC_GENERATE_AND_SAVE_KEYFILE">Generer og lagre nøkkelfil...</entry>
    <entry lang="nb" key="IDC_GENERATE_KEYFILE">&amp;Generer tilfeldig nøkkelfil...</entry>
    <entry lang="nb" key="IDC_GET_LANG_PACKS">Last ned språkpakke</entry>
@@ -428,7 +428,7 @@
    <entry lang="nb" key="DEVICE_IN_USE_INFO">ADVARSEL: Noen av de monterte enhetene/partisjonene var allerede i bruk!\n\nÅ ignorere dette kan føre til uønskede resultater inkludert systemustabilitet.\n\nVi anbefaler sterkt at du lukker eventuelle programmer som kan bruke enhetene/partisjonene.</entry>
    <entry lang="nb" key="DEVICE_PARTITIONS_ERR">Den valgte enheten inneholder partisjoner.\n\nFormatering av enheten kan føre til systemustabilitet og/eller datakorrupsjon. Velg en partisjon på enheten, eller fjern alle partisjoner på enheten for å la VeraCrypt formatere den sikkert.</entry>
    <entry lang="nb" key="DEVICE_PARTITIONS_ERR_W_INPLACE_ENC_NOTE">Den valgte ikke-systemenheten inneholder partisjoner.\n\nKrypterte enhetsbaserte VeraCrypt-volum kan opprettes innenfor enheter som ikke inneholder noen partisjoner (inkludert harddisker og SSD-er). En enhet som inneholder partisjoner kan krypteres helt på plass (ved hjelp av en enkelt hovednøkkel) bare hvis det er disken der Windows er installert og hvorfra den starter.\n\nHvis du vil kryptere den valgte ikke-systemenheten ved hjelp av en enkel hovednøkkel, må du fjerne alle partisjoner på enheten først for å la VeraCrypt formatere den sikkert (formatering av en enhet som inneholder partisjoner kan føre til systemustabilitet og/eller datakorrupsjon). Alternativt kan du kryptere hver partisjon på disken individuelt (hver partisjon vil bli kryptert ved hjelp av en annen hovednøkkel).\n\nMerk: Hvis du vil fjerne alle partisjoner fra en GPT-disk, kan det hende du må konvertere den til en MBR-disk (ved bruk av f.eks. 'Datamaskinhåndtering'-verktøyet) for å fjerne skjulte partisjoner.</entry>
-    <entry lang="nb" key="WHOLE_NONSYS_DEVICE_ENC_CONFIRM">Advarsel: Hvis du krypterer hele enheten (i motsetning til å kryptere bare en partisjon på den), vil operativsystemer betrakte enheten som ny, tom og uformatert (den vil ikke inneholde en partisjonstabell) og kan spontant initialisere enheten (eller spørre deg om du vil gjøre det), som kan skade volumet. Videre vil det ikke være mulig å montere volumet konsekvent som favoritt (f.eks. når drivenummeret endres) eller å tilordne en favorittvolumetikett til den.\n\nFor å unngå dette kan du vurdere å opprette en partisjon på enheten og kryptere partisjonen i stedet.\n\nEr du sikker på at du vil kryptere hele enheten?</entry>
+    <entry lang="nb" key="WHOLE_NONSYS_DEVICE_ENC_CONFIRM">Advarsel: Hvis du krypterer hele enheten (i motsetning til å kryptere bare en partisjon på den), vil operativsystemer betrakte enheten som ny, tom og uformatert (den vil ikke inneholde en partisjonstabell) og kan spontant initialisere enheten (eller spørre deg om du vil gjøre det), som kan skade volumet. Videre vil det ikke være mulig å montere volumet konsekvent som favoritt (f.eks. når enhetsnummeret endres) eller å tilordne en favorittvolumetikett til den.\n\nFor å unngå dette kan du vurdere å opprette en partisjon på enheten og kryptere partisjonen i stedet.\n\nEr du sikker på at du vil kryptere hele enheten?</entry>
    <entry lang="nb" key="AFTER_FORMAT_DRIVE_LETTER_WARN">VIKTIG: Vennligst husk at dette volumet IKKE kan monteres/tilgås ved å bruke stasjonsbokstaven %c:, som foreløpig er tildelt det!\n\nFor å montere dette volumet, klikk 'Automonter Enheter' i hovedvinduet til VeraCrypt (alternativt klikker du 'Velg Enhet' i hovedvinduet til VeraCrypt, velger denne partisjonen/enheten, og klikker 'Monter'). Volumet vil bli montert til en annen stasjonsbokstav, som du velger fra listen i hovedvinduet til VeraCrypt.\n\nDen opprinnelige stasjonsbokstaven %c: bør bare brukes i tilfelle du må fjerne krypteringen fra partisjonen/enheten (f.eks. hvis du ikke lenger trenger kryptering). I et slikt tilfelle, høyreklikk stasjonsbokstaven %c: i 'Datamaskin' (eller 'Min datamaskin')-listen og velg 'Formater'. Ellers bør stasjonsbokstaven %c: aldri brukes (med mindre du fjerner den, som beskrevet f.eks. i VeraCrypt FAQ, og tildeler den en annen partisjon/enhet).</entry>
    <entry lang="nb" key="OS_NOT_SUPPORTED_FOR_NONSYS_INPLACE_ENC">På-plass-kryptering av ikke-systemvolum støttes ikke på versjonen av operativsystemet du bruker (det støttes bare på Windows Vista og senere versjoner av Windows).\n\nÅrsaken er at denne versjonen av Windows ikke støtter krymping av et filsystem (filsystemet må krympes for å gi plass til volummetadata og sikkerhetskopedata for volum).</entry>
    <entry lang="nb" key="ONLY_NTFS_SUPPORTED_FOR_NONSYS_INPLACE_ENC">Den valgte partisjonen ser ikke ut til å inneholde et NTFS-filsystem. Bare partisjoner som inneholder et NTFS-filsystem kan krypteres på plass.\n\nMerk: Årsaken er at Windows ikke støtter krymping av andre typer filsystemer (filsystemet må krympes for å gi plass til volummetadata og sikkerhetskopidata for volum).</entry>
@@ -567,7 +567,7 @@
    <entry lang="nb" key="MAX_HIDVOL_SIZE_GB">Maksimal mulig størrelse på skjult volum for dette volumet er %.2f GiB.</entry>
    <entry lang="nb" key="MAX_HIDVOL_SIZE_TB">Maksimal mulig størrelse på skjult volum for dette volumet er %.2f TiB.</entry>
    <entry lang="nb" key="MOUNTED_NOPWCHANGE">Volumpassord/nøkkelfiler kan ikke endres mens volumet er montert. Vennligst demonter volumet først.</entry>
-    <entry lang="nb" key="MOUNTED_NO_PKCS5_PRF_CHANGE">Hodenøkkel avledningsalgoritmen kan ikke endres mens volumet er montert. Vennligst demonter volumet først.</entry>
+    <entry lang="nb" key="MOUNTED_NO_PKCS5_PRF_CHANGE">Avledningsalgoritmen for hodenøkkelen kan ikke endres mens volumet er montert. Vennligst demonter volumet først.</entry>
    <entry lang="nb" key="MOUNT_BUTTON">&amp;Monter</entry>
    <entry lang="nb" key="NEW_VERSION_REQUIRED">En nyere versjon av VeraCrypt er nødvendig for å montere dette volumet.</entry>
    <entry lang="nb" key="VOL_CREATION_WIZARD_NOT_FOUND">Feil: Klarte ikke å finne veiviser for volumopprettelse.\n\nVennligst forsikre deg om at filen 'VeraCrypt Format.exe' befinner seg i mappen der hovedapplikasjonen VeraCrypt (VeraCrypt.exe) er plassert. Hvis den ikke er det, vennligst reinstaller VeraCrypt, eller lokaliser 'VeraCrypt Format.exe' på disken og kjør den.</entry>
@@ -609,14 +609,14 @@
    <entry lang="nb" key="IDD_PCDM_CHANGE_PKCS5_PRF">Angi hodenøkkel avledningsalgoritme</entry>
    <entry lang="nb" key="IDD_PCDM_ADD_REMOVE_VOL_KEYFILES">Legg til/Fjern nøkkelfiler fra Volum</entry>
    <entry lang="nb" key="IDD_PCDM_REMOVE_ALL_KEYFILES_FROM_VOL">Fjern alle nøkkelfiler fra volum</entry>
-    <entry lang="nb" key="PASSWORD_CHANGED">Passord, PIM og/eller nøkkelfil(er) er endret med suksess.\n\nVIKTIG: Vennligst sørg for at du har lest seksjonen 'Endring av Passord og Nøkkelfiler' i kapitlet 'Sikkerhetskrav og Forholdsregler' i VeraCrypt Brukerveiledning.</entry>
+    <entry lang="nb" key="PASSWORD_CHANGED">Passord, PIM og/eller nøkkelfil(er) er endret.\n\nVIKTIG: Vennligst sørg for at du har lest seksjonen 'Endring av passord og nøkkelfiler' i kapitlet 'Sikkerhetskrav og forholdsregler' i VeraCrypt-brukerveiledningen.</entry>
    <entry lang="nb" key="FAVORITE_PIM_CHANGED">Dette volumet er registrert som et System Favoritt og dets PIM ble endret.\nVil du at VeraCrypt automatisk oppdaterer System Favoritt-konfigurasjonen (administratorrettigheter nødvendig)?\n\nVennligst merk at hvis du svarer nei, må du oppdatere System Favoritten manuelt.</entry>
    <entry lang="nb" key="SYS_PASSWORD_CHANGED_ASK_RESCUE_DISK">VIKTIG: Hvis du ikke har ødelagt VeraCrypt Redningsdisken din, kan systempartisjonen/disken fremdeles dekrypteres ved hjelp av det gamle passordet (ved å starte VeraCrypt Redningsdisk og skrive inn det gamle passordet). Du bør opprette en ny VeraCrypt Redningsdisk og deretter ødelegge den gamle.\n\nVil du opprette en ny VeraCrypt Redningsdisk?</entry>
    <entry lang="nb" key="SYS_HKD_ALGO_CHANGED_ASK_RESCUE_DISK">Merk at VeraCrypt Redningsdisk fortsatt bruker den forrige algoritmen. Hvis du anser den forrige algoritmen som usikker, bør du opprette en ny VeraCrypt Redningsdisk og deretter ødelegge den gamle.\n\nVil du opprette en ny VeraCrypt Redningsdisk?</entry>
    <entry lang="nb" key="KEYFILES_NOTE">Merk at VeraCrypt aldri endrer nøkkelfilinnholdet. Du kan velge mer enn en nøkkelfil (rekkefølgen spiller ingen rolle). Hvis du legger til en mappe, vil alle ikke-skjulte filer som finnes i den bli brukt som nøkkelfiler. Klikk 'Legg til Tokenfiler' for å velge nøkkelfiler lagret på sikkerhetstokens eller smartkort (eller for å importere nøkkelfiler til sikkerhetstokens eller smartkort).</entry>
-    <entry lang="nb" key="KEYFILE_CHANGED">Nøkkelfil(er) er lagt til/fjernet med suksess.</entry>
-    <entry lang="nb" key="KEYFILE_EXPORTED">Nøkkelfil er eksportert.</entry>
-    <entry lang="nb" key="PKCS5_PRF_CHANGED">Hodenøkkel avledningsalgoritmen er satt med suksess.</entry>
+    <entry lang="nb" key="KEYFILE_CHANGED">Nøkkelfil(er) er lagt til/fjernet.</entry>
+    <entry lang="nb" key="KEYFILE_EXPORTED">Nøkkelfilen er eksportert.</entry>
+    <entry lang="nb" key="PKCS5_PRF_CHANGED">Avledningsalgoritmen for hodenøkkelen er endret.</entry>
    <entry lang="nb" key="NONSYS_INPLACE_ENC_RESUME_PASSWORD_PAGE_HELP">Vennligst skriv inn passordet og/eller nøkkelfil(er) for det ikke-systemvolumet hvor du ønsker å gjenoppta prosessen med kryptering/dekryptering på plass.\n\nMerknad: Etter at du klikker Neste, vil VeraCrypt forsøke å finne alle ikke-systemvolumer der krypteringen/dekrypteringen har blitt avbrutt og der VeraCrypt volummeta-data kunne dekodes ved bruk av de oppgitte passordet og/eller nøkkelfilene. Hvis mer enn ett volum finnes, vil du måtte velge ett av dem i neste trinn.</entry>
    <entry lang="nb" key="NONSYS_INPLACE_ENC_RESUME_VOL_SELECT_HELP">Vennligst velg ett av de oppførte volumene. Listen inneholder hvert tilgjengelige ikke-systemvolum hvor krypterings-/dekrypteringsprosessen har blitt avbrutt og hvor volummeta-dataen ble vellykket dekodet ved bruk av det oppgitte passordet og/eller nøkkelfilene.</entry>
    <entry lang="nb" key="NONSYS_INPLACE_DEC_PASSWORD_PAGE_HELP">Vennligst skriv inn passordet og/eller nøkkelfil(er) for det ikke-system VeraCrypt volumet du ønsker å dekryptere.</entry>
@@ -631,7 +631,7 @@
    <entry lang="nb" key="PASSWORD_HIDVOL_TITLE">Passord til skjult volum</entry>
    <entry lang="nb" key="PASSWORD_HIDDEN_OS_TITLE">Passord for skjult operativsystem</entry>
    <entry lang="nb" key="PASSWORD_LENGTH_WARNING">ADVARSEL: Korte passord er lette å knekke ved bruk av brute force-teknikker!\n\nVi anbefaler å velge et passord som består av 20 eller flere tegn. Er du sikker på at du vil bruke et kort passord?</entry>
-    <entry lang="nb" key="PASSWORD_TITLE">Volum passord</entry>
+    <entry lang="nb" key="PASSWORD_TITLE">Volumpassord</entry>
    <entry lang="nb" key="PASSWORD_WRONG">Operasjonen mislyktes på grunn av en eller flere av følgende:\n - Feil passord.\n - Feil Volum PIM nummer.\n - Feil PRF (hash).\n - Ikke et gyldig volum.</entry>
    <entry lang="nb" key="PASSWORD_OR_KEYFILE_WRONG">Operasjonen mislyktes på grunn av en eller flere av følgende:\n - Feil nøkkelfil(er).\n - Feil passord.\n - Feil Volum PIM nummer.\n - Feil PRF (hash).\n - Ikke et gyldig volum.</entry>
    <entry lang="nb" key="PASSWORD_OR_MODE_WRONG">Operasjonen mislyktes på grunn av en eller flere av følgende:\n - Feil monteringsmodus.\n - Feil passord.\n - Feil Volum PIM nummer.\n - Feil PRF (hash).\n - Ikke et gyldig volum.</entry>
@@ -649,7 +649,7 @@
    <entry lang="nb" key="PIM_LARGE_WARNING">Du har valgt en PIM-verdi som er større enn VeraCrypt standardverdi.\nVennligst merk at dette vil føre til mye langsommere montering/oppstart.</entry>
    <entry lang="nb" key="PIM_SMALL_WARNING">Du har valgt en PIM (Personal Iterations Multiplier) som er mindre enn den standard VeraCrypt verdien. Vennligst merk at hvis passordet ditt ikke er sterkt nok, kan dette føre til redusert sikkerhet.\n\nBekrefter du at du bruker et sterkt passord?</entry>
    <entry lang="nb" key="PIM_SYSENC_TOO_BIG">Maksimalverdi for PIM (Personal Iterations Multiplier) for systemkryptering er 65535.</entry>
-    <entry lang="nb" key="PIM_TITLE">Volum PIM</entry>
+    <entry lang="nb" key="PIM_TITLE">Volum-PIM</entry>
    <entry lang="nb" key="HIDDEN_FILES_PRESENT_IN_KEYFILE_PATH">\n\nADVARSEL: Skjulte filer har blitt funnet i en nøkkelfilsøkesti. Slike skjulte filer kan ikke brukes som nøkkelfiler. Hvis du trenger å bruke dem som nøkkelfiler, fjern deres 'Skjult'-attributt (høyreklikk hver av dem, velg 'Egenskaper', fjern 'Skjult' og klikk OK). Merk: Skjulte filer er synlige bare hvis det tilsvarende alternativet er aktivert (Datamaskin > Organiser > 'Mappe- og søkealternativer' > Visning).</entry>
    <entry lang="nb" key="HIDDEN_VOL_PROT_PASSWORD_US_KEYB_LAYOUT">Hvis du forsøker å beskytte et skjult volum som inneholder et skjult system, vennligst sørg for at du bruker det standard amerikanske tastaturoppsettet når du skriver inn passordet for det skjulte volumet. Dette kreves på grunn av at passordet må tastes inn i pre-boot-miljøet (før Windows starter) der ikke-amerikanske tastaturoppsett ikke er tilgjengelige.</entry>
    <entry lang="nb" key="FOUND_NO_PARTITION_W_DEFERRED_INPLACE_ENC">VeraCrypt har ikke funnet noe volum hvor prosessen med kryptering/dekryptering på plass har blitt avbrutt og hvor volummeta-data kunne dekodes ved bruk av det oppgitte passordet og/eller nøkkelfiler.\n\nVennligst forsikre deg om at passordet og/eller nøkkelfilene er korrekte og at partisjonen/volumet ikke brukes av systemet eller applikasjoner (inkludert antivirusprogramvare).</entry>
@@ -688,8 +688,8 @@
    <entry lang="nb" key="TWO_LAYER_CASCADE_HELP">To chiffer i en kaskade som opererer i XTS-modus. Hver blokk er først kryptert med %s (%d-bit nøkkel) og deretter med %s (%d- bit nøkkel). Hvert chiffer bruker sin egen nøkkel. Alle nøkler er gjensidig uavhengige.</entry>
    <entry lang="nb" key="THREE_LAYER_CASCADE_HELP">Tre chiffer i en kaskade som opererer i XTS-modus. Hver blokk er først kryptert med %s (%d-bit nøkkel), deretter med %s (%d-bit nøkkel), og til slutt med %s (%d-bit nøkkel). Hvert chiffer bruker sin egen nøkkel. Alle nøkler er gjensidig uavhengige.</entry>
    <entry lang="nb" key="AUTORUN_MAY_NOT_ALWAYS_WORK">Merk at, avhengig av operativsystemets konfigurasjon, kan disse autokjør- og automonteringsfunksjonene bare virke når reisediskfilene er opprettet på et ikke-skrivbart CD/DVD-lignende medium. Vær oppmerksom på at dette ikke er en feil i VeraCrypt (det er en begrensning i Windows).</entry>
-    <entry lang="nb" key="TRAVELER_DISK_CREATED">VeraCrypt reisedisk har blitt opprettet.\n\nMerk at du trenger administratortillatelser for å kjøre VeraCrypt i bærbar modus. Vær også oppmerksom på at, etter å ha undersøkt registerfilen, kan det være mulig å fastslå at VeraCrypt ble kjørt på et Windows-system selv om det kjøres i bærbar modus.</entry>
-    <entry lang="nb" key="TC_TRAVELER_DISK">VeraCrypt reisedisk</entry>
+    <entry lang="nb" key="TRAVELER_DISK_CREATED">VeraCrypt-reisedisken er opprettet.\n\nMerk at du trenger administratortillatelser for å kjøre VeraCrypt i bærbar modus. Vær også oppmerksom på at det, etter å ha undersøkt registerfilen, kan være mulig å fastslå at VeraCrypt ble kjørt på et Windows-system selv om det kjøres i bærbar modus.</entry>
+    <entry lang="nb" key="TC_TRAVELER_DISK">VeraCrypt-reisedisk</entry>
    <entry lang="nb" key="TWOFISH_HELP">Designet av Bruce Schneier, John Kelsey, Doug Whiting, David Wagner, Chris Hall og Niels Ferguson. Publisert i 1998. 256-bit nøkkel, 128-bit blokk. Operasjonsmodus er XTS. Twofish var en av AES-finalistene.</entry>
    <entry lang="nb" key="MORE_INFO_ABOUT">Mer informasjon om %s</entry>
    <entry lang="nb" key="UNKNOWN">Ukjent</entry>
@@ -838,7 +838,7 @@
    <entry lang="nb" key="SETUP_FINISHED_TITLE_DON">VeraCrypt har blitt installert</entry>
    <entry lang="nb" key="SETUP_FINISHED_UPGRADE_TITLE_DON">VeraCrypt har blitt oppgradert</entry>
    <entry lang="nb" key="SETUP_FINISHED_INFO_DON">Vennligst vurdér å gi en donasjon. Du kan klikke Fullfør når som helst for å lukke installasjonsprogrammet.</entry>
-    <entry lang="nb" key="EXTRACTION_OPTIONS_TITLE">Pakk ut alternativer</entry>
+    <entry lang="nb" key="EXTRACTION_OPTIONS_TITLE">Alternativer for utpakking</entry>
    <entry lang="nb" key="EXTRACTION_OPTIONS_INFO">Her kan du sette forskjellige alternativer for å kontrollere utpakkingsprosessen.</entry>
    <entry lang="nb" key="EXTRACTION_PROGRESS_INFO">Vennligst vent mens filene blir pakket ut.</entry>
    <entry lang="nb" key="EXTRACTION_FINISHED_TITLE_DON">Filer pakket ut</entry>
@@ -862,11 +862,11 @@
    <entry lang="nb" key="CANT_VERIFY_PACKAGE_INTEGRITY">Kan ikke verifisere integriteten av denne distribusjonspakken.</entry>
    <entry lang="nb" key="EXTRACTION_FAILED">Utpakking feilet.</entry>
    <entry lang="nb" key="ROLLBACK">Installeringen har blitt rullet tilbake.</entry>
-    <entry lang="nb" key="INSTALL_OK">VeraCrypt har blitt installert.</entry>
-    <entry lang="nb" key="SETUP_UPDATE_OK">VeraCrypt har blitt oppdatert.</entry>
-    <entry lang="nb" key="UPGRADE_OK_REBOOT_REQUIRED">VeraCrypt har blitt oppgradert med suksess. Men før du kan begynne å bruke det, må datamaskinen startes på nytt.\n\nVil du starte den på nytt nå?</entry>
+    <entry lang="nb" key="INSTALL_OK">VeraCrypt er installert.</entry>
+    <entry lang="nb" key="SETUP_UPDATE_OK">VeraCrypt er oppdatert.</entry>
+    <entry lang="nb" key="UPGRADE_OK_REBOOT_REQUIRED">VeraCrypt er oppgradert. Før du kan begynne å bruke det, må datamaskinen startes på nytt.\n\nVil du starte den på nytt nå?</entry>
    <entry lang="nb" key="SYS_ENC_UPGRADE_FAILED">Oppgradering av VeraCrypt mislyktes!\n\nVIKTIG: Før du slår av eller starter systemet på nytt, anbefaler vi sterkt at du bruker Systemgjenoppretting (Start-menyen > Alle programmer > Tilbehør > Systemverktøy > Systemgjenoppretting) for å gjenopprette systemet til gjenopprettingspunktet med navnet 'VeraCrypt-installering'. Hvis Systemgjenoppretting ikke er tilgjengelig, bør du prøve å installere den opprinnelige eller den nye versjonen av VeraCrypt igjen før du slår av eller starter systemet på nytt.</entry>
-    <entry lang="nb" key="UNINSTALL_OK">VeraCrypt har blitt avinstallert.\n\nKlikk 'Fullfør' for å fjerne VeraCrypt installasjonsprogrammet og mappen %s. Merk at mappen ikke vil bli fjernet hvis den inneholder filer som ikke ble installert av VeraCrypt installasjonsprogrammet eller opprettet av VeraCrypt.</entry>
+    <entry lang="nb" key="UNINSTALL_OK">VeraCrypt er avinstallert.\n\nKlikk 'Fullfør' for å fjerne VeraCrypt-installasjonsprogrammet og mappen %s. Merk at mappen ikke vil bli fjernet hvis den inneholder filer som ikke ble installert av VeraCrypt-installasjonsprogrammet eller opprettet av VeraCrypt.</entry>
    <entry lang="nb" key="REMOVING_REG">Fjerner VeraCrypt registeroppføringer.</entry>
    <entry lang="nb" key="ADDING_REG">Legger til registeroppføring.</entry>
    <entry lang="nb" key="REMOVING_APPDATA">Fjern applikasjonsspesifikke data.</entry>
@@ -938,15 +938,15 @@
    <entry lang="nb" key="ENTER_NORMAL_VOL_PASSWORD">Skriv inn passord for det normale/ytre volumet</entry>
    <entry lang="nb" key="ENTER_HIDDEN_VOL_PASSWORD">Skriv inn passord for det skjulte volumet</entry>
    <entry lang="nb" key="ENTER_HEADER_BACKUP_PASSWORD">Skriv inn passord for hodet lagret i sikkerhetskopifil</entry>
-    <entry lang="nb" key="KEYFILE_CREATED">Nøkkelfiler har blitt opprettet med suksess.</entry>
+    <entry lang="nb" key="KEYFILE_CREATED">Nøkkelfilene er opprettet.</entry>
    <entry lang="nb" key="KEYFILE_INCORRECT_NUMBER">Antall nøkkelfiler du har oppgitt er ugyldig.</entry>
    <entry lang="nb" key="KEYFILE_INCORRECT_SIZE">Nøkkelfilstørrelsen må være minst 64 byte.</entry>
    <entry lang="nb" key="KEYFILE_EMPTY_BASE_NAME">Vennligst skriv inn et navn for nøkkelfilene som skal genereres</entry>
    <entry lang="nb" key="KEYFILE_INVALID_BASE_NAME">Basisnavnet på nøkkelfilene er ugyldig</entry>
    <entry lang="nb" key="KEYFILE_ALREADY_EXISTS">Nøkkelfilen '%s' eksisterer allerede.\nVil du overskrive den? Genereringsprosessen vil stoppes hvis du svarer Nei.</entry>
    <entry lang="nb" key="HEADER_DAMAGED_AUTO_USED_HEADER_BAK">ADVARSEL: Hodet til dette volumet er skadet! VeraCrypt brukte automatisk sikkerhetskopien av volumhodet innebygd i volumet.\n\nDu bør reparere volumhodet ved å velge 'Verktøy' > 'Gjenopprett volumhodet'.</entry>
-    <entry lang="nb" key="VOL_HEADER_BACKED_UP">Volumhodet har blitt sikkerhetskopiert med suksess.\n\nVIKTIG: Å gjenopprette volumhodet ved bruk av denne sikkerhetskopifilen vil også gjenopprette gjeldende volumpassord. Dessuten, hvis nøkkelfil(er) er nødvendig for å montere volumet, vil de samme nøkkelfilene være nødvendige for å montere volumet igjen etter at volumhodet er gjenopprettet.\n\nADVARSEL: Denne sikkerhetskopien av volumhode kan bare brukes til å gjenopprette hodet til dette bestemte volumet. Hvis du bruker denne sikkerhetskopien av hodet for å gjenopprette hodet til et annet volum, vil du kunne montere volumet, men du vil IKKE kunne dekryptere noen data lagret i volumet (fordi du vil endre hovednøkkelen).</entry>
-    <entry lang="nb" key="VOL_HEADER_RESTORED">Volumhodet har blitt gjenopprettet med suksess.\n\nVIKTIG: Vennligst merk at et gammelt passord også kan ha blitt gjenopprettet. Dessuten, hvis nøkkelfil(er) var nødvendig for å montere volumet da sikkerhetskopien ble opprettet, vil de samme nøkkelfilene nå være nødvendige for å montere volumet igjen.</entry>
+    <entry lang="nb" key="VOL_HEADER_BACKED_UP">Volumhodet er sikkerhetskopiert.\n\nVIKTIG: Å gjenopprette volumhodet ved bruk av denne sikkerhetskopifilen vil også gjenopprette gjeldende volumpassord. Dessuten, hvis nøkkelfil(er) er nødvendig for å montere volumet, vil de samme nøkkelfilene være nødvendige for å montere volumet igjen etter at volumhodet er gjenopprettet.\n\nADVARSEL: Denne sikkerhetskopien av volumhodet kan bare brukes til å gjenopprette hodet til dette bestemte volumet. Hvis du bruker denne sikkerhetskopien for å gjenopprette hodet til et annet volum, vil du kunne montere volumet, men du vil IKKE kunne dekryptere data lagret i volumet (fordi du vil endre hovednøkkelen).</entry>
+    <entry lang="nb" key="VOL_HEADER_RESTORED">Volumhodet er gjenopprettet.\n\nVIKTIG: Vennligst merk at et gammelt passord også kan ha blitt gjenopprettet. Dessuten, hvis nøkkelfil(er) var nødvendig for å montere volumet da sikkerhetskopien ble opprettet, vil de samme nøkkelfilene nå være nødvendige for å montere volumet igjen.</entry>
    <entry lang="nb" key="EXTERNAL_VOL_HEADER_BAK_FIRST_INFO">For sikkerhetsårsaker, må du skrive inn riktig passord (og/eller oppgi riktige nøkkelfiler) for volumet.\n\nMerk: Hvis volumet inneholder et skjult volum, må du først oppgi riktig passord (og/eller oppgi riktige nøkkelfiler) for det ytre volumet. Deretter, hvis du velger å sikkerhetskopiere hodet til det skjulte volumet, må du skrive inn riktig passord (og/eller oppgi riktige nøkkelfiler) for det skjulte volumet.</entry>
    <entry lang="nb" key="CONFIRM_VOL_HEADER_BAK">Er du sikker på at du vil opprette sikkerhetskopi av volumhodet til %s?\n\nEtter å ha klikket Ja vil du bli bedt om å oppgi et filnavn for sikkerhetskopien av hodet.\n\nMerk: Både standard- og skjulte volumhoder vil bli kryptert med nytt salt og lagret i sikkerhetskopifilen. Hvis det ikke er noe skjult volum innenfor dette volumet, vil området reservert for det skjulte volumhodet i sikkerhetskopifilen bli fylt med tilfeldige data (for å beholde troverdig benektelse). Når du gjenoppretter volumhodet fra sikkerhetskopifilen, må du oppgi riktig passord (og/eller riktige nøkkelfiler) som var gyldig da sikkerhetskopien av volumhodet ble opprettet. Passordet (og/eller nøkkelfilene) vil også automatisk bestemme hvilken type volumhode som skal gjenopprettes, dvs. standard eller skjult (merk at VeraCrypt bestemmer typen gjennom prosessen med prøv-og-feil).</entry>
    <entry lang="nb" key="CONFIRM_VOL_HEADER_RESTORE">Er du sikker på at du vil gjenopprette volumhodet til %s?\n\nADVARSEL: Å gjenopprette en volumhodet gjenoppretter også volumpassordet som var gyldig da sikkerhetskopien ble opprettet. Dessuten, hvis nøkkelfil(er) var nødvendig for å montere volumet da sikkerhetskopien ble opprettet, vil de samme nøkkelfilene være nødvendige for å montere volumet igjen etter at volumhodet er gjenopprettet.\n\nEtter å ha klikket Ja vil du velge sikkerhetskopifilen for hodet.</entry>
@@ -964,9 +964,9 @@
    <entry lang="nb" key="RESCUE_DISK_NON_WIZARD_CREATION_BURN">Redningsdisk-avbildningen har blitt opprettet og lagret i denne filen:\n%s\n\nNå må du brenne Redningsdisk-avbildningen til en CD eller DVD.\n\nVIKTIG: Merk at filen må brennes til CD/DVD som en ISO-diskavbildning (ikke som en individuell fil). For informasjon om hvordan du gjør dette, vennligst se dokumentasjonen til CD/DVD-brenningsprogramvaren din.\n\nEtter at du har brent Redningsdisken, velger du 'System' > 'Verifiser Redningsdisk' for å sikre at den har blitt brent riktig.</entry>
    <entry lang="nb" key="RESCUE_DISK_NON_WIZARD_CREATION_WIN_ISOBURN">Redningsdisk-avbildningen har blitt opprettet og lagret i denne filen:\n%s\n\nNå må du brenne Redningsdisk-avbildningen til en CD eller DVD.\n\nVil du starte Microsoft Windows Disc Image Burner nå?\n\nMerk: Etter at du har brent Redningsdisken, velger du 'System' > 'Verifiser Redningsdisk' for å sikre at den har blitt brent riktig.</entry>
    <entry lang="nb" key="RESCUE_DISK_NON_WIZARD_CHECK_INSERT">Vennligst sett inn din VeraCrypt Redningsdisk og klikk OK for å verifisere den.</entry>
-    <entry lang="nb" key="RESCUE_DISK_NON_WIZARD_CHECK_PASSED">VeraCrypt Redningsdisk har blitt verifisert med suksess.</entry>
-    <entry lang="nb" key="RESCUE_DISK_NON_WIZARD_CHECK_FAILED">Kunne ikke verifisere at Redningsdisken har blitt brent riktig.\n\nHvis du har brent Redningsdisken, vennligst fjern og sett inn CD/DVD på nytt og prøv igjen. Hvis dette ikke hjelper, vennligst prøv annen CD/DVD-brenningsprogramvare og/eller medium.\n\nHvis du forsøkte å verifisere en VeraCrypt Redningsdisk opprettet for en annen master nøkkel, passord, salt, osv., vil en slik Redningsdisk alltid mislykkes i denne verifiseringen. For å opprette en ny Redningsdisk som er fullt kompatibel med din nåværende konfigurasjon, velg 'System' > 'Opprett Redningsdisk'.</entry>
-    <entry lang="nb" key="RESCUE_DISK_ISO_IMAGE_CHECK_PASSED">VeraCrypt Redningsdisk avbildning har blitt verifisert med suksess.</entry>
+    <entry lang="nb" key="RESCUE_DISK_NON_WIZARD_CHECK_PASSED">VeraCrypt-redningsdisken er verifisert.</entry>
+    <entry lang="nb" key="RESCUE_DISK_NON_WIZARD_CHECK_FAILED">Kunne ikke verifisere at redningsdisken er korrekt brent.\n\nHvis du har brent redningsdisken, vennligst fjern og sett inn CD/DVD på nytt og prøv igjen. Hvis dette ikke hjelper, vennligst prøv en annen CD/DVD-brenningsprogramvare og/eller et annet medium.\n\nHvis du forsøkte å verifisere en VeraCrypt-redningsdisk opprettet for en annen hovednøkkel, passord, salt, osv., vil en slik redningsdisk alltid mislykkes i denne verifiseringen. For å opprette en ny redningsdisk som er fullt kompatibel med din nåværende konfigurasjon, velg 'System' &gt; 'Opprett redningsdisk'.</entry>
+    <entry lang="nb" key="RESCUE_DISK_ISO_IMAGE_CHECK_PASSED">VeraCrypt-redningsdiskbildet er verifisert.</entry>
    <entry lang="nb" key="RESCUE_DISK_ISO_IMAGE_CHECK_FAILED">Verifiseringen av Redningsdisk-avbildningen mislyktes.\n\nHvis du forsøkte å verifisere en Redningsdisk-avbildning opprettet for en annen master nøkkel, passord, salt, osv., vil en slik Redningsdisk-avbildning alltid mislykkes i denne verifiseringen. For å opprette en ny Redningsdisk-avbildning fullt kompatibel med din nåværende konfigurasjon, velg 'System' > 'Opprett Redningsdisk'.</entry>
    <entry lang="nb" key="ERROR_CREATING_RESCUE_DISK">Feil ved oppretting av VeraCrypt Redningsdisk.</entry>
    <entry lang="nb" key="CANNOT_CREATE_RESCUE_DISK_ON_HIDDEN_OS">VeraCrypt Redningsdisk kan ikke opprettes når et skjult operativsystem kjører.\n\nFor å opprette en VeraCrypt Redningsdisk, start avledningsoperativsystemet og velg deretter 'System' > 'Opprett Redningsdisk'.</entry>
@@ -1011,9 +1011,9 @@
    <entry lang="nb" key="HK_AUTOMOUNT_DEVICES">Automonter enheter</entry>
    <entry lang="nb" key="HK_UNMOUNT_ALL">Demonter alle</entry>
    <entry lang="nb" key="HK_WIPE_CACHE">Slett mellomlager</entry>
-    <entry lang="nb" key="HK_UNMOUNT_ALL_AND_WIPE">Demonter alle &amp; slett mellomlager</entry>
-    <entry lang="nb" key="HK_FORCE_UNMOUNT_ALL_AND_WIPE">Tving demontering av alle &amp; slett mellomlager</entry>
-    <entry lang="nb" key="HK_FORCE_UNMOUNT_ALL_AND_WIPE_AND_EXIT">Tving demontering av alle, slett mellomlager &amp; avslutt</entry>
+    <entry lang="nb" key="HK_UNMOUNT_ALL_AND_WIPE">Demonter alle og slett mellomlager</entry>
+    <entry lang="nb" key="HK_FORCE_UNMOUNT_ALL_AND_WIPE">Tving demontering av alle og slett mellomlager</entry>
+    <entry lang="nb" key="HK_FORCE_UNMOUNT_ALL_AND_WIPE_AND_EXIT">Tving demontering av alle, slett mellomlager og avslutt</entry>
    <entry lang="nb" key="HK_MOUNT_FAVORITE_VOLUMES">Monter favorittvolumer</entry>
    <entry lang="nb" key="HK_SHOW_HIDE_MAIN_WINDOW">Vis/skjul hovedvinduet til VeraCrypt</entry>
    <entry lang="nb" key="PRESS_A_KEY_TO_ASSIGN">(Klikk her og trykk en tast)</entry>
@@ -1066,7 +1066,7 @@
    <entry lang="nb" key="UNMOUNT_ALL_TC_VOLUMES">Demonter alle VeraCrypt-volumer</entry>
    <entry lang="nb" key="UAC_INIT_ERROR">VeraCrypt klarte ikke å få administratorrettigheter.</entry>
    <entry lang="nb" key="ERR_ACCESS_DENIED">Tilgang ble nektet av operativsystemet.\n\nMulig årsak: Operativsystemet krever at du har lese/skrive-tillatelser (eller administratorrettigheter) for visse mapper, filer og enheter, for at du skal få lov til å lese og skrive data til/fra dem. Normalt er en bruker uten administratorrettigheter tillatt å opprette, lese og endre filer i sin Dokumenter-mappe.</entry>
-    <entry lang="nb" key="SECTOR_SIZE_UNSUPPORTED">Feil: Enheten bruker en unsupported sektorstørrelse.\n\nFor øyeblikket er det ikke mulig å opprette partisjons-/enhetsbaserte volumer på enheter som bruker sektorer større enn 4096 byte. Merk imidlertid at du kan opprette filbaserte volumer (beholdere) på slike enheter.</entry>
+    <entry lang="nb" key="SECTOR_SIZE_UNSUPPORTED">Feil: Enheten bruker en sektorstørrelse som ikke støttes.\n\nFor øyeblikket er det ikke mulig å opprette partisjons-/enhetsbaserte volumer på enheter som bruker sektorer større enn 4096 byte. Merk imidlertid at du kan opprette filbaserte volumer (beholdere) på slike enheter.</entry>
    <entry lang="nb" key="SYSENC_UNSUPPORTED_SECTOR_SIZE_BIOS">For øyeblikket er det ikke mulig å kryptere et system installert på en disk som bruker en sektorstørrelse annen enn 512 bytes.</entry>
    <entry lang="nb" key="NO_SPACE_FOR_BOOT_LOADER">VeraCrypt Boot Loader krever minst 32 KibiBytes ledig plass i begynnelsen av systemdisken (VeraCrypt Boot Loader trenger å lagre i dette området). Dessverre oppfyller ikke disken din denne betingelsen.\n\nVennligst IKKE rapporter dette som en feil eller et problem i VeraCrypt. For å løse dette problemet, må du repartisjonere disken din og la de første 32 KibiBytes stå ledig (i de fleste tilfeller må du slette og gjenopprette den første partisjonen). Vi anbefaler at du bruker Microsoft partisjonssjefen som er tilgjengelig f.eks. når du installerer Windows.</entry>
    <entry lang="nb" key="FEATURE_UNSUPPORTED_ON_CURRENT_OS">Funksjonen støttes ikke på den versjonen av operativsystemet du bruker.</entry>
@@ -1079,7 +1079,7 @@
    <entry lang="nb" key="SYS_LOADER_RESTORE_FAILED">Kunne ikke gjenopprette den opprinnelige systemlasteren.\n\nVennligst bruk din VeraCrypt Redningsdisk ('Reparasjon' > 'Gjenopprett opprinnelig systemlaster') eller Windows installasjonsmedium for å erstatte VeraCrypt Boot Loader med Windows systemlaster.</entry>
    <entry lang="nb" key="SYS_LOADER_UNAVAILABLE_FOR_RESCUE_DISK">Den opprinnelige systemlasteren blir ikke lagret på redningsdisken (sannsynlig årsak: manglende sikkerhetskopifil).</entry>
    <entry lang="nb" key="ERROR_MBR_PROTECTED">Kunne ikke skrive til MBR-sektoren.\n\nDin BIOS kan være konfigurert til å beskytte MBR-sektoren. Sjekk BIOS-innstillingene dine (trykk F2, Delete, eller Esc, etter at du slår på datamaskinen) for MBR/viruskontroller.</entry>
-    <entry lang="nb" key="BOOT_LOADER_FINGERPRINT_CHECK_FAILED">ADVARSEL: Valideringen av VeraCrypt bootloader-fingeravtrykket mislyktes!\nDin disk kan ha blitt manipulert av en angriper ("Evil Maid" angrep).\n\nDenne advarselen kan også bli utløst hvis du gjenopprettet VeraCrypt oppstartslaster ved å bruke en redningsdisk generert med en annen versjon.\n\nDet anbefales at du endrer passordet umiddelbart, som også vil gjenopprette den korrekte VeraCrypt bootloader. Det anbefales å reinstallere VeraCrypt og å ta tiltak for å unngå tilgang til denne maskinen fra uvedkommende.</entry>
+    <entry lang="nb" key="BOOT_LOADER_FINGERPRINT_CHECK_FAILED">ADVARSEL: Valideringen av VeraCrypts oppstartslaster-fingeravtrykk mislyktes!\nDisken kan ha blitt manipulert av en angriper ("Evil Maid"-angrep).\n\nDenne advarselen kan også bli utløst hvis du gjenopprettet VeraCrypt-oppstartslasteren ved å bruke en redningsdisk generert med en annen versjon.\n\nDet anbefales at du endrer passordet umiddelbart, som også vil gjenopprette den korrekte VeraCrypt-oppstartslasteren. Det anbefales å reinstallere VeraCrypt og å ta tiltak for å unngå tilgang til denne maskinen fra uvedkommende.</entry>
    <entry lang="nb" key="BOOT_LOADER_VERSION_INCORRECT_PREFERENCES">Den nødvendige versjonen av VeraCrypt Boot Loader er for øyeblikket ikke installert. Dette kan forhindre at noen av innstillingene blir lagret.</entry>
    <entry lang="nb" key="CUSTOM_BOOT_LOADER_MESSAGE_HELP"> Merk: I noen situasjoner kan det hende du ønsker å hindre en person (motstander) som ser deg starte datamaskinen fra å vite at du bruker VeraCrypt. Ovennevnte alternativer lar deg gjøre det ved å tilpasse VeraCrypt boot loader-skjermbildet. Hvis du aktiverer det første alternativet, vil ingen tekster bli vist av boot loaderen (ikke engang når du skriver inn feil passord). Datamaskinen vil se ut til å være "frosset" mens du kan skrive inn passordet ditt. I tillegg kan en tilpasset melding bli vist for å villede motstanderen. For eksempel, falske feilmeldinger som "Manglende operativsystem" (som vanligvis vises av Windows boot loader hvis den ikke finner noen Windows boot partisjon). Det er imidlertid viktig å merke seg at hvis motstanderen kan analysere innholdet på harddisken, kan han/hun fortsatt finne ut at den inneholder VeraCrypt boot loaderen.</entry>
    <entry lang="nb" key="CUSTOM_BOOT_LOADER_MESSAGE_PROMPT">ADVARSEL: Vennligst husk at hvis du aktiverer dette alternativet, vil VeraCrypt boot loader ikke vise noen tekster (ikke engang når du skriver inn feil passord). Datamaskinen vil se ut til å være "frosset" (responsløs) mens du kan skrive inn passordet ditt (markøren vil IKKE bevege seg og ingen stjerner vil bli vist når du trykker en tast).\n\nEr du sikker på at du vil aktivere dette alternativet?</entry>
@@ -1113,8 +1113,8 @@
    <entry lang="nb" key="KEYB_LAYOUT_SYS_ENC_EXPLANATION">Merk: Passordet må skrives i pre-boot-miljøet (før Windows starter) hvor ikke-amerikanske Windows-tastaturoppsett ikke er tilgjengelige. Derfor må passordet alltid skrives ved bruk av det standard amerikanske tastaturoppsettet. Det er imidlertid viktig å merke seg at du IKKE trenger et ekte amerikansk tastatur. VeraCrypt sørger automatisk for at du trygt kan skrive passordet (akkurat nå og i pre-boot-miljøet) selv om du IKKE har et ekte amerikansk tastatur.</entry>
    <entry lang="nb" key="RESCUE_DISK_INFO">Før du kan kryptere partisjonen/disken, må du opprette en VeraCrypt Rescue Disk (VRD), som tjener følgende formål:\n\n- Hvis VeraCrypt Boot Loader, hovednøkkel eller andre kritiske data blir skadet, tillater VRD deg å gjenopprette det (merk imidlertid at du fortsatt må oppgi riktig passord da).\n\n- Hvis Windows blir skadet og ikke kan starte, tillater VRD deg å permanent dekryptere partisjonen/disken før Windows starter.\n\n- VRD vil inneholde en sikkerhetskopi av det nåværende innholdet på den første disksporet (som vanligvis inneholder en systemloader eller oppstartsstyrer) og vil tillate deg å gjenopprette det hvis nødvendig.\n\nVeraCrypt Rescue Disk ISO-bilde vil bli opprettet i den angitte plasseringen nedenfor.</entry>
    <entry lang="nb" key="RESCUE_DISK_WIN_ISOBURN_PRELAUNCH_NOTE">Etter at du klikker OK, vil Microsoft Windows Disk Image Burner bli startet. Vennligst bruk den til å brenne VeraCrypt Rescue Disk ISO-bildet til en CD eller DVD.\n\nEtter at du har gjort det, gå tilbake til veiviseren for opprettelse av VeraCrypt-volumer og følg instruksjonene.</entry>
-    <entry lang="nb" key="RESCUE_DISK_BURN_INFO">Rescue Disk-bildet har blitt opprettet og lagret i filen:\n%s\n\nNå må du brenne det til en CD eller DVD.\n\n%lsEtter at du har brent Rescue Disk, klikk Neste for å verifisere at det har blitt riktig brent.</entry>
-    <entry lang="nb" key="RESCUE_DISK_BURN_INFO_NO_CHECK">Rescue Disk-bildet har blitt opprettet og lagret i filen:\n%s\n\nNå bør du enten brenne bildet til en CD/DVD eller flytte det til en sikker plassering for senere bruk.\n\n%lsKlikk Neste for å fortsette.</entry>
+    <entry lang="nb" key="RESCUE_DISK_BURN_INFO">Redningsdisk-bildet er opprettet og lagret i filen:\n%s\n\nNå må du brenne det til en CD eller DVD.\n\n%lsEtter at du har brent redningsdisken, klikk Neste for å verifisere at den ble korrekt brent.</entry>
+    <entry lang="nb" key="RESCUE_DISK_BURN_INFO_NO_CHECK">Redningsdisk-bildet er opprettet og lagret i filen:\n%s\n\nNå bør du enten brenne bildet til en CD/DVD eller flytte det til en sikker plassering for senere bruk.\n\n%lsKlikk Neste for å fortsette.</entry>
    <entry lang="nb" key="RESCUE_DISK_BURN_INFO_NONWIN_ISO_BURNER">VIKTIG: Merk at filen må skrives til CD/DVD som et ISO-diskbilde (ikke som en individuell fil). For informasjon om hvordan du gjør det, vennligst referer til dokumentasjonen for CD/DVD-opptaksprogramvaren din. Hvis du ikke har noen CD/DVD-opptaksprogramvare som kan skrive ISO-diskbildet til en CD/DVD, klikk lenken nedenfor for å laste ned slik gratis programvare.\n\n</entry>
    <entry lang="nb" key="LAUNCH_WIN_ISOBURN">Start Microsoft Windows Disk Image Burner</entry>
    <entry lang="nb" key="RESCUE_DISK_BURN_NO_CHECK_WARN">ADVARSEL: Hvis du allerede opprettet en VeraCrypt Rescue Disk tidligere, kan den ikke gjenbrukes for denne systempartisjonen/disken fordi den ble opprettet for en annen hovednøkkel! Hver gang du krypterer en systempartisjon/disk, må du lage en ny VeraCrypt Rescue Disk for den selv om du bruker samme passord.</entry>
@@ -1173,11 +1173,11 @@
    <entry lang="nb" key="CD_BURNER_NOT_PRESENT_WILL_CONNECT_LATER">Jeg vil koble til en CD/DVD-brenner til datamaskinen min senere. Avslutt prosessen nå.</entry>
    <entry lang="nb" key="CD_BURNER_NOT_PRESENT_CONNECTED_NOW">En CD/DVD-brenner er tilkoblet datamaskinen min nå. Fortsett og skriv Rescue Disk.</entry>
    <entry lang="nb" key="CD_BURNER_NOT_PRESENT_WILL_STORE_ISO_INFO">Vennligst følg disse trinnene:\n\n1) Koble til en flyttbar enhet, for eksempel en USB-minnepinne, til datamaskinen nå.\n\n2) Kopier filen for VeraCrypt Rescue Disk-bildet (%s) til den flyttbare enheten.\n\nHvis du trenger å bruke VeraCrypt Rescue Disk i fremtiden, vil du kunne koble den flyttbare enheten (som inneholder VeraCrypt Rescue Disk-bildet) til en datamaskin med en CD/DVD-brenner og opprette en oppstartbar VeraCrypt Rescue Disk ved å brenne bildet til en CD eller DVD. VIKTIG: Merk at filen for VeraCrypt Rescue Disk-bildet må skrives til CD/DVD som et ISO-diskbilde (ikke som en individuell fil).</entry>
-    <entry lang="nb" key="RESCUE_DISK_RECORDING_TITLE">Innspilling av Rescue Disk</entry>
-    <entry lang="nb" key="RESCUE_DISK_CREATED_TITLE">Rescue Disk opprettet</entry>
+    <entry lang="nb" key="RESCUE_DISK_RECORDING_TITLE">Brenning av redningsdisk</entry>
+    <entry lang="nb" key="RESCUE_DISK_CREATED_TITLE">Redningsdisk opprettet</entry>
    <entry lang="nb" key="SYS_ENCRYPTION_PRETEST_TITLE">Systemkrypteringstest</entry>
-    <entry lang="nb" key="RESCUE_DISK_DISK_VERIFIED_TITLE">Rescue Disk verifisert</entry>
-    <entry lang="nb" key="RESCUE_DISK_VERIFIED_INFO">\nVeraCrypt Rescue Disk har blitt vellykket verifisert. Vennligst fjern den fra lagringsenheten nå og oppbevar den på et trygt sted.\n\nKlikk Neste for å fortsette.</entry>
+    <entry lang="nb" key="RESCUE_DISK_DISK_VERIFIED_TITLE">Redningsdisk verifisert</entry>
+    <entry lang="nb" key="RESCUE_DISK_VERIFIED_INFO">\nVeraCrypt-redningsdisken er verifisert. Vennligst fjern den fra lagringsenheten nå og oppbevar den på et trygt sted.\n\nKlikk Neste for å fortsette.</entry>
    <entry lang="nb" key="REMOVE_RESCUE_DISK_FROM_DRIVE">ADVARSEL: Under de neste trinnene må ikke VeraCrypt Rescue Disk være i stasjonen. Ellers vil det ikke være mulig å fullføre trinnene riktig.\n\nVennligst fjern den fra stasjonen nå og oppbevar den på et trygt sted. Klikk deretter OK.</entry>
    <entry lang="nb" key="PREBOOT_NOT_LOCALIZED">Advarsel: På grunn av tekniske begrensninger i pre-boot-miljøet, kan ikke tekster vist av VeraCrypt i pre-boot-miljøet (dvs. før Windows starter) lokaliseres. Brukergrensesnittet for VeraCrypt Boot Loader er helt på engelsk.\n\nFortsette?</entry>
    <entry lang="nb" key="SYS_ENCRYPTION_PRETEST_INFO">Før du krypterer systempartisjonen eller -disken, må VeraCrypt verifisere at alt fungerer som det skal.\n\nEtter at du klikker Test, vil alle nødvendige komponenter (for eksempel pre-boot autentiseringskomponenten, dvs. VeraCrypt Boot Loader) bli installert og datamaskinen vil starte på nytt. Da må du angi passordet ditt på VeraCrypt Boot Loader-skjermen som vil vises før Windows starter. Etter Windows starter, vil du automatisk bli informert om resultatet av forhåndstesten.\n\nFølgende enhet vil bli endret: Disk #%d\n\n\nHvis du klikker Avbryt nå, vil ingenting bli installert og forhåndstesten vil ikke bli utført.</entry>
@@ -1245,9 +1245,9 @@
    <entry lang="nb" key="CONFIRM_CHANGE_WIZARD_MODE_TO_FILE_CONTAINER">Vil du opprette en VeraCrypt filbeholder i stedet?</entry>
    <entry lang="nb" key="CONFIRM_SYSTEM_ENCRYPTION_MODE">Du har valgt systempartisjonen/disken (eller oppstartspartisjonen), men veivisermodusen du valgte er egnet bare for ikke-systempartisjoner/disks.\n\nVil du sette opp førstart-autentisering (som betyr at du må angi passordet ditt hver gang før Windows starter) og kryptere systempartisjonen/disken?</entry>
    <entry lang="nb" key="CONFIRM_DECRYPT_SYS_DEVICE">Er du sikker på at du vil permanent dekryptere systempartisjonen/disken?</entry>
-    <entry lang="nb" key="CONFIRM_DECRYPT_SYS_DEVICE_CAUTION">ADVARSEL: Hvis du permanent dekrypterer systempartisjonen/disken, vil ukryptert data bli skrevet til den.\n\nEr du virkelig sikker på at du vil permanent dekryptere systempartisjonen/disken?</entry>
+    <entry lang="nb" key="CONFIRM_DECRYPT_SYS_DEVICE_CAUTION">ADVARSEL: Hvis du permanent dekrypterer systempartisjonen/disken, vil ukrypterte data bli skrevet til den.\n\nEr du virkelig sikker på at du vil permanent dekryptere systempartisjonen/disken?</entry>
    <entry lang="nb" key="CONFIRM_DECRYPT_NON_SYS_DEVICE">Er du sikker på at du vil permanent dekryptere følgende volum?</entry>
-    <entry lang="nb" key="CONFIRM_DECRYPT_NON_SYS_DEVICE_CAUTION">ADVARSEL: Hvis du permanent dekrypterer VeraCrypt-volumet, vil ukryptert data bli skrevet til disken.\n\nEr du virkelig sikker på at du vil permanent dekryptere det valgte volumet?</entry>
+    <entry lang="nb" key="CONFIRM_DECRYPT_NON_SYS_DEVICE_CAUTION">ADVARSEL: Hvis du permanent dekrypterer VeraCrypt-volumet, vil ukrypterte data bli skrevet til disken.\n\nEr du virkelig sikker på at du vil permanent dekryptere det valgte volumet?</entry>
    <entry lang="nb" key="CONFIRM_CASCADE_FOR_SYS_ENCRYPTION">Advarsel: Hvis du bruker en kaskade av chiffer for systemkryptering, kan du oppleve følgende problemer:\n\n1) VeraCrypt Boot Loader er større enn normalt, og derfor er det ikke nok plass i det første spor på disken for en sikkerhetskopi av VeraCrypt Boot Loader. Derfor, når den blir skadet (som ofte skjer, for eksempel under upassende utformede antipirat-aktiveringsprosedyrer av visse programmer), vil du måtte bruke VeraCrypt Redningsdisk for å starte eller reparere VeraCrypt Boot Loader.\n\n2) På noen datamaskiner tar det lengre tid å gjenoppta fra dvalemodus.\n\nDisse potensielle problemene kan forhindres ved å velge en ikke-kaskade krypteringsalgoritme (f.eks. AES).\n\nEr du sikker på at du vil bruke en kaskade av chiffer?</entry>
    <entry lang="nb" key="NOTE_CASCADE_FOR_SYS_ENCRYPTION">Hvis du opplever noen av de tidligere beskrevne problemene, dekrypter partisjonen/disken (hvis den er kryptert) og prøv deretter å kryptere den igjen ved å bruke en ikke-kaskade krypteringsalgoritme (f.eks. AES).</entry>
    <entry lang="nb" key="UPDATE_TC_IN_DECOY_OS_FIRST">ADVARSEL: Av sikkerhetsgrunner bør du oppdatere VeraCrypt på dekosystemet før du oppdaterer det på det skjulte systemet.\n\nFor å gjøre det, start dekosystemet og kjør VeraCrypt installasjonsprogrammet fra det. Start deretter det skjulte systemet og kjør installasjonsprogrammet fra det også.\n\nMerk: Dekosystemet og det skjulte systemet deler en enkelt boot loader. Hvis du oppgraderte VeraCrypt bare på det skjulte systemet (men ikke på dekosystemet), vil dekosystemet inneholde en VeraCrypt-driver og VeraCrypt-programmer hvis versjonsnummer er forskjellig fra versjonsnummeret til VeraCrypt Boot Loader. En slik diskrepans kan indikere at det finnes et skjult operativsystem på denne datamaskinen.\n\n\nVil du fortsette?</entry>
@@ -1278,7 +1278,7 @@
    <entry lang="nb" key="SECURITY_TOKEN_ERROR">Sikkerhetstoken feil</entry>
    <entry lang="nb" key="CKR_PIN_INCORRECT">Passord for sikkerhetstoken er feil.</entry>
    <entry lang="nb" key="CKR_DEVICE_MEMORY">Sikkerhetstoken har ikke nok minne/plass til å utføre den forespurte operasjonen.\n\nHvis du prøver å importere en nøkkelfil, bør du velge en mindre fil eller bruke en nøkkelfil generert av VeraCrypt (velg 'Verktøy' > 'Nøkkelfilgenerator').</entry>
-    <entry lang="nb" key="ALL_TOKEN_SESSIONS_CLOSED">Alle åpne sikkerhetstoken-sesjoner har blitt lukket.</entry>
+    <entry lang="nb" key="ALL_TOKEN_SESSIONS_CLOSED">Alle åpne sikkerhetstokensesjoner er lukket.</entry>
    <entry lang="nb" key="SELECT_TOKEN_KEYFILES">Velg Sikkerhetstoken-nøkkelfiler</entry>
    <entry lang="nb" key="TOKEN_SLOT_ID">Slot</entry>
    <entry lang="nb" key="TOKEN_NAME">Token-navn</entry>
@@ -1412,9 +1412,9 @@
    <entry lang="nb" key="IDC_SECURE_DESKTOP_PASSWORD_ENTRY">Bruk Sikkert Skrivebord for passordinntasting</entry>
    <entry lang="nb" key="ERR_REFS_INVALID_VOLUME_SIZE">Volumfilstørrelsen spesifisert i kommandolinjen er inkompatibel med valgt ReFS-filsystem.</entry>
    <entry lang="nb" key="IDC_EDIT_DCSPROP">Rediger Boot Loader-konfigurasjon</entry>
-    <entry lang="nb" key="IDC_SHOW_PLATFORMINFO">Vis EFI-plattformsinformasjon</entry>
+    <entry lang="nb" key="IDC_SHOW_PLATFORMINFO">Vis EFI-plattforminformasjon</entry>
    <entry lang="nb" key="BOOT_LOADER_CONFIGURATION_FILE">Boot Loader-konfigurasjonsfil</entry>
-    <entry lang="nb" key="EFI_PLATFORM_INFORMATION">EFI-plattformsinformasjon</entry>
+    <entry lang="nb" key="EFI_PLATFORM_INFORMATION">EFI-plattforminformasjon</entry>
    <entry lang="nb" key="EDIT_DCSPROP_FOR_ADVANCED_ONLY">ADVARSEL: Uerfarne brukere bør aldri forsøke å manuelt redigere Boot Loader-konfigurasjoner.\n\nFortsette?</entry>
    <entry lang="nb" key="DCSPROP_XML_VALIDATION_FAILED">ADVARSEL: Kunne ikke verifisere XML-formatet til Boot Loader-konfigurasjonen. Vennligst sjekk dine modifikasjoner.</entry>
    <entry lang="nb" key="IDT_ADVANCED_OPTIONS">Avanserte Alternativer</entry>
@@ -1443,9 +1443,9 @@
    <entry lang="nb" key="HIDDEN_CREDS_SAME_AS_OUTER">Det skjulte volumet kan ikke ha samme passord, PIM og nøkkelfiler som det ytre volumet</entry>
    <entry lang="nb" key="SYSENC_BITLOCKER_CONFLICT">VeraCrypt støtter ikke kryptering av en systemdisk som allerede er kryptert med BitLocker.</entry>
    <entry lang="nb" key="IDC_UPDATE_BOOTLOADER_ON_SHUTDOWN">Fiks automatisk oppstartskonfigurasjonsproblemer som kan forhindre at Windows starter</entry>
-    <entry lang="nb" key="IDC_FORCE_NEXT_BOOT_VERACRYPT">Tving maskinen til å starte på VeraCrypt ved neste oppstart</entry>
-    <entry lang="nb" key="IDC_FORCE_VERACRYPT_BOOT_ENTRY">Tving tilstedeværelsen av VeraCrypt-oppføringen i EFI-firmware bootmenyen</entry>
-    <entry lang="nb" key="IDC_FORCE_VERACRYPT_FIRST_BOOT_ENTRY">Tving VeraCrypt-oppføringen til å være den første i EFI-firmware bootmenyen</entry>
+    <entry lang="nb" key="IDC_FORCE_NEXT_BOOT_VERACRYPT">Tving maskinen til å starte opp i VeraCrypt ved neste oppstart</entry>
+    <entry lang="nb" key="IDC_FORCE_VERACRYPT_BOOT_ENTRY">Tving tilstedeværelsen av VeraCrypt-oppføringen i EFI-fastvarens oppstartsmeny</entry>
+    <entry lang="nb" key="IDC_FORCE_VERACRYPT_FIRST_BOOT_ENTRY">Tving VeraCrypt-oppføringen til å være den første i EFI-fastvarens oppstartsmeny</entry>
    <entry lang="nb" key="RAM_ENCRYPTION_DISABLE_HIBERNATE">ADVARSEL: RAM-kryptering er ikke kompatibel med Windows Hvilemodus og Windows Hurtigoppstart-funksjoner. VeraCrypt må deaktivere dem før du aktiverer RAM-kryptering.\n\nFortsette?</entry>
    <entry lang="nb" key="CONFIRM_DISABLE_FAST_STARTUP">ADVARSEL: Windows Hurtigoppstart er aktivert og det er kjent for å forårsake problemer når du arbeider med VeraCrypt volumer. Det anbefales å deaktivere det for bedre sikkerhet og brukervennlighet.\n\nVil du deaktivere Windows Hurtigoppstart?</entry>
    <entry lang="nb" key="QUICK_FORMAT_HELP">For å gjøre det mulig for operativsystemet å montere ditt nye volum, må det formateres med et filsystem. Vennligst velg en filsystemtype.\n\nHvis volumet ditt skal være vert på en enhet eller partisjon, kan du bruke 'Hurtigformatering' for å hoppe over kryptering av ledig plass på volumet.</entry>
@@ -1475,7 +1475,7 @@
    <entry lang="nb" key="LINUX_CROSS_SUPPORT_ONLY">Jeg skal montere volumet kun på {0}</entry>
    <entry lang="nb" key="LINUX_CROSS_SUPPORT_ONLY_HELP">Velg dette alternativet hvis du ikke trenger å bruke volumet på andre plattformer.</entry>
    <entry lang="nb" key="LINUX_DESELECT">Fjern merking</entry>
-    <entry lang="nb" key="LINUX_ADMIN_PW_QUERY">Angi ditt brukernavn eller administratorpassord:</entry>
+    <entry lang="nb" key="LINUX_ADMIN_PW_QUERY">Skriv inn bruker- eller administratorpassordet ditt:</entry>
    <entry lang="nb" key="LINUX_ADMIN_PW_QUERY_TITLE">Administratorrettigheter kreves</entry>
    <entry lang="nb" key="LINUX_VC_RUNNING_ALREADY">VeraCrypt kjører allerede.</entry>
    <entry lang="nb" key="LINUX_SYSTEM_ENC_PW_LENGTH_NOTE">Systemkrypteringspassord er lengre enn {0} tegn.</entry>
@@ -1486,13 +1486,13 @@
    <entry lang="nb" key="LINUX_UNMOUNT_ALL_WHEN">Demonter alle volumer når</entry>
    <entry lang="nb" key="LINUX_ENTERING_POWERSAVING">Systemet går inn i strømsparingsmodus</entry>
    <entry lang="nb" key="LINUX_LOGIN_ACTION">Handlinger å utføre når brukeren logger inn</entry>
-    <entry lang="nb" key="LINUX_CLOSE_EXPL_ON_UNMOUNT">Lukk alle Utforsker-vinduer til volumet som demonteres</entry>
+    <entry lang="nb" key="LINUX_CLOSE_EXPL_ON_UNMOUNT">Lukk alle Utforsker-vinduer for volumet som demonteres</entry>
    <entry lang="nb" key="LINUX_HOTKEYS">Hurtigtaster</entry>
    <entry lang="nb" key="LINUX_SYSTEM_HOTKEYS">System-omfattende Hurtigtaster</entry>
    <entry lang="nb" key="LINUX_SOUND_NOTIFICATION">Spill av systemvarsellyd etter montering/demontering</entry>
    <entry lang="nb" key="LINUX_CONFIRM_AFTER_UNMOUNT">Vis bekreftelsesmeldingsboks etter demontering</entry>
    <entry lang="nb" key="LINUX_VC_QUITS">VeraCrypt avsluttes</entry>
-    <entry lang="nb" key="LINUX_OPEN_FINDER">Åpne Finder-vindu for vellykket montert volum</entry>
+    <entry lang="nb" key="LINUX_OPEN_FINDER">Åpne Finder-vindu for monterte volumer</entry>
    <entry lang="nb" key="LINUX_DISABLE_KERNEL_ONLY_SETTING">Vennligst merk at denne innstillingen trer i kraft kun hvis bruk av kjernekryptografiske tjenester er deaktivert.</entry>
    <entry lang="nb" key="LINUX_DISABLE_KERNEL_CRYPT_CONFIRM">Deaktivering av bruk av kjernekryptografiske tjenester kan redusere ytelsen.\n\nEr du sikker?</entry>
    <entry lang="nb" key="LINUX_KERNEL_CRYPT_OPTION_CHANGE_MOUNTED_HINT">Vennligst merk at deaktivering av dette alternativet kanskje ikke har noen effekt på volumer som er montert ved bruk av kjernekryptografiske tjenester.</entry>
@@ -1573,7 +1573,7 @@
    <entry lang="nb" key="SYS_ENCRYPTION_UPGRADE_UNSUPPORTED_ALGORITHM">VeraCrypt kan ikke oppgraderes fordi systempartisjonen/disken ble kryptert ved bruk av en algoritme som ikke støttes lenger.\nVennligst dekrypter systemet ditt før du oppgraderer VeraCrypt og deretter krypter det igjen.</entry>
    <entry lang="nb" key="LINUX_EX2MSG_TERMINALNOTFOUND">Støttet terminalprogram kunne ikke bli funnet, du trenger enten xterm, konsole eller gnome-terminal (med dbus-x11).</entry>
    <entry lang="nb" key="IDM_MOUNT_NO_CACHE">Monter uten mellomlager</entry>
-    <entry lang="nb" key="EXPANDER_INFO">:: VeraCrypt Expander ::\n\nUtvid et VeraCrypt-volum mens det er i drift uten å omformatere\n\n\nAlle typer volumer (beholderfiler, disker og partisjoner) formatert med NTFS støttes. Den eneste forutsetningen er at det må være nok ledig plass på vertsenheten eller vertsdisken til VeraCrypt-volumet.\n\nIkke bruk denne programvaren for å utvide et ytre volum som inneholder et skjult volum, da dette ødelegger det skjulte volumet!</entry>
+    <entry lang="nb" key="EXPANDER_INFO">:: VeraCrypt Expander ::\n\nUtvid et VeraCrypt-volum uten å reformatere\n\n\nAlle typer volumer (beholderfiler, disker og partisjoner) formatert med NTFS støttes. Den eneste forutsetningen er at det må være nok ledig plass på vertsenheten eller vertsdisken til VeraCrypt-volumet.\n\nIkke bruk denne programvaren for å utvide et ytre volum som inneholder et skjult volum, da dette ødelegger det skjulte volumet!</entry>
    <entry lang="nb" key="IDC_STEPSEXPAND">1. Velg VeraCrypt-volumet som skal utvides\n2. Klikk på 'Monter'-knappen</entry>
    <entry lang="nb" key="IDT_VOL_NAME">Volum: </entry>
    <entry lang="nb" key="IDT_FILE_SYS">Filsystem: </entry>
@@ -1585,7 +1585,7 @@
    <entry lang="nb" key="IDT_INIT_SPACE">Fyll ny plass: </entry>
    <entry lang="nb" key="EXPANDER_FREE_SPACE">%s ledig plass tilgjengelig på vertsdisken</entry>
    <entry lang="nb" key="EXPANDER_HELP_DEVICE">Dette er et enhetsbasert VeraCrypt-volum.\n\nDen nye volumstørrelsen vil bli valgt automatisk som størrelsen på vertsenheten.</entry>
-    <entry lang="nb" key="EXPANDER_HELP_FILE">Vennligst spesifiser den nye størrelsen på VeraCrypt-volumet (må være minst %I64u KB større enn den nåværende størrelsen).</entry>
+    <entry lang="nb" key="EXPANDER_HELP_FILE">Vennligst spesifiser den nye størrelsen på VeraCrypt-volumet (må være minst %I64u KiB større enn den nåværende størrelsen).</entry>
    <entry lang="nb" key="QUICK_EXPAND_WARNING">ADVARSEL: Du bør bruke rask utvidelse bare i følgende tilfeller:\n\n1) Enheten hvor filbeholderen er plassert inneholder ingen sensitive data og du trenger ikke troverdig benektelse.\n2) Enheten hvor filbeholderen er plassert har allerede blitt sikkert og fullstendig kryptert.\n\nEr du sikker på at du vil bruke hurtigutvidelse?</entry>
    <entry lang="nb" key="EXPANDER_STATUS_TEXT">VIKTIG: Flytt musen så tilfeldig som mulig innenfor dette vinduet. Jo lengre du flytter den, jo bedre. Dette øker den kryptografiske styrken til krypteringsnøklene betydelig. Klikk deretter 'Fortsett' for å utvide volumet.</entry>
    <entry lang="nb" key="EXPANDER_STATUS_TEXT_LEGACY">Klikk 'Fortsett' for å utvide volumet.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="nb" key="PIM_ARGON2_LARGE_WARNING">Du har valgt en Argon2 PIM-verdi som er større enn VeraCrypts standardverdi.\nVær oppmerksom på at dette kan kreve mer minne og føre til mye tregere montering.</entry>
    <entry lang="nb" key="PIM_ARGON2_SMALL_WARNING">Du har valgt en Argon2 PIM-verdi som er mindre enn VeraCrypts standardverdi. Vær oppmerksom på at dersom passordet ditt ikke er sterkt nok, kan dette føre til svakere sikkerhet.\n\nBekrefter du at du bruker et sterkt passord?</entry>
    <entry lang="nb" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Passordet må inneholde 20 eller flere tegn for å kunne bruke den angitte Argon2 PIM-en.\nKortere passord kan kun brukes hvis Argon2 PIM er 12 eller større.</entry>
-    <entry lang="nb" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Monter NTFS-volumer med Linux-kjernens ntfs3-driver</entry>
-    <entry lang="nb" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Kun for Linux. Når dette er aktivert, undersøker VeraCrypt den dekrypterte virtuelle enheten med blkid -p og monterer oppdagede NTFS-filsystemer med ntfs3 i stedet for standard NTFS-bakgrunnssystem. Hvis NTFS-deteksjonen mislykkes, bruker VeraCrypt vanlig automatisk filsystemvalg. Hvis ntfs3 er utilgjengelig eller blokkert av distribusjonen, kan monteringen mislykkes. Dette valgfrie alternativet kan forhindre at hvile- eller dvalemodus henger seg opp på grunn av fastlåste FUSE-filsystemer i brukermodus.</entry>
+    <entry lang="nb" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Monter NTFS-volumer med en Linux-driver i kjernen</entry>
+    <entry lang="nb" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Kun Linux. Når aktivert og ingen eksplisitt filsystemtype er angitt, undersøker VeraCrypt den dekrypterte virtuelle enheten med blkid -p og monterer oppdagede NTFS-filsystemer med en tilgjengelig NTFS-driver i kjernen, og omgår monteringshjelpere som ntfs-3g. VeraCrypt bruker ntfs når den er positivt identifisert som en moderne lese/skrive-driver eller forventet på Linux 7.1 eller nyere, og bruker ellers ntfs3. Hvis NTFS-deteksjonen mislykkes, bruker VeraCrypt det vanlige automatiske filsystemvalget. Hvis ingen støttet NTFS-driver i kjernen er tilgjengelig eller kan lastes, mislykkes monteringen. Dette valgfrie alternativet kan unngå at hvilemodus eller dvalemodus henger på grunn av frosne FUSE-filsystemer i brukerområdet.</entry>
+    <entry lang="nb" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">Ingen støttet NTFS-driver i kjernen er tilgjengelig eller kan lastes. For å bruke systemets standard NTFS-backend, deaktiver innstillingen for NTFS-kjernedriver eller ikke be om NTFS-kjerne eksplisitt.</entry>
    <entry lang="nb" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal demontering av volumet {0} mislyktes. Dette kan skje når programmer fortsatt har filer eller mapper åpne på volumet, eller når den underliggende enheten ble frakoblet og monteringen ble foreldet.\n\nHvis enheten fortsatt er tilkoblet, velg Nei, lukk programmene som bruker volumet, og prøv å demontere på nytt.\n\nHvis enheten ble frakoblet eller monteringen er foreldet, kan VeraCrypt forsøke en nødopprydding ved å frakoble filsystemet og fjerne eller planlegge fjerning av VeraCrypts kjerneobjekter. Ventende skrivinger kan ha mislyktes, data kan gå tapt, og oppryddingen kan forbli ventende inntil programmene lukker åpne filer. Kontroller filsystemet med fsck eller et passende reparasjonsverktøy før du bruker det igjen.\n\nFortsette?</entry>
    <entry lang="nb" key="LINUX_EMERGENCY_UNMOUNTED">Nødopprydding for volumet {0} er igangsatt. Hvis volumet ble frakoblet, monteringen var foreldet, eller det var ventende skrivinger, kontroller filsystemet med fsck eller et passende reparasjonsverktøy før du bruker det igjen.</entry>
    <entry lang="nb" key="FORMAT_STAGE_WRITING_DATA">Oppretter volumdata. Vennligst vent.</entry>
@@ -1,7 +1,7 @@
 <?xml version='1.0' encoding='UTF-8' standalone='no'?>
 <VeraCrypt>
  <localization prog-version="1.26.28">
-    <language langid="nl" name="Nederlands" en-name="Dutch" version="2026-05-08" translators="Jan van der Wal, Peter Tak, Thomas De Rocker"/>
+    <language langid="nl" name="Nederlands" en-name="Dutch" version="2026-05-19" translators="Jan van der Wal, Peter Tak, Thomas De Rocker"/>
    <font lang="nl" class="normal" size="11" face="default"/>
    <font lang="nl" class="bold" size="13" face="Arial"/>
    <font lang="nl" class="fixed" size="12" face="Lucida Console"/>
@@ -1654,8 +1654,8 @@
    <entry lang="nl" key="IDC_SECURE_DESKTOP_ENABLE_IME">De invoermethode-editor (IME) inschakelen in Secure Desktop</entry>
    <entry lang="nl" key="ENABLE_IME_IN_SECURE_DESKTOP_WARNING">WAARSCHUWING: schakel deze optie alleen in als u problemen ondervindt bij het selecteren van sleutelbestanden/tokens onder Secure Desktop.</entry>
    <entry lang="nl" key="ERR_KEY_DERIVATION_FAILED">Het afleiden van de sleutel is mislukt. Dit kan worden veroorzaakt door onvoldoende geheugen of een onderbroken bewerking.</entry>
-    <entry lang="nl" key="EFI_MS_BOOT_LOADER_RESTORE_FAILED">De systeempartitie/schijf is al ontsleuteld, maar het pad naar de EFI-bootloader van Microsoft is niet hersteld in de Windows Boot Manager. Alleen de EFI-opstartbestanden moeten worden gerepareerd. Gebruik de reparatieoptie van de VeraCrypt Rescue Disk, of start op vanaf het Windows-herstelmedium en voer ‘bcdboot W:\\Windows /s S: /f UEFI’ uit, waarbij u W: vervangt door de stationsletter van het Windows-volume en S: door de stationsletter van de EFI-systeempartitie. Pad:</entry>
-    <entry lang="nl" key="EFI_FALLBACK_BOOT_LOADER_STILL_VERACRYPT">De systeempartitie/schijf is al ontsleuteld, maar het pad naar de fallback-EFI-bootloader bevat nog steeds de VeraCrypt-bootloader. Alleen de EFI-opstartbestanden moeten worden gerepareerd. Gebruik de reparatieoptie van de VeraCrypt Rescue Disk, of start op vanaf het Windows-herstelmedium en voer ‘bcdboot W:\\Windows /s S: /f UEFI’ uit, waarbij u W: vervangt door de stationsletter van het Windows-volume en S: door de stationsletter van de EFI-systeempartitie. Pad:</entry>
+    <entry lang="nl" key="EFI_MS_BOOT_LOADER_RESTORE_FAILED">De systeempartitie/schijf is al ontsleuteld, maar het pad naar de EFI-bootloader van Microsoft is niet hersteld in de Windows Boot Manager. Alleen de EFI-opstartbestanden moeten worden gerepareerd. Gebruik de reparatieoptie van de VeraCrypt Rescue Disk, of start op vanaf het Windows-herstelmedium en voer 'bcdboot W:\\Windows /s S: /f UEFI' uit, waarbij u W: vervangt door de stationsletter van het Windows-volume en S: door de stationsletter van de EFI-systeempartitie. Pad:</entry>
+    <entry lang="nl" key="EFI_FALLBACK_BOOT_LOADER_STILL_VERACRYPT">De systeempartitie/schijf is al ontsleuteld, maar het pad naar de fallback-EFI-bootloader bevat nog steeds de VeraCrypt-bootloader. Alleen de EFI-opstartbestanden moeten worden gerepareerd. Gebruik de reparatieoptie van de VeraCrypt Rescue Disk, of start op vanaf het Windows-herstelmedium en voer 'bcdboot W:\\Windows /s S: /f UEFI' uit, waarbij u W: vervangt door de stationsletter van het Windows-volume en S: door de stationsletter van de EFI-systeempartitie. Pad:</entry>
    <entry lang="nl" key="IDM_REPAIR_EFI_BOOT_LOADER">EFI-bootloader repareren...</entry>
    <entry lang="nl" key="CONFIRM_REPAIR_EFI_BOOT_LOADER">VeraCrypt herstelt de paden van de Windows EFI-bootloader en verwijdert de EFI-opstartvermeldingen en -bestanden van VeraCrypt.\n\nGebruik deze optie alleen nadat de systeempartitie/het systeemstation volledig is ontsleuteld en Windows kan opstarten zonder systeemversleuteling.\n\nWilt u doorgaan?</entry>
    <entry lang="nl" key="EFI_BOOT_LOADER_FILE_READ_FAILED">Het EFI-bootloaderbestand kon niet volledig worden gelezen:</entry>
@@ -1668,9 +1668,10 @@
    <entry lang="nl" key="PIM_ARGON2_LARGE_WARNING">U hebt een Argon2 PIM-waarde gekozen die hoger is dan de standaardwaarde van VeraCrypt.\nHoud er rekening mee dat dit meer geheugen kan vergen en kan leiden tot een aanzienlijk tragere koppeling.</entry>
    <entry lang="nl" key="PIM_ARGON2_SMALL_WARNING">U hebt een Argon2-PIM-waarde gekozen die lager is dan de standaardwaarde van VeraCrypt. Houd er rekening mee dat als uw wachtwoord niet sterk genoeg is, dit kan leiden tot een lagere beveiliging.\n\nBevestigt u dat u een sterk wachtwoord gebruikt?</entry>
    <entry lang="nl" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Het wachtwoord moet uit minimaal 20 tekens bestaan om de opgegeven Argon2-PIM te kunnen gebruiken.\nKortere wachtwoorden kunnen alleen worden gebruikt als de Argon2-PIM 12 of hoger is.</entry>
-    <entry lang="nl" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">NTFS-volumes koppelen met het ntfs3-stuurprogramma van de Linux-kernel</entry>
-    <entry lang="nl" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Alleen voor Linux. Wanneer deze optie is ingeschakeld, controleert VeraCrypt het ontsleutelde virtuele apparaat met `blkid -p` en koppelt het gedetecteerde NTFS-bestandssystemen met ntfs3 in plaats van de standaard NTFS-backend. Als de NTFS-detectie mislukt, gebruikt VeraCrypt de normale automatische bestandssysteemselectie. Als ntfs3 niet beschikbaar is of door de distributie wordt geblokkeerd, kan het koppelen mislukken. Deze opt-in-optie kan vastlopen tijdens slaapstand of sluimerstand voorkomen dat wordt veroorzaakt door bevroren FUSE-bestandssystemen in de gebruikersruimte.</entry>
-    <entry lang="nl" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Het normaal ontkoppelen van volume {0} is mislukt. Dit kan gebeuren wanneer applicaties nog bestanden of mappen op het volume open hebben staan, of wanneer het onderliggende apparaat is losgekoppeld en de koppeling verouderd is geraakt.\n\nAls het apparaat nog is aangesloten, kies dan ‘Nee’, sluit de applicaties die het volume gebruiken en probeer het ontkoppelen opnieuw.\n\nAls het apparaat is losgekoppeld of de koppeling verouderd is, kan VeraCrypt een noodopruiming uitvoeren door het bestandssysteem lui los te koppelen en VeraCrypt-kernelobjecten te verwijderen of de verwijdering ervan in te plannen. Lopende schrijfbewerkingen zijn mogelijk mislukt, er kan gegevensverlies optreden en de opruiming kan in behandeling blijven totdat applicaties geopende bestanden sluiten. Controleer het bestandssysteem met fsck of het juiste reparatieprogramma voordat u het opnieuw gebruikt.\n\nDoorgaan?</entry>
+    <entry lang="nl" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">NTFS-volumes koppelen met een Linux-stuurprogramma in de kernel</entry>
+    <entry lang="nl" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Alleen voor Linux. Wanneer deze optie is ingeschakeld en er geen specifiek bestandssysteemtype is opgegeven, onderzoekt VeraCrypt het ontsleutelde virtuele apparaat met 'blkid -p' en koppelt het gedetecteerde NTFS-bestandssystemen met een beschikbare NTFS-driver in de kernel, waarbij koppelhulpprogramma's zoals 'ntfs-3g' worden omzeild. VeraCrypt gebruikt ntfs wanneer dit duidelijk wordt geïdentificeerd als een modern lees-/schrijfstuurprogramma of wordt verwacht op Linux 7.1 of later, en gebruikt anders ntfs3. Als de NTFS-detectie mislukt, gebruikt VeraCrypt de normale automatische bestandssysteemselectie. Als er geen ondersteund NTFS-stuurprogramma in de kernel beschikbaar of laadbaar is, mislukt het koppelen. Deze opt-in-optie kan vastlopers bij slaapstand of sluimerstand voorkomen die worden veroorzaakt door bevroren FUSE-bestandssystemen in de gebruikersruimte.</entry>
+    <entry lang="nl" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">Er is geen ondersteunde NTFS-kerneldriver beschikbaar of laadbaar. Om de standaard NTFS-backend van het systeem te gebruiken, moet u de voorkeur voor de NTFS-kerneldriver uitschakelen of niet expliciet om de NTFS-kerneldriver vragen.</entry>
+    <entry lang="nl" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Het normaal ontkoppelen van volume {0} is mislukt. Dit kan gebeuren wanneer applicaties nog bestanden of mappen op het volume open hebben staan, of wanneer het onderliggende apparaat is losgekoppeld en de koppeling verouderd is geraakt.\n\nAls het apparaat nog is aangesloten, kies dan 'Nee', sluit de applicaties die het volume gebruiken en probeer het ontkoppelen opnieuw.\n\nAls het apparaat is losgekoppeld of de koppeling verouderd is, kan VeraCrypt een noodopruiming uitvoeren door het bestandssysteem lui los te koppelen en VeraCrypt-kernelobjecten te verwijderen of de verwijdering ervan in te plannen. Lopende schrijfbewerkingen zijn mogelijk mislukt, er kan gegevensverlies optreden en de opruiming kan in behandeling blijven totdat applicaties geopende bestanden sluiten. Controleer het bestandssysteem met fsck of het juiste reparatieprogramma voordat u het opnieuw gebruikt.\n\nDoorgaan?</entry>
    <entry lang="nl" key="LINUX_EMERGENCY_UNMOUNTED">De noodopruiming voor volume {0} is gestart. Als het volume was losgekoppeld, de koppeling verouderd was of er nog schrijfbewerkingen in de wachtrij stonden, controleer dan het bestandssysteem met fsck of het juiste reparatieprogramma voordat u het weer gebruikt.</entry>
    <entry lang="nl" key="FORMAT_STAGE_WRITING_DATA">Volumegegevens aanmaken. Even geduld.</entry>
    <entry lang="nl" key="FORMAT_STAGE_WRITING_BACKUP_HEADER">Aanmaken van volume voltooien: backup-header schrijven.</entry>
@@ -1682,11 +1683,11 @@
    <entry lang="nl" key="FORMAT_STAGE_PREPARING_TEMP_DEVICE">Aanmaken van volume voltooien: tijdelijk apparaat voorbereiden.</entry>
    <entry lang="nl" key="FORMAT_STAGE_CREATING_FILESYSTEM">Aanmaken van volume voltooien: bestandssysteem aanmaken met {0}.</entry>
    <entry lang="nl" key="FORMAT_STAGE_DISMOUNTING_TEMP_VOLUME">Aanmaken van volume voltooien: tijdelijk volume ontkoppelen.</entry>
-    <entry lang="en" key="MACOSX_APFS_SYNTHESIZED_DEVICE">The selected device '{0}' is an APFS synthesized container or volume and cannot be used as a raw VeraCrypt volume host.\n\nSelect the physical APFS store partition{1} instead.</entry>
-    <entry lang="en" key="MACOSX_DEVICE_SYSTEM_PARTITION">The selected device '{0}' is a macOS system/support partition and cannot be used as a VeraCrypt volume host.</entry>
-    <entry lang="en" key="MACOSX_APFS_SYSTEM_STORE">The selected APFS physical store '{0}' contains the currently mounted macOS system volume and cannot be used as a VeraCrypt volume host.</entry>
-    <entry lang="en" key="MACOSX_DEVICE_NOT_WRITABLE">macOS reports the selected device '{0}' as read-only. Select a writable physical partition or disk.</entry>
-    <entry lang="en" key="MACOSX_APFS_EROFS_HINT">macOS reported the selected device as read-only. If this is an APFS disk, make sure you selected the physical APFS store partition, not an APFS synthesized volume. Use Disk Utility or 'diskutil list' to identify the physical partition, then retry.</entry>
+    <entry lang="nl" key="MACOSX_APFS_SYNTHESIZED_DEVICE">Het geselecteerde apparaat '{0}' is een door APFS gesynthetiseerde container of een APFS-volume en kan niet worden gebruikt als host voor een onbewerkt VeraCrypt-volume.\n\nSelecteer in plaats daarvan de fysieke APFS-opslagpartitie{1}.</entry>
+    <entry lang="nl" key="MACOSX_DEVICE_SYSTEM_PARTITION">Het geselecteerde apparaat '{0}' is een systeem-/ondersteuningspartitie van macOS en kan niet worden gebruikt als host voor een VeraCrypt-volume.</entry>
+    <entry lang="nl" key="MACOSX_APFS_SYSTEM_STORE">De geselecteerde fysieke APFS-opslag '{0}' bevat het momenteel gekoppelde macOS-systeemvolume en kan niet worden gebruikt als host voor een VeraCrypt-volume.</entry>
+    <entry lang="nl" key="MACOSX_DEVICE_NOT_WRITABLE">macOS meldt dat het geselecteerde apparaat '{0}' alleen-lezen is. Selecteer een fysieke partitie of schijf waarop geschreven kan worden.</entry>
+    <entry lang="nl" key="MACOSX_APFS_EROFS_HINT">macOS geeft aan dat het geselecteerde apparaat alleen-lezen is. Als dit een APFS-schijf is, controleer dan of u de fysieke APFS-opslagpartitie hebt geselecteerd en niet een gesynthetiseerd APFS-volume. Gebruik Schijfhulpprogramma of 'diskutil list' om de fysieke partitie te identificeren en probeer het vervolgens opnieuw.</entry>
  </localization>
  <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" attributeFormDefault="unqualified" elementFormDefault="qualified">
    <xs:element name="VeraCrypt">
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="pl" key="PIM_ARGON2_LARGE_WARNING">Wybrano wartość PIM Argon2 większą niż domyślna wartość VeraCrypt.\nNależy pamiętać, że może to wymagać więcej pamięci i prowadzić do znacznie wolniejszego podłączania.</entry>
    <entry lang="pl" key="PIM_ARGON2_SMALL_WARNING">Wybrano wartość PIM Argon2 mniejszą niż domyślna wartość VeraCrypt. Należy pamiętać, że jeśli hasło nie jest wystarczająco silne, może to prowadzić do osłabienia zabezpieczeń.\n\nCzy potwierdzasz użycie silnego hasła?</entry>
    <entry lang="pl" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Hasło musi zawierać przynajmniej 20 albo więcej znaków do używania określonego PIM Argon2.\nKrótszych haseł można używać tylko wtedy, gdy PIM Argon2 ma wartość 12 lub większą.</entry>
-    <entry lang="pl" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Podłączaj wolumeny NTFS za pomocą sterownika ntfs3 jądra systemu Linux</entry>
-    <entry lang="pl" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Tylko system Linux. Po włączeniu tej opcji VeraCrypt skanuje odszyfrowane urządzenie wirtualne za pomocą blkid -p i podłącza wykryte systemy plików NTFS za pomocą sterownika NTFS3 zamiast domyślnego NTFS. Jeśli wykrycie NTFS się nie powiedzie, VeraCrypt użyje standardowego automatycznego wyboru systemu plików. Jeśli NTFS3 jest niedostępny lub zablokowany przez dystrybucję, podłączenie może się nie powieść. To opcjonalne ustawienie pozwala uniknąć zawieszeń w trybie uśpienia lub hibernacji spowodowanych przez zamrożone systemy plików FUSE w przestrzeni użytkownika.</entry>
+    <entry lang="pl" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Podłącz wolumeny NTFS za pomocą sterownika systemu Linux w jądrze</entry>
+    <entry lang="pl" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Tylko system Linux. Po włączeniu i braku jawnego typu systemu plików, VeraCrypt skanuje odszyfrowane urządzenie wirtualne za pomocą blkid -p i podłącza wykryte systemy plików NTFS za pomocą dostępnego sterownika NTFS w jądrze, pomijając programy pomocnicze podłączania, takie jak ntfs-3g. VeraCrypt używa ntfs, gdy zostanie on jednoznacznie rozpoznany jako nowoczesny sterownik odczytu/zapisu albo jest oczekiwany w jądrze Linuksa 7.1 lub nowszym, a w przeciwnym razie używa ntfs3. Jeśli wykrycie NTFS się nie powiedzie, VeraCrypt użyje standardowego wyboru automatycznego systemu plików. Jeśli żaden obsługiwany sterownik NTFS w jądrze nie jest dostępny lub możliwy do załadowania, podłączenie kończy się niepowodzeniem. To ustawienie opcjonalne pozwala uniknąć zawieszeń w trybie uśpienia lub hibernacji spowodowanych przez zamrożone systemy plików FUSE w przestrzeni użytkownika.</entry>
+    <entry lang="pl" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">Brak obsługiwanego sterownika NTFS w jądrze lub możliwości załadowania go. Aby użyć domyślnego backendu NTFS w systemie, wyłącz preferencję sterownika NTFS jądra lub jawnie nie żądaj NTFS z jądra.</entry>
    <entry lang="pl" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Nie udało się wykonać normalnego odłączenia wolumenu {0}. Może się to zdarzyć, gdy programy nadal mają otwarte pliki lub katalogi na wolumenie lub gdy urządzenie bazowe zostało rozłączone, a podłączenie stało się nieaktualne.\n\nJeśli urządzenie jest nadal podłączone, wybierz opcję „Nie”, zamknij programy korzystające z wolumenu i spróbuj ponownie odłączyć.\n\nJeśli urządzenie zostało rozłączone lub podłączenie jest nieaktualne, VeraCrypt może podjąć próbę awaryjnego czyszczenia poprzez leniwe odłączenie systemu plików i usunięcie lub zaplanowanie usunięcia obiektów jądra VeraCrypt. Oczekujące zapisy mogły się nie powieść, dane mogły zostać utracone, a czyszczenie może pozostać w toku do momentu zamknięcia otwartych plików przez programy. Sprawdź system plików za pomocą fsck lub odpowiedniego narzędzia naprawczego przed ponownym użyciem.\n\nKontynuować?</entry>
    <entry lang="pl" key="LINUX_EMERGENCY_UNMOUNTED">Rozpoczęto awaryjne czyszczenie wolumenu {0}. Jeśli wolumen był rozłączony, podłączenie było nieaktualne lub występowały oczekujące operacje zapisu, sprawdź system plików za pomocą fsck lub odpowiedniego narzędzia naprawczego przed ponownym użyciem.</entry>
    <entry lang="pl" key="FORMAT_STAGE_WRITING_DATA">Tworzenie danych wolumenu. Proszę czekać.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="ro" key="PIM_ARGON2_LARGE_WARNING">Ați ales o valoare MIP Argon2 mai mare decât valoarea implicită din VeraCrypt.\nAcest lucru poate necesita mai multă memorie și poate duce la o montare mult mai lentă.</entry>
    <entry lang="ro" key="PIM_ARGON2_SMALL_WARNING">Ați ales o valoare MIP Argon2 mai mică decât valoarea implicită din VeraCrypt. Dacă parola nu este suficient de puternică, acest lucru ar putea duce la o securitate mai slabă.\n\nConfirmați că utilizați o parolă puternică?</entry>
    <entry lang="ro" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Parola trebuie să conțină 20 sau mai multe caractere pentru a utiliza valoarea MIP Argon2 specificată. Parolele mai scurte pot fi utilizate numai dacă valoarea MIP Argon2 este 12 sau mai mare.</entry>
-    <entry lang="ro" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Montare volume NTFS cu driverul ntfs3 din kernelul Linux</entry>
-    <entry lang="ro" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Doar în Linux. Când este activat, VeraCrypt verifică dispozitivul virtual decriptat cu blkid -p și montează sistemele de fișiere NTFS detectate cu ntfs3 în loc de implementarea NTFS implicită. Dacă detectarea NTFS eșuează, VeraCrypt utilizează selecția automată normală a sistemului de fișiere. Dacă ntfs3 nu este disponibil sau este blocat de distribuție, montarea poate eșua. Această posibilitate de alegere poate evita blocările în suspendare sau hibernare cauzate de sistemele de fișiere FUSE înghețate în spațiul utilizatorului.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="ro" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Demontarea normală a volumului {0} a eșuat. Aceasta poate apărea când aplicațiile au încă fișiere sau foldere deschise pe volum sau când dispozitivul respectiv a fost deconectat și montarea a devenit învechită.\n\nDacă dispozitivul este încă conectat, alegeți Nu, închideți aplicațiile care folosesc volumul și reîncercați demontarea.\n\nDacă dispozitivul a fost deconectat sau montarea este învechită, VeraCrypt poate încerca curățarea de urgență prin detașarea întârziată a sistemului de fișiere și eliminarea sau programarea eliminării obiectelor nucleului VeraCrypt. Scrierile în așteptare ar putea eșua, datele s-ar putea pierde, iar curățarea ar putea rămâne în așteptare până când aplicațiile închid fișierele deschise. Verificați sistemul de fișiere cu fsck sau cu instrumentul de reparare corespunzător înainte de a-l utiliza din nou.\n\nContinuați?</entry>
    <entry lang="ro" key="LINUX_EMERGENCY_UNMOUNTED">Curățarea de urgență pentru volumul {0} a fost inițiată. Dacă volumul a fost deconectat, montarea era învechită sau existau scrieri în așteptare, verificați sistemul de fișiere cu fsck sau cu instrumentul de reparare corespunzător înainte de a-l reutiliza.</entry>
    <entry lang="ro" key="FORMAT_STAGE_WRITING_DATA">Se creează datele volumului. Așteptați.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="ru" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Монтировать тома NTFS с помощью драйвера ntfs3 ядра Linux</entry>
-    <entry lang="ru" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Только Linux. Если включено, VeraCrypt проверяет расшифрованное виртуальное устройство с помощью blkid -p и монтирует обнаруженные файловые системы NTFS с помощью драйвера ntfs3 вместо стандартного NTFS-бэкенда. Если NTFS не удалось определить, VeraCrypt использует обычный автоматический выбор файловой системы. Если ntfs3 недоступен или заблокирован дистрибутивом, монтирование может завершиться ошибкой. Эта необязательная настройка может предотвратить зависания при ждущем режиме или гибернации из-за замороженных файловых систем FUSE, работающих в пользовательском пространстве.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1669,8 +1669,9 @@
    <entry lang="zh-cn" key="PIM_ARGON2_LARGE_WARNING">您选择的 Argon2 PIM 值大于 VeraCrypt 的默认值。\n请注意，这可能需要更多内存，并导致挂载速度显著变慢。</entry>
    <entry lang="zh-cn" key="PIM_ARGON2_SMALL_WARNING">您选择的 Argon2 PIM 值小于 VeraCrypt 的默认值。请注意，如果您的密码强度不够，这可能导致安全性降低。\n\n您确认正在使用强密码吗？</entry>
    <entry lang="zh-cn" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">密码必须包含 20 个或更多字符，才能使用指定的 Argon2 PIM。\n较短的密码只有在 Argon2 PIM 大于或等于 12 时才能使用。</entry>
-    <entry lang="zh-cn" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">使用 Linux 内核 ntfs3 驱动程序挂载 NTFS 卷</entry>
-    <entry lang="zh-cn" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">仅限 Linux。启用后，VeraCrypt 会使用 blkid -p 探测解密的虚拟设备，并使用 ntfs3 挂载检测到的 NTFS 文件系统，而不是默认的 NTFS 后端。如果 NTFS 检测失败，VeraCrypt 将使用正常的自动文件系统选择。如果 ntfs3 不可用或被发行版阻止，挂载可能会失败。此手动启用选项可以避免因冻结的用户空间 FUSE 文件系统导致的挂起或休眠卡顿。</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="zh-cn" key="LINUX_EMERGENCY_UNMOUNT_WARNING">卷 {0} 的正常卸载失败。当应用程序仍在卷上打开文件或目录，或者后端设备已断开连接导致挂载状态失效时，可能会发生这种情况。\n\n如果设备仍处于连接状态，请选择“否”，关闭使用该卷的应用程序，然后再次尝试卸载。\n\n如果设备已断开连接或挂载状态已失效，VeraCrypt 可以尝试执行紧急清理：惰性脱离文件系统，并移除或安排移除 VeraCrypt 内核对象。待处理的写入可能已失败，数据可能丢失，并且清理操作可能保持挂起状态，直到应用程序关闭打开的文件。再次使用前，请使用 fsck 或相应的修复工具检查文件系统。\n\n继续？</entry>
    <entry lang="zh-cn" key="LINUX_EMERGENCY_UNMOUNTED">已对卷 {0} 启动紧急清理。如果卷已断开连接、挂载状态失效或存在待处理的写入操作，请在再次使用前使用 fsck 或相应的修复工具检查文件系统。</entry>
    <entry lang="zh-cn" key="FORMAT_STAGE_WRITING_DATA">正在创建卷数据。请稍候。</entry>
@@ -1683,11 +1684,11 @@
    <entry lang="zh-cn" key="FORMAT_STAGE_PREPARING_TEMP_DEVICE">正在完成卷创建：准备临时设备。</entry>
    <entry lang="zh-cn" key="FORMAT_STAGE_CREATING_FILESYSTEM">正在完成卷创建：使用 {0} 创建文件系统。</entry>
    <entry lang="zh-cn" key="FORMAT_STAGE_DISMOUNTING_TEMP_VOLUME">正在完成卷创建：卸载临时卷。</entry>
-    <entry lang="en" key="MACOSX_APFS_SYNTHESIZED_DEVICE">The selected device '{0}' is an APFS synthesized container or volume and cannot be used as a raw VeraCrypt volume host.\n\nSelect the physical APFS store partition{1} instead.</entry>
-    <entry lang="en" key="MACOSX_DEVICE_SYSTEM_PARTITION">The selected device '{0}' is a macOS system/support partition and cannot be used as a VeraCrypt volume host.</entry>
-    <entry lang="en" key="MACOSX_APFS_SYSTEM_STORE">The selected APFS physical store '{0}' contains the currently mounted macOS system volume and cannot be used as a VeraCrypt volume host.</entry>
-    <entry lang="en" key="MACOSX_DEVICE_NOT_WRITABLE">macOS reports the selected device '{0}' as read-only. Select a writable physical partition or disk.</entry>
-    <entry lang="en" key="MACOSX_APFS_EROFS_HINT">macOS reported the selected device as read-only. If this is an APFS disk, make sure you selected the physical APFS store partition, not an APFS synthesized volume. Use Disk Utility or 'diskutil list' to identify the physical partition, then retry.</entry>
+    <entry lang="zh-cn" key="MACOSX_APFS_SYNTHESIZED_DEVICE">所选设备 '{0}' 是 APFS 合成容器或卷，不能作为原始 VeraCrypt 卷的承载设备使用。\n\n请改选物理 APFS 存储分区{1}。</entry>
+    <entry lang="zh-cn" key="MACOSX_DEVICE_SYSTEM_PARTITION">所选设备 '{0}' 是 macOS 系统/支持分区，无法作为 VeraCrypt 卷主机使用。</entry>
+    <entry lang="zh-cn" key="MACOSX_APFS_SYSTEM_STORE">所选 APFS 物理存储 '{0}' 包含当前挂载的 macOS 系统卷，无法作为 VeraCrypt 卷主机使用。</entry>
+    <entry lang="zh-cn" key="MACOSX_DEVICE_NOT_WRITABLE">macOS 报告所选设备 '{0}' 为只读。请选择可写的物理分区或磁盘。</entry>
+    <entry lang="zh-cn" key="MACOSX_APFS_EROFS_HINT">macOS 报告所选设备为只读。如果这是 APFS 磁盘，请确保您选择的是物理 APFS 存储分区，而不是 APFS 合成卷。请使用“磁盘工具”或 'diskutil list' 来识别物理分区，然后重试。</entry>
  </localization>
  <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
    <xs:element name="VeraCrypt">
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -1668,8 +1668,9 @@
    <entry lang="en" key="PIM_ARGON2_LARGE_WARNING">You have chosen an Argon2 PIM value that is larger than VeraCrypt default value.\nPlease note that this can require more memory and lead to much slower mounting.</entry>
    <entry lang="en" key="PIM_ARGON2_SMALL_WARNING">You have chosen an Argon2 PIM value that is smaller than the default VeraCrypt value. Please note that if your password is not strong enough, this could lead to weaker security.\n\nDo you confirm that you are using a strong password?</entry>
    <entry lang="en" key="PIM_ARGON2_REQUIRE_LONG_PASSWORD">Password must contain 20 or more characters in order to use the specified Argon2 PIM.\nShorter passwords can only be used if the Argon2 PIM is 12 or greater.</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3">Mount NTFS volumes with the Linux kernel ntfs3 driver</entry>
-    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_NTFS3_HELP">Linux only. When enabled, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with ntfs3 instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If ntfs3 is unavailable or blocked by the distribution, mounting may fail. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER">Mount NTFS volumes with an in-kernel Linux driver</entry>
+    <entry lang="en" key="LINUX_PREF_MOUNT_NTFS_WITH_KERNEL_DRIVER_HELP">Linux only. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with blkid -p and mounts detected NTFS filesystems with an available in-kernel NTFS driver, bypassing mount helpers such as ntfs-3g. VeraCrypt uses ntfs when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses ntfs3. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. This opt-in option can avoid suspend or hibernate hangs caused by frozen user-space FUSE filesystems.</entry>
+    <entry lang="en" key="LINUX_KERNEL_NTFS_DRIVER_UNAVAILABLE">No supported in-kernel NTFS driver is available or loadable. To use the system default NTFS backend, disable the NTFS kernel-driver preference or do not request kernel NTFS explicitly.</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNT_WARNING">Normal unmount of volume {0} failed. This can happen when applications still have files or directories open on the volume, or when the backing device was disconnected and the mount became stale.\n\nIf the device is still connected, choose No, close applications using the volume, and try unmounting again.\n\nIf the device was disconnected or the mount is stale, VeraCrypt can attempt emergency cleanup by lazy-detaching the filesystem and removing or scheduling removal of VeraCrypt kernel objects. Pending writes may have failed, data may be lost, and cleanup may remain pending until applications close open files. Check the filesystem with fsck or the appropriate repair tool before using it again.\n\nContinue?</entry>
    <entry lang="en" key="LINUX_EMERGENCY_UNMOUNTED">Emergency cleanup for volume {0} has been initiated. If the volume was disconnected, the mount was stale, or there were pending writes, check the filesystem with fsck or the appropriate repair tool before using it again.</entry>
    <entry lang="en" key="FORMAT_STAGE_WRITING_DATA">Creating volume data. Please wait.</entry>
@@ -18,7 +18,6 @@ arrow_right.gif
 Authenticity and Integrity.html
 Authors.html
 Avoid Third-Party File Extensions.html
-bank_30x30.png
 BC_Logo_30x30.png
 BCH_Logo_30x30.png
 Beginner's Tutorial.html
@@ -18,7 +18,6 @@ arrow_right.gif
 Authenticity and Integrity.html
 Authors.html
 Avoid Third-Party File Extensions.html
-bank_30x30.png
 BC_Logo_30x30.png
 BCH_Logo_30x30.png
 Beginner's Tutorial.html
@@ -19,7 +19,6 @@ arrow_right.gif
 Authenticity and Integrity.html
 Authors.html
 Avoid Third-Party File Extensions.html
-bank_30x30.png
 BC_Logo_30x30.png
 BCH_Logo_30x30.png
 Beginner's Tutorial.html
@@ -88,7 +88,7 @@ The amount of memory used during the key derivation process, controlled by the P
 <strong>Range:</strong> 64 MiB to 1024 MiB (capped at PIM = 31)
 </li>
 <li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
-<strong>Default:</strong> 96 MiB (equivalent to PIM = 2)
+<strong>Default:</strong> 416 MiB (equivalent to PIM = 12)
 </li>
 </ul>

@@ -104,7 +104,7 @@ The number of iterations performed during the key derivation process:
 <strong>For PIM > 31:</strong> t_cost(pim) = 13 + (pim - 31)
 </li>
 <li style="text-align:left; margin-top:0px; margin-bottom:0px; padding-top:0px; padding-bottom:0px">
-<strong>Default:</strong> 3 iterations (equivalent to PIM = 2)
+<strong>Default:</strong> 6 iterations (equivalent to PIM = 12)
 </li>
 </ul>

@@ -165,7 +165,7 @@
 </tr>
 <tr>
 <td><em>--filesystem=TYPE</em></td>
-<td>Filesystem type to mount or create. For mounting, the type is passed to the system mount command. <em>none</em> disables filesystem mounting or creation. Supported creation types depend on the platform: Linux supports <em>FAT</em>, <em>Ext2</em>, <em>Ext3</em>, <em>Ext4</em>, <em>NTFS</em>, <em>exFAT</em>, and <em>Btrfs</em>; macOS supports <em>FAT</em>, <em>HFS</em>/<em>HFS+</em>/<em>MacOsExt</em>, <em>exFAT</em>, and <em>APFS</em>; FreeBSD and Solaris builds support <em>FAT</em> and <em>UFS</em>. Non-FAT creation requires the corresponding system formatter to be available.</td>
+<td>Filesystem type to mount or create. For mounting, the type is passed to the system mount command. <em>none</em> disables filesystem mounting or creation. On Linux, <em>ntfs3</em> pins the in-kernel ntfs3 driver and bypasses mount helpers, while <em>kernel-ntfs</em> selects an available in-kernel NTFS driver (<em>ntfs</em> or <em>ntfs3</em>). These Linux driver selectors are mount-only; use <em>NTFS</em> when creating a new NTFS volume. Supported creation types depend on the platform: Linux supports <em>FAT</em>, <em>Ext2</em>, <em>Ext3</em>, <em>Ext4</em>, <em>NTFS</em>, <em>exFAT</em>, and <em>Btrfs</em>; macOS supports <em>FAT</em>, <em>HFS</em>/<em>HFS+</em>/<em>MacOsExt</em>, <em>exFAT</em>, and <em>APFS</em>; FreeBSD and Solaris builds support <em>FAT</em> and <em>UFS</em>. Non-FAT creation requires the corresponding system formatter to be available.</td>
 </tr>
 <tr>
 <td><em>-f</em> or <em>--force</em></td>
@@ -197,7 +197,7 @@
 </tr>
 <tr>
 <td><em>-m OPTION1[,OPTION2,...]</em> or <em>--mount-options=OPTION1[,OPTION2,...]</em></td>
-<td>Set VeraCrypt volume mount options. Supported options are <em>headerbak</em>, <em>nokernelcrypto</em>, <em>readonly</em> or <em>ro</em>, <em>system</em>, and <em>timestamp</em> or <em>ts</em>.</td>
+<td>Set VeraCrypt volume mount options. Supported options are <em>headerbak</em>, <em>nokernelcrypto</em>, <em>readonly</em> or <em>ro</em>, <em>system</em>, and <em>timestamp</em> or <em>ts</em>. On Linux, <em>kernelntfs</em> enables in-kernel NTFS driver selection for the current mount when NTFS is detected and no filesystem type was supplied.</td>
 </tr>
 <tr>
 <td><em>--new-hash=HASH</em></td>
@@ -310,6 +310,8 @@
 <p><code>veracrypt -m ro -k keyfile1,keyfile2 volume.hc /media/veracrypt1</code></p>
 <p>Mount a volume without mounting its filesystem:</p>
 <p><code>veracrypt --filesystem=none volume.hc</code></p>
+<p>Mount an NTFS volume using a Linux in-kernel NTFS driver:</p>
+<p><code>veracrypt -t --filesystem=kernel-ntfs volume.hc /media/veracrypt1</code></p>
 <p>Mount a volume prompting only for its password:</p>
 <p><code>veracrypt -t -k "" --pim=0 --protect-hidden=no volume.hc /media/veracrypt1</code></p>
 <p>Mount a volume non-interactively and read the password from standard input:</p>
@@ -27,7 +27,7 @@

 <div class="wikidoc">
 <h1>Donation to VeraCrypt</h1>
-<p>You can support VeraCrypt development through donations using PayPal, bank transfers and cryptocurrencies (<a href="#Bitcoin">Bitcoin</a> and <a href="#Ethereum">Ethereum</a>). It is also possible to donate using Liberapay.</p>
+<p>You can support VeraCrypt development through donations using PayPal, cryptocurrencies (<a href="#Bitcoin">Bitcoin</a> and <a href="#Ethereum">Ethereum</a>) and Liberapay.</p>

 <hr>
 <h3><img src="paypal_30x30.png" style="vertical-align: middle; margin-right: 5px">PayPal</h3>
@@ -113,10 +113,6 @@
 </form>


-<hr>
-<h3><a href="Donation_Bank.html"><img src="bank_30x30.png" style="margin-right: 5px"></a>Bank Transfer</h3>
-<p>You can use <a href="Donation_Bank.html">AM Crypto bank details available here</a> to send your donations using bank transfers.
-
 <hr>
 <h3>Donation Platforms:</h3>
 <ul>
@@ -1,116 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta http-equiv="content-type" content="text/html; charset=utf-8" />
-<title>VeraCrypt - Free Open source disk encryption with strong security for the Paranoid</title>
-<meta name="description" content="VeraCrypt is free open-source disk encryption software for Windows, Mac OS X and Linux. In case an attacker forces you to reveal the password, VeraCrypt provides plausible deniability. In contrast to file encryption, data encryption performed by VeraCrypt is real-time (on-the-fly), automatic, transparent, needs very little memory, and does not involve temporary unencrypted files."/>
-<meta name="keywords" content="encryption, security"/>
-<link href="styles.css" rel="stylesheet" type="text/css" />
-</head>
-<body>
-
-<div>
-<a href="Documentation.html"><img src="VeraCrypt128x128.png" alt="VeraCrypt"/></a>
-</div>
-
-<div id="menu">
-	<ul>
-	  <li><a href="Home.html">Home</a></li>
-	  <li><a href="Code.html">Source Code</a></li>
-	  <li><a href="Downloads.html">Downloads</a></li>
-	  <li><a href="Documentation.html">Documentation</a></li>
-	  <li><a class="active" href="Donation.html">Donate</a></li>
-	  <li><a href="https://sourceforge.net/p/veracrypt/discussion/" target="_blank">Forums</a></li>
-	</ul>
-</div>
-
-<div class="wikidoc">
-<h1>Donation to VeraCrypt using bank transfer</h1>
-<p>You can support VeraCrypt development through donations using bank transfers to one of AM Crypto bank accounts below, depending on the currency used.<br>
-The supported currencies are <a href="#Euro">Euro<img src="flag-eu-small.png" style="vertical-align: top; margin-left: 5px"></a>, <a href="#USD">US Dollar<img src="flag-us-small.png" style="vertical-align: top; margin-left: 5px"></a>, <a href="#GBP">British Pound<img src="flag-gb-small.png" style="vertical-align: top; margin-left: 5px"></a>, <a href="#AUD">Australian Dollar<img src="flag-au-small.png" style="vertical-align: top; margin-left: 5px"></a> and <a href="#NZD">New Zealand Dollar<img src="flag-nz-small.png" style="vertical-align: top; margin-left: 5px"></a>.<br>
-Please <a href="Contact.html" target="_blank.html">contact us</a> if you need an official invoice for your donation.</p>
-<hr>
-<h3 id="Euro"><img src="flag-eu.png" style="vertical-align: middle; margin-right: 5px">Euro SEPA Bank Details</h3>
-<p>Accepted payment types are SEPA bank transferts or SWIFT in Euro only.</p>
-Account Holder: AM Crypto<br>
-IBAN: BE54 9053 4814 2097<br>
-Bank code (SWIFT / BIC): TRWIBEB1XXX<br>
-Address: Wise, Rue du Trône 100, 3rd floor, Brussels, 1050, Belgium<br>
-Reference: Open Source Donation<br>
-<hr>
-
-<h3 id="USD"><img src="flag-us.png" style="vertical-align: middle; margin-right: 5px">US Dollar Bank Details</h3>
-<p>From within the US, accepted payment types are ACH and Wire.</p>
-Account Holder: AM Crypto<br>
-Account number: 215667625228<br>
-ACH and Wire routing number: 101019628<br>
-Account Type: Checking<br>
-Address: Wise US Inc, 30 W. 26TH Street, Sixth Floor, New York, NY, 10010, United States<br>
-Reference: Open Source Donation<br>
-
-<p>From outside the US, accepted payment in SWIFT.</p>
-Account Holder: AM Crypto<br>
-Account number: 215667625228<br>
-Routing number: 101019628<br>
-Bank code (SWIFT/BIC): TRWIUS35XXX<br>
-Address: Wise US Inc, 30 W. 26TH Street, Sixth Floor, New York, NY, 10010, United States<br>
-Reference: Open Source Donation<br>
-<hr>
-
-<h3 id="GBP"><img src="flag-gb.png" style="vertical-align: middle; margin-right: 5px">British Pound Bank Details</h3>
-<p>Accepted payment types are Faster Payments (FPS), BACS and CHAPS from withing the UK only.</p>
-
-Account Holder: AM Crypto<br>
-Account number: 11930731<br>
-UK Sort Code: 23-08-01<br>
-IBAN (to receive GBP from UK only): GB35 TRWI 2308 0111 9307 31<br>
-Address: Wise Payments Limited, 1st Floor, Worship Square, 65 Clifton Street, London, EC2A 4JE, United Kingdom<br>
-Reference: Open Source Donation<br>
-<hr>
-
-<h3 id="AUD"><img src="flag-au.png" style="vertical-align: middle; margin-right: 5px">Australian Dollar Bank Details</h3>
-<p>Accepted payment types to this account are local AUD bank transfers only.</p>
-Account Holder: AM Crypto<br>
-Account number: 230232302<br>
-BSB Code: 774001<br>
-Address: Wise Australia Pty Ltd, Suite 1, Level 11, 66 Goulburn Street, Sydney, NSW, 2000, Australia.<br>
-Reference: Open Source Donation<br>
-<hr>
-
-<h3 id="NZD"><img src="flag-nz.png" style="vertical-align: middle; margin-right: 5px">New Zealand Dollar Bank Details</h3>
-<p>Accepted payment types to this account are local NZD bank transfers only.</p>
-Account Holder: AM Crypto<br>
-Account number: 04-2021-0294035-03<br>
-Address: Wise Payments Ltd. - New Zealand Branch, 1st Floor, Worship Square, 65 Clifton Street, London, EC2A 4JE, United Kingdom<br>
-Reference: Open Source Donation<br>
-<hr>
-
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-</div><div class="ClearBoth"></div></body></html>
@@ -53,7 +53,7 @@ Volumes</em> menu.<br>
 Default mount options can be configured in the main program preferences (<em>Settings -&gt; Preferences).</em></p>
 <h4>Filesystem mount options under Linux</h4>
 <p>Under Linux, the <em>Mount Options</em> dialog also contains a <em>Mount options</em> field for filesystem mount options. The value entered there is passed to the system <code>mount</code> command with <code>-o</code> when the filesystem inside the VeraCrypt volume is mounted. For example, entering <code>noatime</code> prevents Linux from updating inode access times on filesystems that support this option, reducing metadata writes caused only by file access. Multiple options can be specified as a comma-separated list, for example <code>noatime,nosuid,nodev</code>. Unsupported options are handled by the operating system and may cause mounting to fail.</p>
-<p>The Linux preference <em>Mount NTFS volumes with the Linux kernel ntfs3 driver</em> is disabled by default. When enabled, VeraCrypt probes the decrypted virtual device with <code>blkid -p</code> and mounts detected NTFS filesystems with the in-kernel <code>ntfs3</code> driver instead of the default NTFS backend. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If <code>ntfs3</code> is unavailable or blocked by the Linux distribution, mounting may fail. This opt-in option can help on systems where suspend or hibernation can hang if user-space FUSE filesystems such as <code>ntfs-3g</code>/<code>fuseblk</code> are frozen while the kernel is syncing filesystems. The actual mounted filesystem type can be checked with <code>findmnt</code>.</p>
+<p>The Linux preference <em>Mount NTFS volumes with an in-kernel Linux driver</em> is disabled by default. When enabled and no explicit filesystem type was supplied, VeraCrypt probes the decrypted virtual device with <code>blkid -p</code> and mounts detected NTFS filesystems with an available in-kernel NTFS driver instead of the default NTFS backend. VeraCrypt uses <code>ntfs</code> when it is positively identified as a modern read/write driver or expected on Linux 7.1 or later, and otherwise uses <code>ntfs3</code>. Mount helpers such as <code>mount.ntfs</code> and <code>ntfs-3g</code> are bypassed. If NTFS detection fails, VeraCrypt uses the normal automatic filesystem selection. If no supported in-kernel NTFS driver is available or loadable, mounting fails. On the command line, <code>--filesystem=ntfs3</code> pins the in-kernel ntfs3 driver, <code>--filesystem=kernel-ntfs</code> forces VeraCrypt's kernel-driver selection for an NTFS mount, and <code>-m kernelntfs</code> enables the detected-NTFS selection for the current mount. The <code>ntfs3</code> and <code>kernel-ntfs</code> filesystem selectors are mount-only; use <code>NTFS</code> when creating a new NTFS volume. This opt-in option can help on systems where suspend or hibernation can hang if user-space FUSE filesystems such as <code>ntfs-3g</code>/<code>fuseblk</code> are frozen while the kernel is syncing filesystems. The actual mounted filesystem type can be checked with <code>findmnt</code>.</p>
 <p>The command line equivalent is <code>veracrypt --fs-options=noatime &lt;volume&gt; &lt;mountpoint&gt;</code>.</p>
 <h4>Mount volume as read-only</h4>
 <p>When checked, it will not be possible to write any data to the mounted volume.</p>
@@ -39,6 +39,17 @@
 <span style="color:#ff0000;">To avoid hinting whether your volumes contain a hidden volume or not, or if you depend on plausible deniability when using hidden volumes/OS, then you must recreate both the outer and hidden volumes including system encryption and hidden OS, discarding existing volumes created prior to 1.18a version of VeraCrypt.</span></li>
 </p>

+<p><strong style="text-align:left">1.26.28</strong> (May 18<sup>th</sup>, 2026):</p>
+<ul>
+<li><strong>Linux:</strong>
+	<ul>
+	<li>Add in-kernel NTFS driver selection for NTFS mounts, including <code>--filesystem=kernel-ntfs</code> and <code>-m kernelntfs</code>.</li>
+	<li><code>--filesystem=ntfs3</code> now pins the kernel ntfs3 driver and bypasses mount helpers such as <code>mount.ntfs3</code>.</li>
+	<li>Translator note: the previous Linux ntfs3 preference strings were replaced by generic in-kernel NTFS driver strings and should be retranslated.</li>
+	</ul>
+</li>
+</ul>
+
 <p><strong style="text-align:left">1.26.27</strong> (September 20<sup>th</sup>, 2025):</p>
 <ul>
 <li><strong>All OSes:</strong>
@@ -73,6 +73,7 @@ Thus, when setting or entering your password, it's crucial to type it manually u
 <p>Note: By default, Windows 7 and later boot from a special small partition. The partition contains files that are required to boot the system. Windows allows only applications that have administrator privileges to write to the partition (when the system is
 running). In EFI boot mode, which is the default on modern PCs, VeraCrypt can not encrypt this partition since it must remain unencrypted so that the BIOS can load the EFI bootloader from it. This in turn implies that in EFI boot mode, VeraCrypt offers only to encrypt the system partition where Windows is installed (the user can later manually encrypt other data partitions using VeraCrypt).
 In MBR legacy boot mode, VeraCrypt encrypts the partition only if you choose to encrypt the whole system drive (as opposed to choosing to encrypt only the partition where Windows is installed).</p>
+<p>In EFI boot mode with Secure Boot enabled, VeraCrypt selects the installed Microsoft UEFI CA-signed bootloader set during install, repair, upgrade, or Windows PostOOBE repair. If you manually change firmware Secure Boot db entries, run VeraCrypt repair or reinstall to refresh the installed bootloader set.</p>
 <p>&nbsp;</p>
 <p><a href="Hidden%20Operating%20System.html" style="text-align:left; color:#0080c0; text-decoration:none; font-weight:bold">Next Section &gt;&gt;</a></p>
 </div>
@@ -93,6 +93,8 @@ To boot a VeraCrypt Rescue Disk, insert it into a USB port or your CD/DVD drive
 configuration screen appears, restart (reset) the computer again and start pressing F2 or Delete repeatedly as soon as you restart (reset) the computer. When a BIOS configuration screen appears, configure your BIOS to boot from the USB drive and CD/DVD drive first (for
 information on how to do so, please refer to the documentation for your BIOS/motherboard or contact your computer vendor's technical support team for assistance). Then restart your computer. The VeraCrypt Rescue Disk screen should appear now. Note: In the
 case of MBR legacy boot mode, you can select 'Repair Options' on the VeraCrypt Rescue Disk screen by pressing F8 on your keyboard.</div>
+<p>In EFI boot mode with Secure Boot enabled, the VeraCrypt Rescue Disk uses the Microsoft UEFI CA-signed bootloader set selected from the computer's current Secure Boot db state when the Rescue Disk is created. If firmware or Secure Boot db entries are later changed, create a new VeraCrypt Rescue Disk. A Rescue Disk created on a computer that trusts only one Microsoft UEFI CA generation may not Secure-Boot on a different computer that trusts only the other generation.</p>
+<p>Installed EFI bootloader files are refreshed only during VeraCrypt install, repair, upgrade, or Windows PostOOBE repair paths. If you manually change firmware Secure Boot db entries, run VeraCrypt repair or reinstall to refresh the installed bootloader set.</p>
 <p>If your VeraCrypt Rescue Disk is damaged, you can create a new one by selecting
 <em style="text-align:left">System</em> &gt; <em style="text-align:left">Create Rescue Disk</em>. To find out whether your VeraCrypt Rescue Disk is damaged, insert it into a USB port (or into your CD/DVD drive in case of MBR legacy boot mode) and select
 <em style="text-align:left">System</em> &gt; <em style="text-align:left">Verify Rescue Disk</em>.</p>
@@ -27,7 +27,7 @@

 <div class="wikidoc">
 <h1>Пожертвование на разработку VeraCrypt</h1>
-<p>Вы можете поддержать развитие VeraCrypt, отправив пожертвование с помощью PayPal, банковского перевода или криптовалюты (<a href="#Bitcoin">Bitcoin</a> и <a href="#Ethereum">Ethereum</a>). Также возможно отправить пожертвование с использованием платформы Liberapay.</p>
+<p>Вы можете поддержать развитие VeraCrypt, отправив пожертвование с помощью PayPal, криптовалюты (<a href="#Bitcoin">Bitcoin</a> и <a href="#Ethereum">Ethereum</a>) или платформы Liberapay.</p>

 <hr>
 <h3><img src="paypal_30x30.png" style="vertical-align: middle; margin-right: 5px">PayPal</h3>
@@ -112,10 +112,6 @@
 	<input type="submit" value="Пожертвовать" style="padding: 5px 15px; background-color: #08aad7; color: white; border: none; cursor: pointer;">
 </form>

-<hr>
-<h3><a href="Donation_Bank.html"><img src="bank_30x30.png" style="margin-right: 5px"></a>Банковский перевод</h3>
-<p>Чтобы отправить пожертвование через банковский перевод, используйте <a href="Donation_Bank.html">банковские данные AM Crypto</a>.
-
 <hr>
 <h3>Платформы для пожертвований:</h3>
 <ul>
@@ -1,116 +0,0 @@
-<!DOCTYPE html>
-<html lang="ru">
-<head>
-<meta http-equiv="content-type" content="text/html; charset=utf-8" />
-<title>VeraCrypt - Бесплатное надёжное шифрование дисков с открытым исходным кодом</title>
-<meta name="description" content="VeraCrypt это бесплатное программное обеспечение для шифрования дисков с открытым исходным кодом для Windows, Mac OS X (macOS) и Linux. В случае, если злоумышленник вынуждает вас раскрыть пароль, VeraCrypt обеспечивает правдоподобное отрицание наличия шифрования. В отличие от пофайлового шифрования, VeraCrypt шифрует данные в реальном времени (на лету), автоматически, прозрачно, требует очень мало памяти и не использует временные незашифрованные файлы."/>
-<meta name="keywords" content="encryption, security, шифрование, безопасность"/>
-<link href="styles.css" rel="stylesheet" type="text/css" />
-</head>
-<body>
-
-<div>
-<a href="Documentation.html"><img src="VeraCrypt128x128.png" alt="VeraCrypt"/></a>
-</div>
-
-<div id="menu">
-	<ul>
-	  <li><a href="Home.html">Начало</a></li>
-	  <li><a href="Code.html">Исходный код</a></li>
-	  <li><a href="Downloads.html">Загрузить</a></li>
-	  <li><a href="Documentation.html">Документация</a></li>
-	  <li><a class="active" href="Donation.html">Поддержать разработку</a></li>
-	  <li><a href="https://sourceforge.net/p/veracrypt/discussion/" target="_blank">Форум</a></li>
-	</ul>
-</div>
-
-<div class="wikidoc">
-<h1>Пожертвование на развитие VeraCrypt с помощью банковского перевода</h1>
-<p>Вы можете поддержать развитие VeraCrypt, отправив пожертвование посредством банковского перевода на один из перечисленных ниже банковских счетов AM Crypto, в зависимости от валюты.<br>
-Поддерживаемые валюты: <a href="#Euro">евро<img src="flag-eu-small.png" style="vertical-align: top; margin-left: 5px"></a>, <a href="#USD">доллар США<img src="flag-us-small.png" style="vertical-align: top; margin-left: 5px"></a>, <a href="#GBP">британский фунт<img src="flag-gb-small.png" style="vertical-align: top; margin-left: 5px"></a>, <a href="#AUD">австралийский доллар<img src="flag-au-small.png" style="vertical-align: top; margin-left: 5px"></a> и <a href="#NZD">новозеландский доллар<img src="flag-nz-small.png" style="vertical-align: top; margin-left: 5px"></a>.<br>
-<a href="Contact.html" target="_blank.html">Свяжитесь с нами</a>, если вам нужен официальный счёт для вашего пожертвования.</p>
-<hr>
-<h3 id="Euro"><img src="flag-eu.png" style="vertical-align: middle; margin-right: 5px">Евро SEPA – банковские детали</h3>
-<p>Принимаемые типы платежей: SEPA bank transferts или SWIFT только в евро.</p>
-Владелец счёта: AM Crypto<br>
-IBAN: BE54 9053 4814 2097<br>
-Банковский код (SWIFT / BIC): TRWIBEB1XXX<br>
-Адрес: Wise, Rue du Trône 100, 3rd floor, Brussels, 1050, Belgium<br>
-Назначение: Open Source Donation<br>
-<hr>
-
-<h3 id="USD"><img src="flag-us.png" style="vertical-align: middle; margin-right: 5px">Доллар США – банковские детали</h3>
-<p>Из США, принимаемые типы платежей: ACH и Wire.</p>
-Владелец счёта: AM Crypto<br>
-Номер счёта: 215667625228<br>
-Номер маршрута ACH и Wire: 101019628<br>
-Тип счёта: Checking<br>
-Адрес: Wise US Inc, 30 W. 26th Street, Sixth Floor, New York NY, 10010, United States<br>
-Назначение: Open Source Donation<br>
-
-<p>Не из США, принимаемые типы платежей: SWIFT.</p>
-Владелец счёта: AM Crypto<br>
-Номер счёта: 215667625228<br>
-Номер маршрута: 101019628<br>
-Банковский код (SWIFT/BIC): TRWIUS35XXX<br>
-Адрес: Wise US Inc, 30 W. 26th Street, Sixth Floor, New York NY, 10010, United States<br>
-Назначение: Open Source Donation<br>
-<hr>
-
-<h3 id="GBP"><img src="flag-gb.png" style="vertical-align: middle; margin-right: 5px">Британский фунт стерлингов – банковские детали</h3>
-<p>Принимаемые типы платежей: Faster Payments (FPS), BACS и CHAPS только из Великобритании.</p>
-
-Владелец счёта: AM Crypto<br>
-Номер счёта: 11930731<br>
-Код Великобритании: 23-08-01<br>
-IBAN (для получения GBP только из Великобритании): GB35 TRWI 2308 0111 9307 31<br>
-Адрес: Wise Payments Limited, 1st Floor, Worship Square, 65 Clifton Street, London, EC2A 4JE, United Kingdom<br>
-Назначение: Open Source Donation<br>
-<hr>
-
-<h3 id="AUD"><img src="flag-au.png" style="vertical-align: middle; margin-right: 5px">Австралийский доллар – банковские детали</h3>
-<p>Принимаемые типы платежей: только локальные банковские переводы AUD.</p>
-Владелец счёта: AM Crypto<br>
-Номер счёта: 230232302<br>
-Код BSB: 774001<br>
-Адрес: Wise Australia Pty Ltd, Suite 1, Level 11, 66 Goulburn Street, Sydney, NSW, 2000, Australia.<br>
-Назначение: Open Source Donation<br>
-<hr>
-
-<h3 id="NZD"><img src="flag-nz.png" style="vertical-align: middle; margin-right: 5px">Новозеландский доллар – банковские детали</h3>
-<p>Принимаемые типы платежей: только локальные банковские переводы NZD.</p>
-Владелец счёта: AM Crypto<br>
-Номер счёта: 04-2021-0294035-03<br>
-Адрес: Wise Payments Ltd. - New Zealand Branch, 1st Floor, Worship Square, 65 Clifton Street, London, EC2A 4JE, United Kingdom<br>
-Назначение: Open Source Donation<br>
-<hr>
-
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-</div><div class="ClearBoth"></div></body></html>
@@ -62,12 +62,22 @@
 параметр, что уменьшает записи метаданных, вызванные только доступом к файлам. Несколько параметров можно
 указать через запятую, например <code>noatime,nosuid,nodev</code>. Неподдерживаемые параметры обрабатываются
 операционной системой и могут привести к ошибке монтирования.</p>
-<p>Настройка Linux <em>Монтировать тома NTFS с помощью драйвера ntfs3 ядра Linux</em> по умолчанию отключена.
-Если она включена, VeraCrypt проверяет расшифрованное виртуальное устройство с помощью <code>blkid -p</code> и
-монтирует обнаруженные файловые системы NTFS с помощью встроенного в ядро драйвера <code>ntfs3</code> вместо
-стандартного NTFS-бэкенда. Если определить NTFS не удалось, VeraCrypt использует обычный автоматический выбор
-файловой системы. Если <code>ntfs3</code> недоступен или заблокирован дистрибутивом Linux, монтирование может
-завершиться ошибкой. Эта необязательная настройка может помочь на системах, где ждущий режим или гибернация
+<p>Настройка Linux <em>Монтировать тома NTFS с помощью встроенного в ядро драйвера Linux</em> по умолчанию отключена.
+Если она включена и явный тип файловой системы не указан, VeraCrypt проверяет расшифрованное виртуальное
+устройство с помощью <code>blkid -p</code> и
+монтирует обнаруженные файловые системы NTFS с помощью доступного встроенного в ядро драйвера вместо
+стандартного NTFS-бэкенда. VeraCrypt использует <code>ntfs</code>, когда он положительно определен как
+современный драйвер с чтением и записью или ожидается в Linux 7.1 и новее; иначе используется
+<code>ntfs3</code>. Вспомогательные программы монтирования,
+такие как <code>mount.ntfs</code> и <code>ntfs-3g</code>, обходятся. Если определить NTFS не удалось, VeraCrypt
+использует обычный автоматический выбор файловой системы. Если поддерживаемый встроенный в ядро драйвер NTFS
+недоступен или не может быть загружен, монтирование завершается ошибкой. В командной строке
+<code>--filesystem=ntfs3</code> закрепляет встроенный в ядро драйвер <code>ntfs3</code>,
+<code>--filesystem=kernel-ntfs</code> принудительно включает выбор драйвера ядра VeraCrypt для монтирования NTFS, а
+<code>-m kernelntfs</code> включает выбор по обнаруженной NTFS для текущего монтирования.
+Селекторы файловой системы <code>ntfs3</code> и <code>kernel-ntfs</code> предназначены только для монтирования;
+при создании нового тома NTFS используйте <code>NTFS</code>.
+Эта необязательная настройка может помочь на системах, где ждущий режим или гибернация
 зависают, если файловые системы FUSE, работающие в пользовательском пространстве, такие как
 <code>ntfs-3g</code>/<code>fuseblk</code>, заморожены во время синхронизации файловых систем ядром.
 Фактический тип смонтированной файловой системы можно
@@ -27,7 +27,7 @@

 <div class="wikidoc">
 <h1>向VeraCrypt捐赠</h1>
-<p>您可以通过PayPal、银行转账和加密货币（<a href="#Bitcoin">比特币</a>和<a href="#Ethereum">以太坊</a>）进行捐赠，以支持VeraCrypt的开发。也可以使用Liberapay进行捐赠。</p>
+<p>您可以通过PayPal、加密货币（<a href="#Bitcoin">比特币</a>和<a href="#Ethereum">以太坊</a>）和Liberapay进行捐赠，以支持VeraCrypt的开发。</p>

 <hr>
 <h3><img src="paypal_30x30.png" style="vertical-align: middle; margin-right: 5px">PayPal</h3>
@@ -113,10 +113,6 @@
 </form>


-<hr>
-<h3><a href="Donation_Bank.html"><img src="bank_30x30.png" style="margin-right: 5px"></a>银行转账</h3>
-<p>您可以使用<a href="Donation_Bank.html">此处提供的AM Crypto银行信息</a>通过银行转账进行捐赠。
-
 <hr>
 <h3>捐赠平台：</h3>
 <ul>
@@ -157,4 +153,4 @@
 <p>&nbsp;</p>
 <p>&nbsp;</p>
 <p>&nbsp;</p>
-</div><div class="ClearBoth"></div></body></html>
+</div><div class="ClearBoth"></div></body></html>
@@ -1,116 +0,0 @@
-<!DOCTYPE html>
-<html lang="zh-CN">
-<head>
-<meta http-equiv="content-type" content="text/html; charset=utf-8" />
-<title>VeraCrypt - 为偏执者提供强大安全保障的免费开源磁盘加密工具</title>
-<meta name="description" content="VeraCrypt是一款适用于Windows、Mac OS X和Linux的免费开源磁盘加密软件。若攻击者强迫您透露密码，VeraCrypt可提供似是而非的否认。与文件加密不同，VeraCrypt进行的数据加密是实时（即时）、自动、透明的，占用内存极少，且不涉及临时未加密文件。"/>
-<meta name="keywords" content="加密, 安全"/>
-<link href="styles.css" rel="stylesheet" type="text/css" />
-</head>
-<body>
-
-<div>
-<a href="Documentation.html"><img src="VeraCrypt128x128.png" alt="VeraCrypt"/></a>
-</div>
-
-<div id="menu">
-    <ul>
-      <li><a href="Home.html">主页</a></li>
-      <li><a href="Code.html">源代码</a></li>
-      <li><a href="Downloads.html">下载</a></li>
-      <li><a href="Documentation.html">文档</a></li>
-      <li><a class="active" href="Donation.html">捐赠</a></li>
-      <li><a href="https://sourceforge.net/p/veracrypt/discussion/" target="_blank">论坛</a></li>
-    </ul>
-</div>
-
-<div class="wikidoc">
-<h1>通过银行转账向VeraCrypt捐赠</h1>
-<p>您可以通过向以下AM Crypto银行账户之一进行银行转账来支持VeraCrypt的开发，具体取决于所使用的货币。<br>
-支持的货币有 <a href="#Euro">欧元<img src="flag-eu-small.png" style="vertical-align: top; margin-left: 5px"></a>、<a href="#USD">美元<img src="flag-us-small.png" style="vertical-align: top; margin-left: 5px"></a>、<a href="#GBP">英镑<img src="flag-gb-small.png" style="vertical-align: top; margin-left: 5px"></a>、<a href="#AUD">澳元<img src="flag-au-small.png" style="vertical-align: top; margin-left: 5px"></a> 和 <a href="#NZD">新西兰元<img src="flag-nz-small.png" style="vertical-align: top; margin-left: 5px"></a>。<br>
-如果您需要捐赠的正式发票，请 <a href="Contact.html" target="_blank.html">联系我们</a>。</p>
-<hr>
-<h3 id="Euro"><img src="flag-eu.png" style="vertical-align: middle; margin-right: 5px">欧元SEPA银行信息</h3>
-<p>接受的付款方式仅为欧元的SEPA银行转账或SWIFT转账。</p>
-账户持有人：AM Crypto<br>
-国际银行账户号码（IBAN）：BE54 9053 4814 2097<br>
-银行代码（SWIFT / BIC）：TRWIBEB1XXX<br>
-地址：Wise, Rue du Trône 100, 3rd floor, Brussels, 1050, Belgium<br>
-参考信息：Open Source Donation<br>
-<hr>
-
-<h3 id="USD"><img src="flag-us.png" style="vertical-align: middle; margin-right: 5px">美元银行信息</h3>
-<p>在美国境内，接受的付款方式为ACH转账和电汇。</p>
-账户持有人：AM Crypto<br>
-账户号码：215667625228<br>
-ACH和电汇路由号码：101019628<br>
-账户类型：支票账户<br>
-地址：Wise US Inc, 30 W. 26TH Street, Sixth Floor, New York, NY, 10010, United States<br>
-参考信息：Open Source Donation<br>
-
-<p>在美国境外，接受的付款方式为SWIFT转账。</p>
-账户持有人：AM Crypto<br>
-账户号码：215667625228<br>
-路由号码：101019628<br>
-银行代码（SWIFT/BIC）：TRWIUS35XXX<br>
-地址：Wise US Inc, 30 W. 26TH Street, Sixth Floor, New York, NY, 10010, United States<br>
-参考信息：Open Source Donation<br>
-<hr>
-
-<h3 id="GBP"><img src="flag-gb.png" style="vertical-align: middle; margin-right: 5px">英镑银行信息</h3>
-<p>接受的付款方式仅为英国境内的快速支付（FPS）、BACS和CHAPS转账。</p>
-
-账户持有人：AM Crypto<br>
-账户号码：11930731<br>
-英国银行排序代码：23-08-01<br>
-国际银行账户号码（仅用于接收来自英国的英镑）：GB35 TRWI 2308 0111 9307 31<br>
-地址：Wise Payments Limited, 1st Floor, Worship Square, 65 Clifton Street, London, EC2A 4JE, United Kingdom<br>
-参考信息：Open Source Donation<br>
-<hr>
-
-<h3 id="AUD"><img src="flag-au.png" style="vertical-align: middle; margin-right: 5px">澳元银行信息</h3>
-<p>此账户仅接受本地澳元银行转账。</p>
-账户持有人：AM Crypto<br>
-账户号码：230232302<br>
-澳大利亚银行清算代码（BSB）：774001<br>
-地址：Wise Australia Pty Ltd, Suite 1, Level 11, 66 Goulburn Street, Sydney, NSW, 2000, Australia.<br>
-参考信息：Open Source Donation<br>
-<hr>
-
-<h3 id="NZD"><img src="flag-nz.png" style="vertical-align: middle; margin-right: 5px">新西兰元银行信息</h3>
-<p>此账户仅接受本地新西兰元银行转账。</p>
-账户持有人：AM Crypto<br>
-账户号码：04-2021-0294035-03<br>
-地址：Wise Payments Ltd. - New Zealand Branch, 1st Floor, Worship Square, 65 Clifton Street, London, EC2A 4JE, United Kingdom<br>
-参考信息：Open Source Donation<br>
-<hr>
-
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-<p>&nbsp;</p>
-</div><div class="ClearBoth"></div></body></html>
@@ -1,5 +1,5 @@
 # - Minimum CMake version
-cmake_minimum_required(VERSION 2.8.0)
+cmake_minimum_required(VERSION 2.8.12...3.10)

 # - Obligatory parameters
 #		-DVERACRYPT_BUILD_DIR 	: folder that contains 'usr' folder
@@ -27,6 +27,34 @@ else()
 endif()
 project(${PROJECT_NAME})

+# SOURCE_DATE_EPOCH for the cpack-driven DEB pipeline.
+# Precedence: -DSOURCE_DATE_EPOCH=N, env, git HEAD, fixed fallback.
+# Re-exported to ENV so dpkg-deb/tar inherit it.
+if(NOT DEFINED SOURCE_DATE_EPOCH)
+    if(DEFINED ENV{SOURCE_DATE_EPOCH})
+        set(SOURCE_DATE_EPOCH "$ENV{SOURCE_DATE_EPOCH}")
+    else()
+        execute_process(
+            COMMAND git -C "$ENV{SOURCEPATH}" log -1 --pretty=%ct
+            OUTPUT_VARIABLE _git_ct
+            OUTPUT_STRIP_TRAILING_WHITESPACE
+            ERROR_QUIET
+            RESULT_VARIABLE _git_rc)
+        if(_git_rc EQUAL 0 AND _git_ct)
+            set(SOURCE_DATE_EPOCH "${_git_ct}")
+        else()
+            set(SOURCE_DATE_EPOCH "1577836800")
+        endif()
+    endif()
+endif()
+if(NOT SOURCE_DATE_EPOCH MATCHES "^[0-9]+$")
+    MESSAGE(FATAL_ERROR "SOURCE_DATE_EPOCH must be a non-negative Unix timestamp")
+endif()
+message(STATUS "SOURCE_DATE_EPOCH = ${SOURCE_DATE_EPOCH}")
+set(ENV{SOURCE_DATE_EPOCH} "${SOURCE_DATE_EPOCH}")
+# Avoid nondeterministic ordering from cpack 3.18+ parallel compression.
+set(CPACK_THREADS 1)
+
 # - Check whether 'Tcdefs.h' and 'License.txt' exist
 if(NOT EXISTS "$ENV{SOURCEPATH}/Common/Tcdefs.h")
 	MESSAGE(FATAL_ERROR "Tcdefs.h does not exist.")
@@ -248,10 +276,25 @@ if ( ( PLATFORM STREQUAL "Debian" ) OR ( PLATFORM STREQUAL "Ubuntu" ) )
 	
 	# Debian control script(s)
 	file( MAKE_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/Packaging/debian-control)
+	configure_file(		${CMAKE_CURRENT_SOURCE_DIR}/Packaging/debian-control/postinst 	${CMAKE_CURRENT_BINARY_DIR}/Packaging/debian-control/postinst)
 	configure_file(		${CMAKE_CURRENT_SOURCE_DIR}/Packaging/debian-control/prerm 		${CMAKE_CURRENT_BINARY_DIR}/Packaging/debian-control/prerm)
+	set( DEBIAN_POSTINST ${CMAKE_CURRENT_BINARY_DIR}/Packaging/debian-control/postinst)
 	set( DEBIAN_PRERM 	${CMAKE_CURRENT_BINARY_DIR}/Packaging/debian-control/prerm)
 	
 	set( CPACK_GENERATOR 					"DEB" )																				# mandatory
+
+	# Reproducible DEB: clamp the just-installed staging tree's mtimes
+	# and modes so the payload is independent of wall-clock time and
+	# the build umask. Placed AFTER install(DIRECTORY) so it runs against a
+	# populated tree (install rules execute in declaration order). The script
+	# acts only on a real package staging root and refuses a live prefix;
+	# see the script header for the staging-root detection rules.
+	configure_file(
+		"${CMAKE_CURRENT_SOURCE_DIR}/Tools/cmake_repro_clamp_mtimes.cmake.in"
+		"${CMAKE_CURRENT_BINARY_DIR}/cmake_repro_clamp_mtimes.cmake"
+		@ONLY)
+	install(SCRIPT "${CMAKE_CURRENT_BINARY_DIR}/cmake_repro_clamp_mtimes.cmake")
+
 	set( CPACK_DEBIAN_PACKAGE_NAME 			${CPACK_PACKAGE_NAME}  )															# mandatory
 	set( CPACK_DEBIAN_FILE_NAME 			${CPACK_PACKAGE_FILE_NAME}.deb )													# mandatory
 	# -- Use a distro-specific version string to avoid repository conflicts --
@@ -277,7 +320,12 @@ if ( ( PLATFORM STREQUAL "Debian" ) OR ( PLATFORM STREQUAL "Ubuntu" ) )
 		set(VC_DEBIAN_USE_T64 TRUE)
 	endif ()
 	if (VC_WITH_FUSE3)
-		set(VC_DEBIAN_FUSE_PACKAGE "libfuse3-3")
+		if (   ( ( PLATFORM STREQUAL "Debian" ) AND ( PLATFORM_VERSION VERSION_GREATER_EQUAL "13" ) )
+			OR ( ( PLATFORM STREQUAL "Ubuntu" ) AND ( PLATFORM_VERSION VERSION_GREATER_EQUAL "25.10" ) ) )
+			set(VC_DEBIAN_FUSE_PACKAGE "libfuse3-4")
+		else ()
+			set(VC_DEBIAN_FUSE_PACKAGE "libfuse3-3")
+		endif ()
 	else ()
 		if (VC_DEBIAN_USE_T64)
 			set(VC_DEBIAN_FUSE_PACKAGE "libfuse2t64")
@@ -338,7 +386,9 @@ elseif ( ( PLATFORM STREQUAL "CentOS" ) OR ( PLATFORM STREQUAL "openSUSE" ) OR (
 	
 	# RPM control script(s)
 	file( MAKE_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/Packaging/rpm-control)
+	configure_file(	${CMAKE_CURRENT_SOURCE_DIR}/Packaging/rpm-control/postinstall.sh 	${CMAKE_CURRENT_BINARY_DIR}/Packaging/rpm-control/postinstall.sh)
 	configure_file(	${CMAKE_CURRENT_SOURCE_DIR}/Packaging/rpm-control/prerm.sh 		${CMAKE_CURRENT_BINARY_DIR}/Packaging/rpm-control/prerm.sh)
+	set( RPM_POSTINSTALL ${CMAKE_CURRENT_BINARY_DIR}/Packaging/rpm-control/postinstall.sh)
 	set( RPM_PRERM 	${CMAKE_CURRENT_BINARY_DIR}/Packaging/rpm-control/prerm.sh)
 	
 	set( CPACK_GENERATOR 				"RPM" )																					# mandatory
@@ -353,6 +403,7 @@ elseif ( ( PLATFORM STREQUAL "CentOS" ) OR ( PLATFORM STREQUAL "openSUSE" ) OR (
 	set( CPACK_RPM_PACKAGE_GROUP 		"Applications/System" )																	# mandatory, https://fedoraproject.org/wiki/RPMGroups
 	set( CPACK_RPM_PACKAGE_VENDOR 		${CPACK_PACKAGE_VENDOR} )																# mandatory
 	set( CPACK_RPM_PACKAGE_AUTOREQ 		"no" ) 																					# disable automatic shared libraries dependency detection (most of the time buggy)
+
 	if (VC_WITH_FUSE3)
 		set(VC_RPM_FUSE_PACKAGE "fuse3")
 	else ()
@@ -373,6 +424,7 @@ elseif ( ( PLATFORM STREQUAL "CentOS" ) OR ( PLATFORM STREQUAL "openSUSE" ) OR (
 	endif()

 	set( CPACK_RPM_PRE_UNINSTALL_SCRIPT_FILE 			${RPM_PRERM})															# optional
+	set( CPACK_RPM_POST_INSTALL_SCRIPT_FILE 			${RPM_POSTINSTALL})														# optional
 	
 	# Prevents CPack from generating file conflicts
 	# This is to avoid having %dir of these directories in the .spec file
@@ -119,7 +119,18 @@ TR_SED_BIN := tr '\n' ' ' | tr -s ' ' ',' | sed -e 's/^,//g' -e 's/,$$/n/' | tr
 -include $(OBJS:.o=.d) $(OBJSEX:.oo=.d) $(OBJSNOOPT:.o0=.d) $(OBJSHANI:.oshani=.d) $(OBJAESNI:.oaesni=.d) $(OBJSSSE41:.osse41=.d) $(OBJSSSSE3:.ossse3=.d) $(OBJSAVX2:.oavx2=.d) $(OBJARMV8CRYPTO:.oarmv8crypto=.d)


+# Deterministic static library: the 'D' modifier zeroes member mtime/uid/gid
+# and 'ranlib -D' writes a deterministic index. Both are probed functionally
+# (running them on a throwaway archive) rather than by parsing --help, whose
+# wording varies between binutils versions. Very old binutils that lack the
+# feature simply falls back to a normal, still-correct archive.
+# Probe also covers BSD ar / macOS libtool ar (neither supports -D): both
+# variables come out empty there and the original ar/ranlib calls are used.
+AR_DETERMINISTIC := $(shell t=$$(mktemp); rm -f $$t.a; $(AR) Drc $$t.a $$t >/dev/null 2>&1 && echo D; rm -f $$t $$t.a)
+RANLIB_DETERMINISTIC := $(shell t=$$(mktemp); rm -f $$t.a; $(AR) rc $$t.a $$t >/dev/null 2>&1; $(RANLIB) -D $$t.a >/dev/null 2>&1 && echo -D; rm -f $$t $$t.a)
+
 $(NAME).a: $(OBJS) $(OBJSEX) $(OBJSNOOPT) $(OBJSHANI) $(OBJAESNI) $(OBJSSSE41) $(OBJSSSSE3) $(OBJSAVX2) $(OBJARMV8CRYPTO)
 	@echo Updating library $@
-	$(AR) $(AFLAGS) -rc $@ $(OBJS) $(OBJSEX) $(OBJSNOOPT) $(OBJSHANI) $(OBJAESNI) $(OBJSSSE41) $(OBJSSSSE3) $(OBJSAVX2) $(OBJARMV8CRYPTO)
-	$(RANLIB) $@
+	rm -f $@
+	$(AR) $(AFLAGS) $(AR_DETERMINISTIC)rc $@ $(OBJS) $(OBJSEX) $(OBJSNOOPT) $(OBJSHANI) $(OBJAESNI) $(OBJSSSE41) $(OBJSSSSE3) $(OBJSAVX2) $(OBJARMV8CRYPTO)
+	$(RANLIB) $(RANLIB_DETERMINISTIC) $@
@@ -0,0 +1,24 @@
+VERSION_FILE := ../../../Common/Tcdefs.h
+PKGBUILD_RELEASE := PKGBUILD.release
+PKGBUILD_RELEASE_TEMPLATE := PKGBUILD.release.in
+
+.PHONY: pkgbuild-release
+pkgbuild-release: $(PKGBUILD_RELEASE)
+
+$(PKGBUILD_RELEASE): $(PKGBUILD_RELEASE_TEMPLATE) $(VERSION_FILE)
+	@version="$$(awk -F '"' '/^[[:space:]]*#define[[:space:]]+VERSION_STRING[[:space:]]*"/ { print $$2; exit }' "$(VERSION_FILE)")"; \
+	if [ -z "$$version" ]; then \
+		echo "Unable to read VERSION_STRING from $(VERSION_FILE)" >&2; \
+		exit 1; \
+	fi; \
+	{ \
+		printf '%s\n' '# Maintainer: VeraCrypt upstream'; \
+		printf '%s\n' '# DO NOT EDIT: generated from PKGBUILD.release.in by `make pkgbuild-release`.'; \
+		sed -e '1,2d' -e "s/@VERSION@/$$version/g" "$(PKGBUILD_RELEASE_TEMPLATE)"; \
+	} > "$(PKGBUILD_RELEASE)"
+
+.PHONY: clean
+clean:
+	@if [ -d pkg ]; then rm -rf -- pkg; fi
+	@if [ -d src ]; then rm -rf -- src; fi
+	rm -f -- $(PKGBUILD_RELEASE) *.pkg.tar* *.log
@@ -0,0 +1,71 @@
+# Maintainer: VeraCrypt upstream
+
+pkgname=veracrypt
+# This in-tree PKGBUILD is sourced by makepkg from the checkout. It is not
+# suitable for AUR submission or static PKGBUILD parsers.
+_pkgbuild_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+_veracrypt_root="$(cd "${_pkgbuild_dir}/../../../.." && pwd)"
+pkgver="$(awk -F '"' '/^[[:space:]]*#define[[:space:]]+VERSION_STRING[[:space:]]*"/ { print $2; exit }' "${_veracrypt_root}/src/Common/Tcdefs.h")"
+pkgrel=1
+pkgdesc='Disk encryption with strong security based on TrueCrypt'
+url='https://www.veracrypt.jp/'
+arch=(x86_64 aarch64 armv7h)
+license=('LicenseRef-TrueCrypt AND Apache-2.0')
+depends=(
+  device-mapper
+  fuse2
+  gcc-libs
+  glibc
+  libsm
+  wxwidgets-common
+  wxwidgets-gtk3
+)
+optdepends=(
+  'pcsclite: EMV and smart card keyfile support'
+  'sudo: mounting encrypted volumes as nonroot users'
+)
+makedepends=(
+  pcsclite
+)
+makedepends_x86_64=(
+  yasm
+)
+source=()
+sha512sums=()
+
+build() {
+  cd "${_veracrypt_root}/src"
+  make PKG_CONFIG_PATH=/usr/lib/pkgconfig \
+    WX_CONFIG=/usr/bin/wx-config \
+    TC_EXTRA_LFLAGS="${LDFLAGS}" \
+    TC_EXTRA_CXXFLAGS="${CXXFLAGS} ${CPPFLAGS}" \
+    TC_EXTRA_CFLAGS="${CFLAGS} ${CPPFLAGS}" \
+    NOTEST=1 \
+    clean
+
+  make PKG_CONFIG_PATH=/usr/lib/pkgconfig \
+    WX_CONFIG=/usr/bin/wx-config \
+    TC_EXTRA_LFLAGS="${LDFLAGS}" \
+    TC_EXTRA_CXXFLAGS="${CXXFLAGS} ${CPPFLAGS}" \
+    TC_EXTRA_CFLAGS="${CFLAGS} ${CPPFLAGS}" \
+    NOTEST=1 \
+    NOSTRIP=1
+}
+
+check() {
+  cd "${_veracrypt_root}/src"
+  ./Main/veracrypt --text --test >/dev/null
+}
+
+package() {
+  cd "${_veracrypt_root}/src"
+  make DESTDIR="${pkgdir}" \
+    INSTALL_UNINSTALLER=0 \
+    INSTALL_APPIMAGE_FILES=0 \
+    INSTALL_MOUNT_HELPER_DIR=bin \
+    INSTALL_LICENSE_DIR="share/licenses/${pkgname}" \
+    NOSTRIP=1 \
+    install
+}
+
+# vim: ts=2 sw=2 et:
@@ -0,0 +1,82 @@
+# Template for generated PKGBUILD.release.
+# Edit this file and run `make pkgbuild-release`.
+
+pkgname=veracrypt
+pkgver=@VERSION@
+pkgrel=1
+pkgdesc='Disk encryption with strong security based on TrueCrypt'
+url='https://www.veracrypt.jp/'
+arch=(x86_64 aarch64 armv7h)
+license=('LicenseRef-TrueCrypt AND Apache-2.0')
+depends=(
+  device-mapper
+  fuse2
+  gcc-libs
+  glibc
+  libsm
+  wxwidgets-common
+  wxwidgets-gtk3
+)
+optdepends=(
+  'pcsclite: EMV and smart card keyfile support'
+  'sudo: mounting encrypted volumes as nonroot users'
+)
+makedepends=(
+  pcsclite
+)
+makedepends_x86_64=(
+  yasm
+)
+_source_archive="VeraCrypt_${pkgver}_Source.tar.bz2"
+source=(
+  "https://launchpad.net/veracrypt/trunk/${pkgver}/+download/${_source_archive}"
+  "https://launchpad.net/veracrypt/trunk/${pkgver}/+download/${_source_archive}.sig"
+)
+validpgpkeys=(
+  5069A233D55A0EEB174A5FC3821ACD02680D16DE
+)
+# Replace only the source archive SKIP with the published SHA-512 before publishing.
+# The .sig checksum should remain SKIP because makepkg verifies it as a PGP signature.
+sha512sums=(
+  'SKIP'
+  'SKIP'
+)
+
+prepare() {
+  local source_version
+
+  source_version="$(awk -F '"' '/^[[:space:]]*#define[[:space:]]+VERSION_STRING[[:space:]]*"/ { print $2; exit }' "${srcdir}/src/Common/Tcdefs.h")"
+  if [[ "${source_version}" != "${pkgver}" ]]; then
+    printf 'PKGBUILD pkgver (%s) does not match source VERSION_STRING (%s)\n' "${pkgver}" "${source_version}" >&2
+    return 1
+  fi
+}
+
+build() {
+  cd "${srcdir}/src"
+  make PKG_CONFIG_PATH=/usr/lib/pkgconfig \
+    WX_CONFIG=/usr/bin/wx-config \
+    TC_EXTRA_LFLAGS="${LDFLAGS}" \
+    TC_EXTRA_CXXFLAGS="${CXXFLAGS} ${CPPFLAGS}" \
+    TC_EXTRA_CFLAGS="${CFLAGS} ${CPPFLAGS}" \
+    NOTEST=1 \
+    NOSTRIP=1
+}
+
+check() {
+  cd "${srcdir}/src"
+  ./Main/veracrypt --text --test >/dev/null
+}
+
+package() {
+  cd "${srcdir}/src"
+  make DESTDIR="${pkgdir}" \
+    INSTALL_UNINSTALLER=0 \
+    INSTALL_APPIMAGE_FILES=0 \
+    INSTALL_MOUNT_HELPER_DIR=bin \
+    INSTALL_LICENSE_DIR="share/licenses/${pkgname}" \
+    NOSTRIP=1 \
+    install
+}
+
+# vim: ts=2 sw=2 et:
@@ -0,0 +1,60 @@
+# Arch Linux packaging
+
+This directory contains two Arch Linux build paths:
+
+- `PKGBUILD` packages the current VeraCrypt checkout without downloading
+  sources. Use this for in-tree builds before a release source archive is
+  published.
+- `PKGBUILD.release` packages the official release source archive. Use this as
+  the basis for clean chroot builds and downstream Arch packaging after the
+  release archive is published. It is generated from `PKGBUILD.release.in` and
+  is intentionally not committed.
+
+To build and install a package from the current checkout:
+
+```sh
+cd src/Build/Packaging/arch
+makepkg -si
+```
+
+The package build uses VeraCrypt's normal GNU Make build, stages files through
+`make install DESTDIR=...`, omits the generic self-uninstaller and
+AppImage-specific staging files, installs the HTML documentation for offline
+Help, installs the mount helper under `/usr/bin` for Arch's merged `/usr` layout,
+and places the license under `/usr/share/licenses/veracrypt`. This is deliberate:
+`mount(8)` looks for `/sbin/mount.<type>` helpers, and Arch's `/sbin` symlink to
+`/usr/bin` makes `/usr/bin/mount.veracrypt` resolve through that compatibility
+path while keeping package-owned binaries in `/usr/bin`.
+
+The in-tree `PKGBUILD` intentionally uses the checked-out source tree, so it is
+not the file to submit to the AUR or other package repositories and is not
+suitable for static PKGBUILD parsers or clean chroot builds that only copy
+declared `source=()` inputs. Run static packaging tools against the generated
+`PKGBUILD.release` instead. It runs `make clean` before each build and writes
+normal VeraCrypt build artifacts into the checkout. The `clean` target in this
+directory removes only Arch packaging artifacts and the generated
+`PKGBUILD.release`; it does not clean the upstream VeraCrypt build tree or
+`Setup/Linux/usr`.
+
+The PKGBUILDs run VeraCrypt's self-test from `check()`. Use `makepkg --nocheck`
+only for cross or emulated builds where the target binary cannot run.
+
+For a release build, wait until the official source archive exists, then run:
+
+```sh
+make pkgbuild-release
+```
+
+Replace only the first temporary `SKIP` checksum in `PKGBUILD.release` with the
+published SHA-512 checksum for the source archive. Leave the `.sig` checksum as
+`SKIP`; makepkg uses it for PGP verification. Coordinate changes with the
+official Arch package maintainer when targeting Arch's official repositories. If
+copying `PKGBUILD.release` to an AUR-style packaging repository, regenerate
+`.SRCINFO`:
+
+```sh
+makepkg --printsrcinfo > .SRCINFO
+```
+
+Use `PKGBUILD.release` for reproducible-build checks; byte-identical packages
+should be built from the same release archive rather than a live checkout.
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+rm -f \
+	/usr/share/doc/veracrypt/HTML/en/Donation_Bank.html \
+	/usr/share/doc/veracrypt/HTML/en/bank_30x30.png \
+	/usr/share/doc/veracrypt/HTML/ru/Donation_Bank.html \
+	/usr/share/doc/veracrypt/HTML/ru/bank_30x30.png \
+	/usr/share/doc/veracrypt/HTML/zh-cn/Donation_Bank.html \
+	/usr/share/doc/veracrypt/HTML/zh-cn/bank_30x30.png || true
+
+exit 0
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+rm -f \
+	/usr/share/doc/veracrypt/HTML/en/Donation_Bank.html \
+	/usr/share/doc/veracrypt/HTML/en/bank_30x30.png \
+	/usr/share/doc/veracrypt/HTML/ru/Donation_Bank.html \
+	/usr/share/doc/veracrypt/HTML/ru/bank_30x30.png \
+	/usr/share/doc/veracrypt/HTML/zh-cn/Donation_Bank.html \
+	/usr/share/doc/veracrypt/HTML/zh-cn/bank_30x30.png || true
+
+exit 0
@@ -0,0 +1,108 @@
+# Copyright (c) 2026 VeraCrypt
+# Governed by the Apache License 2.0.
+#
+# Run at install time by install(SCRIPT ...) AFTER all install(DIRECTORY)
+# rules, so the staging tree is fully populated. Clamps every file's mtime
+# and permission bits so the CPack DEB payload is reproducible.
+#
+# Safety: only a package staging tree may be modified, never a live host
+# tree. Two recognised staging conventions:
+#   1. CPack: it installs into its private
+#      <build>/_CPack_Packages/.../<pkg>${CPACK_PACKAGING_INSTALL_PREFIX}
+#      directory, exposed here as CMAKE_INSTALL_PREFIX. We require the
+#      path to contain a "_CPack_Packages" component.
+#   2. "make DESTDIR=<dir> install" style: $ENV{DESTDIR} is a non-live
+#      staging root and $ENV{DESTDIR}${CMAKE_INSTALL_PREFIX} is clamped.
+# Anything else (bare "cmake --install" into /usr or /usr/local) is
+# refused so root cannot rewrite mtimes/modes outside a package build.
+
+if(NOT CMAKE_HOST_SYSTEM_NAME STREQUAL "Linux")
+    return()
+endif()
+
+set(_destdir "$ENV{DESTDIR}")
+set(_prefix "${CMAKE_INSTALL_PREFIX}")
+
+if(NOT _destdir STREQUAL "")
+    get_filename_component(_destdir_abs "${_destdir}" ABSOLUTE)
+    foreach(_live_destdir "/" "/usr" "/usr/local" "/opt")
+        if(_destdir_abs STREQUAL "${_live_destdir}")
+            message(FATAL_ERROR "Reproducible build: refusing to clamp live "
+                                "DESTDIR '${_destdir}'")
+        endif()
+    endforeach()
+    set(_staging "${_destdir}${_prefix}")
+elseif(_prefix MATCHES "/_CPack_Packages/")
+    set(_staging "${_prefix}")
+else()
+    message(STATUS "Reproducible build: not a package staging install "
+                   "(DESTDIR empty and prefix '${_prefix}' is not a CPack "
+                   "staging tree); skipping mtime/mode clamp")
+    return()
+endif()
+get_filename_component(_staging "${_staging}" ABSOLUTE)
+
+if(NOT IS_DIRECTORY "${_staging}")
+    message(STATUS "Reproducible build: staging root '${_staging}' absent, "
+                   "skipping mtime/mode clamp")
+    return()
+endif()
+
+# SOURCE_DATE_EPOCH is baked in by configure_file-style substitution from
+# the parent CMakeLists (see install(SCRIPT) call site).
+set(_epoch "@SOURCE_DATE_EPOCH@")
+if(NOT _epoch MATCHES "^[0-9]+$")
+    message(FATAL_ERROR "Reproducible build: SOURCE_DATE_EPOCH must be a "
+                        "non-negative Unix timestamp")
+endif()
+
+# Probe GNU touch on a private temp file, not /dev/null: /dev/null is
+# root-owned, so probing it fails for normal users and rewrites the
+# device node's mtime as root (the bug the review flagged).
+execute_process(
+    COMMAND mktemp
+    OUTPUT_VARIABLE _probe
+    OUTPUT_STRIP_TRAILING_WHITESPACE
+    RESULT_VARIABLE _mktemp_rc)
+if(NOT _mktemp_rc EQUAL 0)
+    message(STATUS "Reproducible build: mktemp failed, skipping mtime clamp")
+    return()
+endif()
+execute_process(
+    COMMAND touch --no-dereference --date=@0 "${_probe}"
+    RESULT_VARIABLE _touch_rc
+    OUTPUT_QUIET ERROR_QUIET)
+file(REMOVE "${_probe}")
+if(NOT _touch_rc EQUAL 0)
+    message(STATUS "Reproducible build: GNU touch unavailable, "
+                   "skipping mtime clamp")
+    return()
+endif()
+
+# Normalise permission bits first: the make-side prepare creates staging
+# dirs with "mkdir -p" (umask-dependent) and CPack's tar records those
+# modes verbatim via USE_SOURCE_PERMISSIONS, so umask 027 -> 0750 vs
+# umask 022 -> 0755 breaks reproducibility. Match the legacy tar's
+# --mode=go-w,a+rX: dirs/exes 0755, regular files 0644.
+execute_process(
+    COMMAND find "${_staging}" -type d -exec chmod 0755 {} +
+    RESULT_VARIABLE _cd_rc OUTPUT_QUIET ERROR_QUIET)
+execute_process(
+    COMMAND find "${_staging}" -type f -perm -u+x -exec chmod 0755 {} +
+    RESULT_VARIABLE _cx_rc OUTPUT_QUIET ERROR_QUIET)
+execute_process(
+    COMMAND find "${_staging}" -type f -not -perm -u+x -exec chmod 0644 {} +
+    RESULT_VARIABLE _cf_rc OUTPUT_QUIET ERROR_QUIET)
+
+# Clamp mtimes last so this is the final metadata write.
+execute_process(
+    COMMAND find "${_staging}" -exec
+        touch --no-dereference --date=@${_epoch} {} +
+    RESULT_VARIABLE _find_rc
+    OUTPUT_QUIET ERROR_QUIET)
+
+if(_find_rc EQUAL 0 AND _cd_rc EQUAL 0 AND _cx_rc EQUAL 0 AND _cf_rc EQUAL 0)
+    message(STATUS "Reproducible build: clamped mtimes and modes under ${_staging}")
+else()
+    message(WARNING "Reproducible build: mtime/mode clamp incomplete under ${_staging}")
+endif()
@@ -0,0 +1,55 @@
+#!/usr/bin/env python3
+#
+# Copyright (c) 2026 VeraCrypt
+# Governed by the Apache License 2.0.
+#
+# Zero the gzip mtime in a makeself archive and refresh its integrity
+# fields. makeself runs `gzip -c9 < tmpfile' which writes tmpfile's
+# mtime into the gzip header (gzip ignores SOURCE_DATE_EPOCH for
+# redirected stdin), so the installer is otherwise not reproducible.
+#
+# After editing the payload the recorded checksums are refreshed:
+#   - CRCsum is set to "0000000000". Makeself stores a POSIX cksum(1)
+#     value there, not a zlib CRC-32 (the two differ); an all-zero
+#     CRCsum makes its extractor skip the redundant CRC check.
+#   - MD5 is recomputed, which the extractor still verifies.
+#
+# Usage: makeself_repro_finalize.py <archive>
+
+import hashlib
+import re
+import sys
+
+
+def finalize(path):
+    with open(path, "rb") as f:
+        raw = bytearray(f.read())
+    text = raw.decode("latin1", errors="replace")
+    # Locate payload start by line count, mirroring makeself's own extractor.
+    m = re.search(r'^skip="(\d+)"', text, re.MULTILINE)
+    if not m:
+        sys.exit(f"{path}: no skip= line in makeself header")
+    skip = int(m.group(1))
+    header_text = "\n".join(text.split("\n")[:skip]) + "\n"
+    offset = len(header_text.encode("latin1"))
+    if bytes(raw[offset:offset + 3]) != b"\x1f\x8b\x08":
+        sys.exit(f"{path}: no gzip magic at payload offset {offset}")
+    # gzip header mtime: 4-byte LE uint at offset+4 (RFC 1952 section 2.3.1).
+    raw[offset + 4:offset + 8] = b"\x00\x00\x00\x00"
+    payload = bytes(raw[offset:])
+    new_md5 = hashlib.md5(payload).hexdigest()
+    # CRCsum -> all zeros (extractor then skips the CRC check); MD5 -> fresh.
+    new_header = re.sub(r'CRCsum="[^"]*"', 'CRCsum="0000000000"', header_text)
+    new_header = re.sub(r'MD5="[0-9a-fA-F]+"', f'MD5="{new_md5}"', new_header)
+    new_bytes = new_header.encode("latin1")
+    # Line count must stay the same so makeself's "skip=" remains accurate.
+    if new_bytes.count(b"\n") != skip:
+        sys.exit(f"{path}: header line count changed during rewrite")
+    with open(path, "wb") as f:
+        f.write(new_bytes + payload)
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 2:
+        sys.exit("Usage: makeself_repro_finalize.py <archive>")
+    finalize(sys.argv[1])
@@ -9,6 +9,26 @@
 # Errors should cause script to exit
 set -e

+# Deterministic umask: dpkg-deb records the mode of the temporary ar
+# members (debian-binary, control.tar.gz, data.tar.gz) it creates, so a
+# caller umask of 027 yields 0640 where 022 yields 0644 and the .deb is
+# not reproducible. Pin it for the whole packaging run.
+umask 022
+
+# Compute and export SOURCE_DATE_EPOCH so cmake/cpack inherit it (they get
+# an empty env from this shell otherwise). Precedence: caller, git HEAD,
+# fallback constant matching src/Makefile and CMakeLists.txt.
+if [ -z "${SOURCE_DATE_EPOCH:-}" ]; then
+    SOURCE_DATE_EPOCH=$(git -C "$(dirname "$0")/../.." log -1 --pretty=%ct 2>/dev/null || echo 1577836800)
+fi
+case "$SOURCE_DATE_EPOCH" in
+    ''|*[!0-9]*)
+        echo "Error: SOURCE_DATE_EPOCH must be a non-negative Unix timestamp" >&2
+        exit 1
+        ;;
+esac
+export SOURCE_DATE_EPOCH
+
 # Absolute path to this script
 export SCRIPT=$(readlink -f "$0")
 # Absolute path this script is in
@@ -158,8 +178,8 @@ rm -rf $PARENTDIR/VeraCrypt_Packaging
 mkdir -p $PARENTDIR/VeraCrypt_Packaging/GUI
 mkdir -p $PARENTDIR/VeraCrypt_Packaging/Console

-cmake -H$SCRIPTPATH -B$PARENTDIR/VeraCrypt_Packaging/GUI -DVERACRYPT_BUILD_DIR="$PARENTDIR/VeraCrypt_Setup/GUI" -DNOGUI=FALSE $FUSE3_CMAKE_FLAG || exit 1
+cmake -H$SCRIPTPATH -B$PARENTDIR/VeraCrypt_Packaging/GUI -DVERACRYPT_BUILD_DIR="$PARENTDIR/VeraCrypt_Setup/GUI" -DNOGUI=FALSE -DSOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH $FUSE3_CMAKE_FLAG || exit 1
 cpack --config $PARENTDIR/VeraCrypt_Packaging/GUI/CPackConfig.cmake || exit 1

-cmake -H$SCRIPTPATH -B$PARENTDIR/VeraCrypt_Packaging/Console -DVERACRYPT_BUILD_DIR="$PARENTDIR/VeraCrypt_Setup/Console" -DNOGUI=TRUE $FUSE3_CMAKE_FLAG || exit 1
+cmake -H$SCRIPTPATH -B$PARENTDIR/VeraCrypt_Packaging/Console -DVERACRYPT_BUILD_DIR="$PARENTDIR/VeraCrypt_Setup/Console" -DNOGUI=TRUE -DSOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH $FUSE3_CMAKE_FLAG || exit 1
 cpack --config $PARENTDIR/VeraCrypt_Packaging/Console/CPackConfig.cmake || exit 1
@@ -9,6 +9,9 @@
 # Errors should cause script to exit
 set -e

+# Keep staged RPM payload permissions independent of the caller's umask.
+umask 022
+
 # Absolute path to this script
 export SCRIPT=$(readlink -f "$0")
 # Absolute path this script is in
@@ -9,6 +9,9 @@
 # Errors should cause script to exit
 set -e

+# Keep staged RPM payload permissions independent of the caller's umask.
+umask 022
+
 # Absolute path to this script
 export SCRIPT=$(readlink -f "$0")
 # Absolute path this script is in
@@ -437,6 +437,33 @@ DWORD BaseCom::GetSecureBootConfig (BOOL* pSecureBootEnabled, BOOL *pVeraCryptKe
 	return ERROR_SUCCESS;
 }

+DWORD BaseCom::GetEfiBootLoaderSigningSupport (BOOL* pMicrosoft2023UefiCAsSupported)
+{
+	if (!pMicrosoft2023UefiCAsSupported)
+		return ERROR_INVALID_PARAMETER;
+
+	try
+	{
+		BootEncryption bootEnc (NULL);
+		bootEnc.GetEfiBootLoaderSigningSupport (pMicrosoft2023UefiCAsSupported);
+	}
+	catch (SystemException &)
+	{
+		return GetLastError();
+	}
+	catch (Exception &e)
+	{
+		e.Show (NULL);
+		return ERROR_EXCEPTION_IN_SERVICE;
+	}
+	catch (...)
+	{
+		return ERROR_EXCEPTION_IN_SERVICE;
+	}
+
+	return ERROR_SUCCESS;
+}
+
 DWORD BaseCom::WriteEfiBootSectorUserConfig (DWORD userConfig, BSTR customUserMessage, int pim, int hashAlg)
 {
 	if (!customUserMessage)
@@ -119,6 +119,7 @@ public:
 	static DWORD WriteEfiBootSectorUserConfig (DWORD userConfig, BSTR customUserMessage, int pim, int hashAlg);
 	static DWORD UpdateSetupConfigFile (BOOL bForInstall);
 	static DWORD GetSecureBootConfig (BOOL* pSecureBootEnabled, BOOL *pVeraCryptKeysLoaded);
+	static DWORD GetEfiBootLoaderSigningSupport (BOOL* pMicrosoft2023UefiCAsSupported);
 	static DWORD NotifyService (DWORD dwNotifyCode);
 	static DWORD FastFileResize (BSTR filePath, __int64 fileSize);

@@ -631,6 +631,18 @@ namespace VeraCrypt
 			}
 		}

+		static void GetEfiBootLoaderSigningSupport (BOOL* pMicrosoft2023UefiCAsSupported)
+		{
+			Elevate();
+
+			DWORD result = ElevatedComInstance->GetEfiBootLoaderSigningSupport (pMicrosoft2023UefiCAsSupported);
+			if (result != ERROR_SUCCESS)
+			{
+				SetLastError (result);
+				throw SystemException(SRC_POS);
+			}
+		}
+
 		static void WriteEfiBootSectorUserConfig (uint8 userConfig, const string &customUserMessage, int pim, int hashAlg)
 		{
 			Elevate();
@@ -755,6 +767,7 @@ namespace VeraCrypt
 		static void WriteEfiBootSectorUserConfig (uint8 userConfig, const string &customUserMessage, int pim, int hashAlg) { throw ParameterIncorrect (SRC_POS); }
 		static void UpdateSetupConfigFile (bool bForInstall) { throw ParameterIncorrect (SRC_POS); }
 		static void GetSecureBootConfig (BOOL* pSecureBootEnabled, BOOL *pVeraCryptKeysLoaded) { throw ParameterIncorrect (SRC_POS); }
+		static void GetEfiBootLoaderSigningSupport (BOOL* pMicrosoft2023UefiCAsSupported) { throw ParameterIncorrect (SRC_POS); }
 		static void RegisterSystemFavoritesService(BOOL registerService) { throw ParameterIncorrect(SRC_POS); }
 		static BOOL IsPagingFileActive(BOOL checkNonWindowsPartitionsOnly) { throw ParameterIncorrect(SRC_POS); }
 		static void WriteLocalMachineRegistryDwordValue(wchar_t* keyPath, wchar_t* valueName, DWORD value) { throw ParameterIncorrect(SRC_POS); }
@@ -2504,6 +2517,530 @@ namespace VeraCrypt
 	}

 	static const wchar_t*	EfiVarGuid = L"{8BE4DF61-93CA-11D2-AA0D-00E098032B8C}";
+	static const wchar_t*	EfiImageSecurityDatabaseGuid = L"{D719B2CB-3D3A-4596-A3BC-DAD00E67656F}";
+
+	struct EfiBootLoaderResourceSet
+	{
+		int DcsBoot;
+		int DcsInt;
+		int DcsCfg;
+		int LegacySpeaker;
+		int DcsRescue;
+		int DcsInfo;
+	};
+
+	struct EfiBootLoaderImages
+	{
+		uint8 *DcsBoot;
+		DWORD SizeDcsBoot;
+		uint8 *DcsInt;
+		DWORD SizeDcsInt;
+		uint8 *DcsCfg;
+		DWORD SizeDcsCfg;
+		uint8 *LegacySpeaker;
+		DWORD SizeLegacySpeaker;
+		uint8 *DcsRescue;
+		DWORD SizeDcsRescue;
+		uint8 *DcsInfo;
+		DWORD SizeDcsInfo;
+		DWORD ResourceSet;
+		const wchar_t *SelectionReason;
+		DWORD FirmwareDbError;
+	};
+
+	struct EfiBootLoaderResourceSelection
+	{
+		const EfiBootLoaderResourceSet *Resources;
+		DWORD ResourceSet;
+		const wchar_t *Reason;
+		DWORD FirmwareDbError;
+	};
+
+	static const EfiBootLoaderResourceSet EfiBootLoaderResources2011 =
+	{
+		IDR_EFI_DCSBOOT_2011,
+		IDR_EFI_DCSINT_2011,
+		IDR_EFI_DCSCFG_2011,
+		IDR_EFI_LEGACYSPEAKER_2011,
+		IDR_EFI_DCSRE_2011,
+		IDR_EFI_DCSINFO_2011
+	};
+
+	static const EfiBootLoaderResourceSet EfiBootLoaderResources2023 =
+	{
+		IDR_EFI_DCSBOOT_2023,
+		IDR_EFI_DCSINT_2023,
+		IDR_EFI_DCSCFG_2023,
+		IDR_EFI_LEGACYSPEAKER_2023,
+		IDR_EFI_DCSRE_2023,
+		IDR_EFI_DCSINFO_2023
+	};
+
+	static const wchar_t *EfiBootLoaderDiagnosticsRegistryKey = L"Software\\VeraCrypt\\Diagnostics\\EfiBootLoader";
+
+	static bool ReadFirmwareEnvironmentVariableBuffer (const wchar_t* name, const wchar_t* guid, std::vector<uint8>& value, DWORD* pLastError = NULL)
+	{
+		bool bRet = false;
+		DWORD dwError = ERROR_SUCCESS;
+		BOOL bPrivilegesSet = IsPrivilegeEnabled (SE_SYSTEM_ENVIRONMENT_NAME);
+		BOOL bPrivilegeEnabled = FALSE;
+		const DWORD maxBufferSize = 16 * 1024 * 1024;
+		DWORD bufferSize = 16384;
+
+		value.clear ();
+		if (pLastError)
+			*pLastError = ERROR_SUCCESS;
+
+		if (!bPrivilegesSet)
+		{
+			if (!SetPrivilege (SE_SYSTEM_ENVIRONMENT_NAME, TRUE))
+			{
+				dwError = GetLastError ();
+				if (dwError == ERROR_SUCCESS)
+					dwError = ERROR_PRIVILEGE_NOT_HELD;
+				if (pLastError)
+					*pLastError = dwError;
+				SetLastError (dwError);
+				return false;
+			}
+
+			bPrivilegeEnabled = TRUE;
+		}
+
+		try
+		{
+			while (bufferSize <= maxBufferSize)
+			{
+				value.resize (bufferSize);
+
+				SetLastError (ERROR_SUCCESS);
+				DWORD dwLen = GetFirmwareEnvironmentVariableW (name, guid, value.data(), bufferSize);
+				if (dwLen != 0)
+				{
+					value.resize (dwLen);
+					bRet = true;
+					break;
+				}
+
+				dwError = GetLastError ();
+				if (dwError == ERROR_SUCCESS)
+				{
+					value.resize (0);
+					bRet = true;
+					break;
+				}
+
+				if ((dwError != ERROR_INSUFFICIENT_BUFFER) || (bufferSize == maxBufferSize))
+					break;
+
+				bufferSize = (bufferSize > (maxBufferSize / 2)) ? maxBufferSize : (bufferSize * 2);
+			}
+		}
+		catch (...)
+		{
+			if (bPrivilegeEnabled)
+				SetPrivilege (SE_SYSTEM_ENVIRONMENT_NAME, FALSE);
+
+			throw;
+		}
+
+		if (bPrivilegeEnabled)
+			SetPrivilege (SE_SYSTEM_ENVIRONMENT_NAME, FALSE);
+
+		if (!bRet)
+		{
+			value.clear ();
+			if (dwError == ERROR_SUCCESS)
+				dwError = GetLastError ();
+			if (dwError == ERROR_SUCCESS)
+				dwError = ERROR_INVALID_DATA;
+			if (pLastError)
+				*pLastError = dwError;
+			SetLastError (dwError);
+		}
+
+		return bRet;
+	}
+
+	static EfiBootLoaderResourceSelection MakeEfiBootLoaderResourceSelection (const EfiBootLoaderResourceSet& resources, DWORD resourceSet, const wchar_t *reason, DWORD firmwareDbError)
+	{
+		EfiBootLoaderResourceSelection selection = { &resources, resourceSet, reason, firmwareDbError };
+		return selection;
+	}
+
+	static void RecordEfiBootLoaderResourceSetSelection (const EfiBootLoaderImages& images)
+	{
+		if (!images.ResourceSet || !images.SelectionReason)
+			return;
+
+		DWORD previousLastError = GetLastError ();
+		WCHAR selectionTimeUtc[32] = {0};
+		SYSTEMTIME systemTime;
+		GetSystemTime (&systemTime);
+		StringCchPrintfW (selectionTimeUtc, ARRAYSIZE (selectionTimeUtc), L"%04u-%02u-%02uT%02u:%02u:%02uZ",
+			systemTime.wYear, systemTime.wMonth, systemTime.wDay, systemTime.wHour, systemTime.wMinute, systemTime.wSecond);
+
+		WriteLocalMachineRegistryDword ((wchar_t *) EfiBootLoaderDiagnosticsRegistryKey, L"EfiBootLoaderResourceSet", images.ResourceSet);
+		WriteLocalMachineRegistryDword ((wchar_t *) EfiBootLoaderDiagnosticsRegistryKey, L"EfiBootLoaderFirmwareDbLastError", images.FirmwareDbError);
+		WriteLocalMachineRegistryString (EfiBootLoaderDiagnosticsRegistryKey, L"EfiBootLoaderSelectionReason", images.SelectionReason, FALSE);
+		WriteLocalMachineRegistryString (EfiBootLoaderDiagnosticsRegistryKey, L"EfiBootLoaderSelectionTimeUtc", selectionTimeUtc, FALSE);
+		SetLastError (previousLastError);
+	}
+
+	static uint32 ReadUint32LittleEndian (const uint8* buffer)
+	{
+		return (uint32) buffer[0]
+			| ((uint32) buffer[1] << 8)
+			| ((uint32) buffer[2] << 16)
+			| ((uint32) buffer[3] << 24);
+	}
+
+	static bool BufferEquals (const uint8* buffer, const uint8* expected, size_t expectedSize)
+	{
+		// Callers of this overload must first verify that buffer contains at least expectedSize bytes.
+		return memcmp (buffer, expected, expectedSize) == 0;
+	}
+
+	static bool BufferEquals (const uint8* buffer, size_t bufferSize, const uint8* expected, size_t expectedSize)
+	{
+		return (bufferSize == expectedSize) && BufferEquals (buffer, expected, expectedSize);
+	}
+
+	static bool FirmwareDbBufferContainsMicrosoft2023UefiCAs (const std::vector<uint8>& db)
+	{
+		// Microsoft documents these CAs as valid db entries in EFI_CERT_X509_GUID or EFI_CERT_RSA2048_GUID form:
+		// https://learn.microsoft.com/windows-hardware/manufacture/desktop/windows-secure-boot-key-creation-and-management-guidance
+		// EFI_CERT_X509_GUID {a5c059a1-94e4-4aa7-87b5-ab155c2bf072}
+		static const uint8 efiCertX509Guid[16] = { 0xA1, 0x59, 0xC0, 0xA5, 0xE4, 0x94, 0xA7, 0x4A, 0x87, 0xB5, 0xAB, 0x15, 0x5C, 0x2B, 0xF0, 0x72 };
+		// EFI_CERT_RSA2048_GUID {3c5766e8-269c-4e34-aa14-ed776e85b3b6}
+		static const uint8 efiCertRsa2048Guid[16] = { 0xE8, 0x66, 0x57, 0x3C, 0x9C, 0x26, 0x34, 0x4E, 0xAA, 0x14, 0xED, 0x77, 0x6E, 0x85, 0xB3, 0xB6 };
+		const size_t efiRsa2048KeySize = 256;
+
+		// X.509 entries are matched by embedded CA public-key modulus bytes; RSA2048 entries contain this modulus directly.
+		// This is a byte-presence heuristic for bootloader-set selection, not full certificate-chain validation.
+		// Microsoft UEFI CA 2023, SHA-1 thumbprint B5EEB4A6706048073F0ED296E7F580A790B59EAA.
+		// DER source: https://go.microsoft.com/fwlink/?linkid=2239872, SHA-256 F6124E34125BEE3FE6D79A574EAA7B91C0E7BD9D929C1A321178EFD611DAD901.
+		static const uint8 microsoftUefiCa2023Rsa2048Modulus[256] =
+		{
+			0xBD, 0x22, 0x2A, 0xAE, 0xEF, 0x1A, 0x31, 0x85,
+			0x13, 0x78, 0x51, 0xA7, 0x9B, 0xFD, 0xFC, 0x78,
+			0xD1, 0x63, 0xB8, 0x1A, 0x9B, 0x63, 0xF5, 0x12,
+			0x06, 0xDB, 0x4B, 0x41, 0x35, 0x6A, 0x6F, 0xAB,
+			0xF5, 0x6A, 0x04, 0xCC, 0x97, 0xCF, 0xBB, 0xD4,
+			0x08, 0x09, 0x1A, 0x61, 0x3A, 0x0D, 0xE6, 0xB3,
+			0xA0, 0x46, 0xFF, 0x09, 0xAD, 0xDE, 0x80, 0x24,
+			0xDC, 0x12, 0x80, 0xF2, 0x5F, 0xD9, 0x16, 0xED,
+			0xE2, 0x42, 0x9D, 0xCD, 0x2F, 0x4D, 0x61, 0x02,
+			0x61, 0x8A, 0x1C, 0x4B, 0x1D, 0x18, 0x62, 0x39,
+			0x86, 0x97, 0x71, 0xAD, 0x3E, 0x7F, 0x5D, 0x71,
+			0x13, 0x4B, 0xE9, 0x2A, 0x00, 0xC1, 0xBE, 0xD5,
+			0xB7, 0x00, 0x9F, 0x5E, 0x65, 0xB2, 0x2C, 0x1A,
+			0xFF, 0x74, 0xED, 0xEA, 0x83, 0xD2, 0x39, 0x89,
+			0x33, 0x35, 0x73, 0x7D, 0xA0, 0xA2, 0xFA, 0x40,
+			0xE4, 0x66, 0x50, 0x58, 0xAA, 0xFC, 0x87, 0xE8,
+			0x5C, 0x20, 0x83, 0x34, 0xEC, 0xAB, 0xE2, 0x0B,
+			0xC5, 0x5F, 0x3E, 0xFF, 0x48, 0x2B, 0x11, 0x91,
+			0x26, 0xEF, 0x18, 0x6E, 0x57, 0xC5, 0x9F, 0x18,
+			0x73, 0x99, 0xEF, 0xE1, 0x6A, 0x74, 0x2B, 0xBB,
+			0x2F, 0x7F, 0x50, 0x8E, 0x1D, 0xDA, 0x3D, 0x76,
+			0xB6, 0x04, 0xE5, 0xCC, 0x2E, 0x10, 0xC7, 0x83,
+			0x1B, 0x83, 0xA3, 0xE4, 0xA5, 0x13, 0x13, 0x71,
+			0x6E, 0x33, 0x78, 0xA3, 0xA8, 0x3C, 0xEC, 0x48,
+			0x26, 0x5E, 0xC7, 0xC6, 0x5E, 0x0D, 0x87, 0x9A,
+			0xAA, 0xCC, 0x55, 0x34, 0x81, 0xAD, 0x9D, 0x90,
+			0xF5, 0xE6, 0x96, 0x63, 0xA6, 0xE8, 0x07, 0x20,
+			0x17, 0xC8, 0x93, 0x1E, 0xD2, 0xAE, 0xA4, 0xDC,
+			0xAE, 0x7D, 0x59, 0xBF, 0x88, 0x5E, 0x62, 0x0C,
+			0xAE, 0x5B, 0xF2, 0x29, 0x40, 0x56, 0x1D, 0x26,
+			0x40, 0xDE, 0x85, 0xA6, 0xAD, 0x56, 0xD1, 0xCF,
+			0x55, 0x47, 0x76, 0x5F, 0x9C, 0x39, 0xDB, 0x03
+		};
+
+		// Microsoft Option ROM UEFI CA 2023, SHA-1 thumbprint 3FB39E2B8BD183BF9E4594E72183CA60AFCD4277.
+		// DER source: https://go.microsoft.com/fwlink/?linkid=2284009, SHA-256 E5BE3E64C6E66A281457ECDECE0D6D0787577AAD2A3A0144262C10C14BA8D8F1.
+		static const uint8 microsoftOptionRomUefiCa2023Rsa2048Modulus[256] =
+		{
+			0xD3, 0x0B, 0xFE, 0x89, 0xCD, 0xCD, 0xB6, 0xEE,
+			0xDC, 0xE5, 0x1A, 0x8D, 0xDC, 0xCA, 0x21, 0x1A,
+			0x0F, 0x22, 0x2F, 0x0B, 0xB5, 0x32, 0x84, 0x35,
+			0xC0, 0xBE, 0x6F, 0x70, 0x93, 0x55, 0xB4, 0x47,
+			0xCC, 0x49, 0x03, 0xC2, 0xFE, 0xCF, 0xBA, 0x32,
+			0x65, 0x64, 0xB7, 0x35, 0xBD, 0x04, 0x3B, 0x44,
+			0x64, 0x2F, 0xA0, 0xF2, 0xDD, 0xE1, 0x5D, 0xBA,
+			0xE7, 0xBD, 0x39, 0x9A, 0xBD, 0xCB, 0x4B, 0xE1,
+			0x83, 0xAA, 0x1B, 0xE8, 0x6F, 0x4E, 0x4C, 0x91,
+			0x52, 0x43, 0xA5, 0xC4, 0x50, 0x55, 0x68, 0xF5,
+			0xDA, 0xAC, 0x48, 0xA2, 0x9C, 0xEC, 0x35, 0xA7,
+			0x04, 0x56, 0x68, 0x19, 0xE2, 0xB1, 0x62, 0xD4,
+			0x92, 0xF4, 0x85, 0x3F, 0x34, 0xA1, 0x15, 0x67,
+			0x87, 0x21, 0x6E, 0x1F, 0xC9, 0xD8, 0x35, 0x32,
+			0xB8, 0x3D, 0xCB, 0x58, 0xCA, 0x29, 0x43, 0x54,
+			0x4A, 0x7E, 0x8B, 0x55, 0x7B, 0x23, 0x7A, 0x3A,
+			0xB6, 0x9D, 0x43, 0x07, 0x04, 0x6B, 0x9A, 0x6B,
+			0xF4, 0xF0, 0x20, 0xFF, 0xFA, 0xA6, 0xDF, 0xA2,
+			0x9E, 0x49, 0xE8, 0x55, 0xC5, 0x75, 0x88, 0x44,
+			0xAC, 0xA4, 0x41, 0x3A, 0x03, 0x7C, 0xBB, 0xE9,
+			0x93, 0xE4, 0x6C, 0xF1, 0xED, 0x79, 0x26, 0xC7,
+			0x8B, 0x32, 0xF7, 0x59, 0x49, 0x25, 0x31, 0x00,
+			0x67, 0x18, 0x0C, 0x67, 0xFB, 0x40, 0xC5, 0x5D,
+			0x76, 0x3D, 0x09, 0x87, 0xC2, 0x2D, 0x8C, 0x5F,
+			0x2B, 0x5A, 0x1E, 0x01, 0x0F, 0x33, 0xAF, 0x65,
+			0x08, 0x90, 0x4F, 0xFC, 0x64, 0x5B, 0x9C, 0xA3,
+			0x5C, 0xD6, 0x53, 0x1B, 0x51, 0x01, 0x9F, 0x98,
+			0xCF, 0xC4, 0x53, 0xC5, 0xB1, 0xDF, 0xB3, 0x68,
+			0x6F, 0x45, 0x4B, 0xC8, 0x45, 0x85, 0xC8, 0x1D,
+			0xB8, 0x9E, 0xD1, 0x77, 0x71, 0xA0, 0xD5, 0xA2,
+			0x77, 0x87, 0xEC, 0x67, 0x2E, 0xB9, 0x87, 0x06,
+			0x46, 0xDD, 0x41, 0x43, 0x40, 0x6A, 0x5F, 0x2F
+		};
+		const size_t efiGuidSize = 16;
+		const size_t efiSignatureListHeaderSize = efiGuidSize + sizeof (uint32) * 3;
+		const size_t efiSignatureOwnerSize = efiGuidSize;
+		bool bContainsMicrosoftUefiCa2023 = false;
+		bool bContainsMicrosoftOptionRomUefiCa2023 = false;
+		size_t offset = 0;
+
+		while (offset < db.size ())
+		{
+			if (db.size () - offset < efiSignatureListHeaderSize)
+				return false;
+
+			const uint8* signatureList = &db[offset];
+			uint32 signatureListSize = ReadUint32LittleEndian (signatureList + efiGuidSize);
+			uint32 signatureHeaderSize = ReadUint32LittleEndian (signatureList + efiGuidSize + sizeof (uint32));
+			uint32 signatureSize = ReadUint32LittleEndian (signatureList + efiGuidSize + sizeof (uint32) * 2);
+
+			if ((signatureListSize < efiSignatureListHeaderSize)
+				|| (signatureListSize > db.size () - offset)
+				|| (signatureHeaderSize > signatureListSize - efiSignatureListHeaderSize))
+				return false;
+
+			size_t signaturesOffset = offset + efiSignatureListHeaderSize + signatureHeaderSize;
+			size_t signaturesSize = signatureListSize - efiSignatureListHeaderSize - signatureHeaderSize;
+
+			if (BufferEquals (signatureList, efiCertX509Guid, efiGuidSize))
+			{
+				if (signatureSize < efiSignatureOwnerSize)
+					return false;
+				if ((signaturesSize % signatureSize) != 0)
+					return false;
+
+				for (size_t signatureOffset = signaturesOffset; signatureOffset < offset + signatureListSize; signatureOffset += signatureSize)
+				{
+					const uint8* certificate = &db[signatureOffset + efiSignatureOwnerSize];
+					size_t certificateSize = signatureSize - efiSignatureOwnerSize;
+
+					if (!bContainsMicrosoftUefiCa2023
+						&& BufferHasPattern (certificate, certificateSize, microsoftUefiCa2023Rsa2048Modulus, sizeof (microsoftUefiCa2023Rsa2048Modulus)))
+					{
+						bContainsMicrosoftUefiCa2023 = true;
+					}
+					else if (!bContainsMicrosoftOptionRomUefiCa2023
+						&& BufferHasPattern (certificate, certificateSize, microsoftOptionRomUefiCa2023Rsa2048Modulus, sizeof (microsoftOptionRomUefiCa2023Rsa2048Modulus)))
+					{
+						bContainsMicrosoftOptionRomUefiCa2023 = true;
+					}
+
+					if (bContainsMicrosoftUefiCa2023 && bContainsMicrosoftOptionRomUefiCa2023)
+						return true;
+				}
+			}
+			else if (BufferEquals (signatureList, efiCertRsa2048Guid, efiGuidSize))
+			{
+				if (signatureHeaderSize != 0
+					|| signatureSize != efiSignatureOwnerSize + efiRsa2048KeySize
+					|| (signaturesSize % signatureSize) != 0)
+				{
+					return false;
+				}
+
+				for (size_t signatureOffset = signaturesOffset; signatureOffset < offset + signatureListSize; signatureOffset += signatureSize)
+				{
+					const uint8* publicKey = &db[signatureOffset + efiSignatureOwnerSize];
+
+					if (!bContainsMicrosoftUefiCa2023
+						&& BufferEquals (publicKey, efiRsa2048KeySize, microsoftUefiCa2023Rsa2048Modulus, sizeof (microsoftUefiCa2023Rsa2048Modulus)))
+					{
+						bContainsMicrosoftUefiCa2023 = true;
+					}
+					else if (!bContainsMicrosoftOptionRomUefiCa2023
+						&& BufferEquals (publicKey, efiRsa2048KeySize, microsoftOptionRomUefiCa2023Rsa2048Modulus, sizeof (microsoftOptionRomUefiCa2023Rsa2048Modulus)))
+					{
+						bContainsMicrosoftOptionRomUefiCa2023 = true;
+					}
+
+					if (bContainsMicrosoftUefiCa2023 && bContainsMicrosoftOptionRomUefiCa2023)
+						return true;
+				}
+			}
+
+			offset += signatureListSize;
+		}
+
+		return false;
+	}
+
+#ifdef VC_EFI_BOOTLOADER_SELECTION_TEST
+	bool TestFirmwareDbBufferContainsMicrosoft2023UefiCAs (const uint8* db, size_t dbSize)
+	{
+		std::vector<uint8> firmwareDb;
+		if (dbSize != 0)
+		{
+			if (!db)
+				return false;
+			firmwareDb.assign (db, db + dbSize);
+		}
+
+		return FirmwareDbBufferContainsMicrosoft2023UefiCAs (firmwareDb);
+	}
+#endif
+
+	static bool TryFirmwareDbContainsMicrosoft2023UefiCAs (bool& bContainsMicrosoft2023UefiCAs)
+	{
+		std::vector<uint8> db;
+		DWORD dwError = ERROR_SUCCESS;
+		if (!ReadFirmwareEnvironmentVariableBuffer (L"db", EfiImageSecurityDatabaseGuid, db, &dwError))
+		{
+			SetLastError (dwError);
+			return false;
+		}
+
+		bContainsMicrosoft2023UefiCAs = FirmwareDbBufferContainsMicrosoft2023UefiCAs (db);
+		return true;
+	}
+
+	static bool IsFirmwareDbUnavailableError (DWORD dwError)
+	{
+		return (dwError == ERROR_ENVVAR_NOT_FOUND) || (dwError == ERROR_INVALID_FUNCTION);
+	}
+
+	static bool TryFirmwareSecureBootEnabled (bool& bSecureBootEnabled, DWORD* pLastError = NULL)
+	{
+		std::vector<uint8> secureBoot;
+		DWORD dwError = ERROR_SUCCESS;
+		if (!ReadFirmwareEnvironmentVariableBuffer (L"SecureBoot", EfiVarGuid, secureBoot, &dwError))
+		{
+			if (pLastError)
+				*pLastError = dwError;
+			SetLastError (dwError);
+			return false;
+		}
+
+		bSecureBootEnabled = (secureBoot.size () >= 1) && (secureBoot[0] == 1);
+		return true;
+	}
+
+	static EfiBootLoaderResourceSelection GetPreferredEfiBootLoaderResourceSet ()
+	{
+		// The current 2023 DCS set uses both Microsoft UEFI CA 2023 and Microsoft Option ROM UEFI CA 2023:
+		// DcsInt.dcs and LegacySpeaker.dcs are signed through the Option ROM UEFI CA 2023 chain.
+		// If db cannot be read, keep the pre-2023 universal behavior and use the 2011 compatibility fallback.
+		bool bContainsMicrosoft2023UefiCAs = false;
+		if (TryFirmwareDbContainsMicrosoft2023UefiCAs (bContainsMicrosoft2023UefiCAs))
+		{
+			if (bContainsMicrosoft2023UefiCAs)
+				return MakeEfiBootLoaderResourceSelection (EfiBootLoaderResources2023, 2023, L"firmware db contains Microsoft UEFI CA 2023 and Microsoft Option ROM UEFI CA 2023", ERROR_SUCCESS);
+
+			return MakeEfiBootLoaderResourceSelection (EfiBootLoaderResources2011, 2011, L"firmware db does not contain both Microsoft 2023 UEFI CAs", ERROR_SUCCESS);
+		}
+
+		DWORD dwError = GetLastError ();
+		if (IsFirmwareDbUnavailableError (dwError))
+			return MakeEfiBootLoaderResourceSelection (EfiBootLoaderResources2011, 2011, L"firmware db is unavailable; using 2011 compatibility fallback", dwError);
+
+		bool bSecureBootEnabled = false;
+		if (TryFirmwareSecureBootEnabled (bSecureBootEnabled) && !bSecureBootEnabled)
+			return MakeEfiBootLoaderResourceSelection (EfiBootLoaderResources2011, 2011, L"Secure Boot is disabled and firmware db could not be read; using 2011 compatibility fallback", dwError);
+#ifndef SETUP
+		if (!IsAdmin () && IsUacSupported ())
+		{
+			// This may prompt for elevation from non-admin Mount/Format paths. EFI rescue
+			// media and bootloader repair need accurate firmware db detection to avoid
+			// selecting a Microsoft CA set unsupported by the current Secure Boot db.
+			BOOL bElevatedContainsMicrosoft2023UefiCAs = FALSE;
+			Elevator::GetEfiBootLoaderSigningSupport (&bElevatedContainsMicrosoft2023UefiCAs);
+			if (bElevatedContainsMicrosoft2023UefiCAs)
+				return MakeEfiBootLoaderResourceSelection (EfiBootLoaderResources2023, 2023, L"elevated helper reported Microsoft 2023 UEFI CA support", dwError);
+
+			return MakeEfiBootLoaderResourceSelection (EfiBootLoaderResources2011, 2011, L"elevated helper did not report Microsoft 2023 UEFI CA support", dwError);
+		}
+#endif
+
+		return MakeEfiBootLoaderResourceSelection (EfiBootLoaderResources2011, 2011, L"firmware db could not be read; using 2011 compatibility fallback", dwError);
+	}
+
+	static void ThrowMissingEfiResource (const wchar_t* resourceName, bool rescueDisk)
+	{
+		if (rescueDisk)
+			throw ParameterIncorrect (SRC_POS);
+
+		throw ErrorException (wstring (L"Out of resource ") + resourceName, SRC_POS);
+	}
+
+	static uint8* MapEfiBootLoaderResource (int resourceId, const wchar_t* resourceName, DWORD& size, bool rescueDisk)
+	{
+		uint8 *resource = MapResource (L"BIN", resourceId, &size);
+		if (!resource)
+			ThrowMissingEfiResource (resourceName, rescueDisk);
+
+		return resource;
+	}
+
+	static EfiBootLoaderImages MapEfiBootLoaderImages (bool rescueDisk)
+	{
+		EfiBootLoaderResourceSelection selection = GetPreferredEfiBootLoaderResourceSet ();
+		const EfiBootLoaderResourceSet& resources = *selection.Resources;
+		EfiBootLoaderImages images = {0};
+
+		images.DcsBoot = MapEfiBootLoaderResource (resources.DcsBoot, L"DcsBoot", images.SizeDcsBoot, rescueDisk);
+		images.DcsInt = MapEfiBootLoaderResource (resources.DcsInt, L"DcsInt", images.SizeDcsInt, rescueDisk);
+		images.DcsCfg = MapEfiBootLoaderResource (resources.DcsCfg, L"DcsCfg", images.SizeDcsCfg, rescueDisk);
+		images.LegacySpeaker = MapEfiBootLoaderResource (resources.LegacySpeaker, L"LegacySpeaker", images.SizeLegacySpeaker, rescueDisk);
+		images.DcsRescue = MapEfiBootLoaderResource (resources.DcsRescue, L"DcsRe", images.SizeDcsRescue, rescueDisk);
+		images.DcsInfo = MapEfiBootLoaderResource (resources.DcsInfo, L"DcsInfo", images.SizeDcsInfo, rescueDisk);
+		images.ResourceSet = selection.ResourceSet;
+		images.SelectionReason = selection.Reason;
+		images.FirmwareDbError = selection.FirmwareDbError;
+
+		return images;
+	}
+
+	static void BackupEfiBootLoaderImageIfDifferent (EfiBoot& efiBoot, const wchar_t* imageName, const wchar_t* backupName, uint8* replacementData, DWORD replacementSize)
+	{
+		std::vector<uint8> currentImage;
+		if (!efiBoot.ReadFileToBuffer (imageName, currentImage))
+			return;
+
+		if ((currentImage.size () != replacementSize)
+			|| ((replacementSize != 0) && (memcmp (currentImage.data (), replacementData, replacementSize) != 0)))
+		{
+			// Preserve the first divergent image as the rollback snapshot; later CA refreshes must not overwrite it.
+			if (!efiBoot.FileExists (backupName))
+				efiBoot.SaveFile (backupName, currentImage.data (), (DWORD) currentImage.size ());
+		}
+	}
+
+	static void BackupEfiBootLoaderImagesIfDifferent (EfiBoot& efiBoot, const EfiBootLoaderImages& images)
+	{
+		BackupEfiBootLoaderImageIfDifferent (efiBoot, L"\\EFI\\VeraCrypt\\DcsBoot.efi", L"\\EFI\\VeraCrypt\\DcsBoot.efi.vc_backup", images.DcsBoot, images.SizeDcsBoot);
+		BackupEfiBootLoaderImageIfDifferent (efiBoot, L"\\EFI\\VeraCrypt\\DcsInt.dcs", L"\\EFI\\VeraCrypt\\DcsInt.dcs.vc_backup", images.DcsInt, images.SizeDcsInt);
+		BackupEfiBootLoaderImageIfDifferent (efiBoot, L"\\EFI\\VeraCrypt\\DcsCfg.dcs", L"\\EFI\\VeraCrypt\\DcsCfg.dcs.vc_backup", images.DcsCfg, images.SizeDcsCfg);
+		BackupEfiBootLoaderImageIfDifferent (efiBoot, L"\\EFI\\VeraCrypt\\LegacySpeaker.dcs", L"\\EFI\\VeraCrypt\\LegacySpeaker.dcs.vc_backup", images.LegacySpeaker, images.SizeLegacySpeaker);
+		BackupEfiBootLoaderImageIfDifferent (efiBoot, L"\\EFI\\VeraCrypt\\DcsInfo.dcs", L"\\EFI\\VeraCrypt\\DcsInfo.dcs.vc_backup", images.DcsInfo, images.SizeDcsInfo);
+	}
+
+	static void SaveEfiBootLoaderImages (EfiBoot& efiBoot, const EfiBootLoaderImages& images, bool backupExistingImages = false)
+	{
+		if (backupExistingImages)
+			BackupEfiBootLoaderImagesIfDifferent (efiBoot, images);
+
+		efiBoot.SaveFile (L"\\EFI\\VeraCrypt\\DcsBoot.efi", images.DcsBoot, images.SizeDcsBoot);
+		efiBoot.SaveFile (L"\\EFI\\VeraCrypt\\DcsInt.dcs", images.DcsInt, images.SizeDcsInt);
+		efiBoot.SaveFile (L"\\EFI\\VeraCrypt\\DcsCfg.dcs", images.DcsCfg, images.SizeDcsCfg);
+		efiBoot.SaveFile (L"\\EFI\\VeraCrypt\\LegacySpeaker.dcs", images.LegacySpeaker, images.SizeLegacySpeaker);
+		efiBoot.SaveFile (L"\\EFI\\VeraCrypt\\DcsInfo.dcs", images.DcsInfo, images.SizeDcsInfo);
+		RecordEfiBootLoaderResourceSetSelection (images);
+	}

 	void 
 	GetVolumeESP(wstring& path, wstring& bootVolumePath) 
@@ -3442,32 +3979,16 @@ namespace VeraCrypt
 					Warning ("ADMIN_PRIVILEGES_WARN_DEVICES", ParentWindow);
 				}
 			}
-			DWORD sizeDcsBoot;
-			uint8 *dcsBootImg = MapResource(L"BIN", IDR_EFI_DCSBOOT, &sizeDcsBoot);
-			if (!dcsBootImg)
-				throw ErrorException(L"Out of resource DcsBoot", SRC_POS);
-			DWORD sizeDcsInt;
-			uint8 *dcsIntImg = MapResource(L"BIN", IDR_EFI_DCSINT, &sizeDcsInt);
-			if (!dcsIntImg)
-				throw ErrorException(L"Out of resource DcsInt", SRC_POS);
-			DWORD sizeDcsCfg;
-			uint8 *dcsCfgImg = MapResource(L"BIN", IDR_EFI_DCSCFG, &sizeDcsCfg);
-			if (!dcsCfgImg)
-				throw ErrorException(L"Out of resource DcsCfg", SRC_POS);
-			DWORD sizeLegacySpeaker;
-			uint8 *LegacySpeakerImg = MapResource(L"BIN", IDR_EFI_LEGACYSPEAKER, &sizeLegacySpeaker);
-			if (!LegacySpeakerImg)
-				throw ErrorException(L"Out of resource LegacySpeaker", SRC_POS);
+			EfiBootLoaderImages efiImages = MapEfiBootLoaderImages (false);
+			// Kept as aliases for the legacy EFI\Boot\bootx64.efi replacement block below.
+			DWORD sizeDcsBoot = efiImages.SizeDcsBoot;
+			uint8 *dcsBootImg = efiImages.DcsBoot;
 #ifdef VC_EFI_CUSTOM_MODE
 			DWORD sizeBootMenuLocker;
 			uint8 *BootMenuLockerImg = MapResource(L"BIN", IDR_EFI_DCSBML, &sizeBootMenuLocker);
 			if (!BootMenuLockerImg)
 				throw ErrorException(L"Out of resource DcsBml", SRC_POS);
 #endif
-			DWORD sizeDcsInfo;
-			uint8 *DcsInfoImg = MapResource(L"BIN", IDR_EFI_DCSINFO, &sizeDcsInfo);
-			if (!DcsInfoImg)
-				throw ErrorException(L"Out of resource DcsInfo", SRC_POS);

 			EfiBootInst.PrepareBootPartition(PostOOBEMode);			

@@ -3477,14 +3998,16 @@ namespace VeraCrypt
 				bool bAlreadyExist;
 				const char* g_szMsBootString = "bootmgfw.pdb";
 				unsigned __int64 loaderSize = 0;
+				const wchar_t * szStdMsBootloader = L"\\EFI\\Microsoft\\Boot\\bootmgfw.efi";
+				const wchar_t * szBackupMsBootloader = L"\\EFI\\Microsoft\\Boot\\bootmgfw_ms.vc";
 				const wchar_t * szStdEfiBootloader = L"\\EFI\\Boot\\bootx64.efi";
 				const wchar_t * szBackupEfiBootloader = L"\\EFI\\Boot\\original_bootx64.vc_backup";

 				if (preserveUserConfig)
 				{
-					bool bModifiedMsBoot = true, bMissingMsBoot = false;;
-					if (EfiBootInst.FileExists (L"\\EFI\\Microsoft\\Boot\\bootmgfw.efi"))
-						EfiBootInst.GetFileSize(L"\\EFI\\Microsoft\\Boot\\bootmgfw.efi", loaderSize);
+					bool bModifiedMsBoot = true, bMissingMsBoot = false, bMsBootloaderMovedToBackup = false;
+					if (EfiBootInst.FileExists (szStdMsBootloader))
+						EfiBootInst.GetFileSize(szStdMsBootloader, loaderSize);
 					else
 						bMissingMsBoot = true;

@@ -3492,20 +4015,21 @@ namespace VeraCrypt
 					if (PostOOBEMode)
 						EfiBootInst.SetStartExec(L"VeraCrypt BootLoader (DcsBoot)", L"\\EFI\\VeraCrypt\\DcsBoot.efi", SetBootEntry, ForceFirstBootEntry, SetBootNext);

-					if (EfiBootInst.FileExists (L"\\EFI\\Microsoft\\Boot\\bootmgfw_ms.vc"))
+					if (EfiBootInst.FileExists (szBackupMsBootloader))
 					{
 						if (loaderSize > 32768)
 						{
 							std::vector<uint8> bootLoaderBuf ((size_t) loaderSize);

-							EfiBootInst.ReadFile(L"\\EFI\\Microsoft\\Boot\\bootmgfw.efi", &bootLoaderBuf[0], (DWORD) loaderSize);
+							EfiBootInst.ReadFile(szStdMsBootloader, &bootLoaderBuf[0], (DWORD) loaderSize);

 							// look for bootmgfw.efi identifiant string
 							if (BufferHasPattern (bootLoaderBuf.data (), (size_t) loaderSize, g_szMsBootString, strlen (g_szMsBootString)))
 							{
 								bModifiedMsBoot = false;
 								// replace the backup with this version
-								EfiBootInst.RenameFile (L"\\EFI\\Microsoft\\Boot\\bootmgfw.efi", L"\\EFI\\Microsoft\\Boot\\bootmgfw_ms.vc", TRUE);
+								if (EfiBootInst.RenameFile (szStdMsBootloader, szBackupMsBootloader, TRUE))
+									bMsBootloaderMovedToBackup = true;
 							}
 						}
 					}
@@ -3516,7 +4040,7 @@ namespace VeraCrypt
 						{
 							std::vector<uint8> bootLoaderBuf ((size_t) loaderSize);

-							EfiBootInst.ReadFile(L"\\EFI\\Microsoft\\Boot\\bootmgfw.efi", &bootLoaderBuf[0], (DWORD) loaderSize);
+							EfiBootInst.ReadFile(szStdMsBootloader, &bootLoaderBuf[0], (DWORD) loaderSize);

 							// look for bootmgfw.efi identifiant string
 							if (BufferHasPattern (bootLoaderBuf.data (), (size_t) loaderSize, g_szMsBootString, strlen (g_szMsBootString)))
@@ -3525,7 +4049,8 @@ namespace VeraCrypt

 						if (!bModifiedMsBoot)
 						{
-							EfiBootInst.RenameFile (L"\\EFI\\Microsoft\\Boot\\bootmgfw.efi", L"\\EFI\\Microsoft\\Boot\\bootmgfw_ms.vc", TRUE);
+							if (EfiBootInst.RenameFile (szStdMsBootloader, szBackupMsBootloader, TRUE))
+								bMsBootloaderMovedToBackup = true;
 						}
 						else
 						{
@@ -3551,7 +4076,7 @@ namespace VeraCrypt
 										if (BufferHasPattern (bootLoaderBuf.data (), (size_t) loaderSize, g_szMsBootString, strlen (g_szMsBootString)))
 										{
 											bFound = true;
-											EfiBootInst.RenameFile(loaderPath.c_str(), L"\\EFI\\Microsoft\\Boot\\bootmgfw_ms.vc", TRUE);
+											EfiBootInst.RenameFile(loaderPath.c_str(), szBackupMsBootloader, TRUE);
 										}
 									}
 								}
@@ -3563,16 +4088,47 @@ namespace VeraCrypt
 					}

 					if (PostOOBEMode && EfiBootInst.FileExists (L"\\EFI\\VeraCrypt\\DcsBoot.efi"))
-					{						
-						// check if bootmgfw.efi has been set again to Microsoft version
-						// if yes, replace it with our bootloader after it was copied to bootmgfw_ms.vc
-						if (!bModifiedMsBoot || bMissingMsBoot)
-							EfiBootInst.CopyFile (L"\\EFI\\VeraCrypt\\DcsBoot.efi", L"\\EFI\\Microsoft\\Boot\\bootmgfw.efi");
+					{
+						const bool bRefreshMsBootloader = !bModifiedMsBoot
+							|| bMissingMsBoot
+							|| (EfiBootInst.FileExists (szStdMsBootloader) && EfiBootInst.IsVeraCryptBootLoader (szStdMsBootloader));
+
+						// Keep the firmware-visible loader path valid before the larger module refresh.
+						if (bRefreshMsBootloader && !EfiBootInst.FileExists (szStdMsBootloader))
+						{
+							try
+							{
+								EfiBootInst.CopyFile (L"\\EFI\\VeraCrypt\\DcsBoot.efi", szStdMsBootloader);
+							}
+							catch (...)
+							{
+								if (bMsBootloaderMovedToBackup)
+									EfiBootInst.RenameFile (szBackupMsBootloader, szStdMsBootloader, TRUE);
+								throw;
+							}
+						}
+
+						SaveEfiBootLoaderImages (EfiBootInst, efiImages, true);
+#ifdef VC_EFI_CUSTOM_MODE
+						EfiBootInst.SaveFile(L"\\EFI\\VeraCrypt\\DcsBml.dcs", BootMenuLockerImg, sizeBootMenuLocker);
+#endif
+
+						// check if bootmgfw.efi has been set again to Microsoft version.
+						// If yes, replace it with our bootloader after it was copied to bootmgfw_ms.vc.
+						// If it is already a VeraCrypt copy, refresh it because the firmware db may now
+						// trust a different Microsoft CA than the one selected at original install time.
+						if (bRefreshMsBootloader)
+						{
+							EfiBootInst.CopyFile (L"\\EFI\\VeraCrypt\\DcsBoot.efi", szStdMsBootloader);
+						}

 						if (EfiBootInst.FileExists (szStdEfiBootloader))
 						{
-							// check if standard bootloader under EFI\Boot has been set to Microsoft version
-							// if yes, replace it with our bootloader
+							// check if standard bootloader under EFI\Boot has been set to Microsoft version.
+							// If yes, replace it with our bootloader. If it is already a VeraCrypt copy,
+							// refresh it because the firmware db may now trust a different Microsoft CA
+							// than the one selected at original install time.
+							bool bStdEfiBootloaderUpdated = false;
 							EfiBootInst.GetFileSize(szStdEfiBootloader, loaderSize);
 							if (loaderSize > 32768)
 							{
@@ -3585,22 +4141,23 @@ namespace VeraCrypt
 								{
 									EfiBootInst.RenameFile (szStdEfiBootloader, szBackupEfiBootloader, TRUE);
 									EfiBootInst.CopyFile (L"\\EFI\\VeraCrypt\\DcsBoot.efi", szStdEfiBootloader);
+									bStdEfiBootloaderUpdated = true;
 								}
 							}
+							if (!bStdEfiBootloaderUpdated && EfiBootInst.IsVeraCryptBootLoader (szStdEfiBootloader))
+							{
+								EfiBootInst.CopyFile (L"\\EFI\\VeraCrypt\\DcsBoot.efi", szStdEfiBootloader);
+							}
 						}
 						return;
 					}
 				}

 				EfiBootInst.MkDir(L"\\EFI\\VeraCrypt", bAlreadyExist);
-				EfiBootInst.SaveFile(L"\\EFI\\VeraCrypt\\DcsBoot.efi", dcsBootImg, sizeDcsBoot);
-				EfiBootInst.SaveFile(L"\\EFI\\VeraCrypt\\DcsInt.dcs", dcsIntImg, sizeDcsInt);
-				EfiBootInst.SaveFile(L"\\EFI\\VeraCrypt\\DcsCfg.dcs", dcsCfgImg, sizeDcsCfg);
-				EfiBootInst.SaveFile(L"\\EFI\\VeraCrypt\\LegacySpeaker.dcs", LegacySpeakerImg, sizeLegacySpeaker);
+				SaveEfiBootLoaderImages (EfiBootInst, efiImages);
 #ifdef VC_EFI_CUSTOM_MODE
 				EfiBootInst.SaveFile(L"\\EFI\\VeraCrypt\\DcsBml.dcs", BootMenuLockerImg, sizeBootMenuLocker);
 #endif
-				EfiBootInst.SaveFile(L"\\EFI\\VeraCrypt\\DcsInfo.dcs", DcsInfoImg, sizeDcsInfo);
 				if (!preserveUserConfig)
 					EfiBootInst.DelFile(L"\\EFI\\VeraCrypt\\PlatformInfo");
 				EfiBootInst.SetStartExec(L"VeraCrypt BootLoader (DcsBoot)", L"\\EFI\\VeraCrypt\\DcsBoot.efi", SetBootEntry, ForceFirstBootEntry, SetBootNext);
@@ -3812,36 +4369,13 @@ namespace VeraCrypt
 		if (bIsGPT)
 		{
 			// create EFI disk structure
-			DWORD sizeDcsBoot;
-			uint8 *dcsBootImg = MapResource(L"BIN", IDR_EFI_DCSBOOT, &sizeDcsBoot);
-			if (!dcsBootImg)
-				throw ParameterIncorrect (SRC_POS);
-			DWORD sizeDcsInt;
-			uint8 *dcsIntImg = MapResource(L"BIN", IDR_EFI_DCSINT, &sizeDcsInt);
-			if (!dcsIntImg)
-				throw ParameterIncorrect (SRC_POS);
-			DWORD sizeDcsCfg;
-			uint8 *dcsCfgImg = MapResource(L"BIN", IDR_EFI_DCSCFG, &sizeDcsCfg);
-			if (!dcsCfgImg)
-				throw ParameterIncorrect (SRC_POS);
-			DWORD sizeLegacySpeaker;
-			uint8 *LegacySpeakerImg = MapResource(L"BIN", IDR_EFI_LEGACYSPEAKER, &sizeLegacySpeaker);
-			if (!LegacySpeakerImg)
-				throw ParameterIncorrect (SRC_POS);
+			EfiBootLoaderImages efiImages = MapEfiBootLoaderImages (true);
 #ifdef VC_EFI_CUSTOM_MODE
 			DWORD sizeBootMenuLocker;
 			uint8 *BootMenuLockerImg = MapResource(L"BIN", IDR_EFI_DCSBML, &sizeBootMenuLocker);
 			if (!BootMenuLockerImg)
 				throw ParameterIncorrect (SRC_POS);
 #endif
-			DWORD sizeDcsRescue;
-			uint8 *DcsRescueImg = MapResource(L"BIN", IDR_EFI_DCSRE, &sizeDcsRescue);
-			if (!DcsRescueImg)
-				throw ParameterIncorrect (SRC_POS);
-			DWORD sizeDcsInfo;
-			uint8 *DcsInfoImg = MapResource(L"BIN", IDR_EFI_DCSINFO, &sizeDcsInfo);
-			if (!DcsInfoImg)
-				throw ParameterIncorrect (SRC_POS);

 			WCHAR szTmpPath[MAX_PATH + 1], szTmpFilePath[MAX_PATH + 1];
 			if (!GetTempPathW (MAX_PATH, szTmpPath))
@@ -3865,21 +4399,21 @@ namespace VeraCrypt

 			finally_do_arg (zip_t**, &z, { if (*finally_arg) zip_discard (*finally_arg);});

-			if (!ZipAdd (z, "EFI/Boot/bootx64.efi", DcsRescueImg, sizeDcsRescue))
+			if (!ZipAdd (z, "EFI/Boot/bootx64.efi", efiImages.DcsRescue, efiImages.SizeDcsRescue))
 				throw ParameterIncorrect (SRC_POS);
 #ifdef VC_EFI_CUSTOM_MODE
 			if (!ZipAdd (z, "EFI/VeraCrypt/DcsBml.dcs", BootMenuLockerImg, sizeBootMenuLocker))
 				throw ParameterIncorrect (SRC_POS);
 #endif
-			if (!ZipAdd (z, "EFI/VeraCrypt/DcsBoot.efi", dcsBootImg, sizeDcsBoot))
+			if (!ZipAdd (z, "EFI/VeraCrypt/DcsBoot.efi", efiImages.DcsBoot, efiImages.SizeDcsBoot))
 				throw ParameterIncorrect (SRC_POS);
-			if (!ZipAdd (z, "EFI/VeraCrypt/DcsCfg.dcs", dcsCfgImg, sizeDcsCfg))
+			if (!ZipAdd (z, "EFI/VeraCrypt/DcsCfg.dcs", efiImages.DcsCfg, efiImages.SizeDcsCfg))
 				throw ParameterIncorrect (SRC_POS);
-			if (!ZipAdd (z, "EFI/VeraCrypt/DcsInt.dcs", dcsIntImg, sizeDcsInt))
+			if (!ZipAdd (z, "EFI/VeraCrypt/DcsInt.dcs", efiImages.DcsInt, efiImages.SizeDcsInt))
 				throw ParameterIncorrect (SRC_POS);
-			if (!ZipAdd (z, "EFI/VeraCrypt/LegacySpeaker.dcs", LegacySpeakerImg, sizeLegacySpeaker))
+			if (!ZipAdd (z, "EFI/VeraCrypt/LegacySpeaker.dcs", efiImages.LegacySpeaker, efiImages.SizeLegacySpeaker))
 				throw ParameterIncorrect (SRC_POS);
-			if (!ZipAdd (z, "EFI/VeraCrypt/DcsInfo.dcs", DcsInfoImg, sizeDcsInfo))
+			if (!ZipAdd (z, "EFI/VeraCrypt/DcsInfo.dcs", efiImages.DcsInfo, efiImages.SizeDcsInfo))
 				throw ParameterIncorrect (SRC_POS);

 			Buffer volHeader(TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE);
@@ -5252,6 +5786,25 @@ namespace VeraCrypt
 		}
 	}
 #endif
+
+	void BootEncryption::GetEfiBootLoaderSigningSupport (BOOL* pMicrosoft2023UefiCAsSupported)
+	{
+		if (!pMicrosoft2023UefiCAsSupported)
+		{
+			SetLastError (ERROR_INVALID_PARAMETER);
+			throw SystemException (SRC_POS);
+		}
+
+		bool bContainsMicrosoft2023UefiCAs = false;
+		if (!TryFirmwareDbContainsMicrosoft2023UefiCAs (bContainsMicrosoft2023UefiCAs))
+		{
+			*pMicrosoft2023UefiCAsSupported = FALSE;
+			return;
+		}
+
+		*pMicrosoft2023UefiCAsSupported = bContainsMicrosoft2023UefiCAs ? TRUE : FALSE;
+	}
+
 #ifndef SETUP
 	void BootEncryption::CheckRequirements ()
 	{ 
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Mounir IDRASSI	c35ba490c8	Build: avoid awk warning in version extraction	2026-05-21 23:31:45 +09:00
Mr-UpdateandGitHub	c4acb6a0be	Update Language.de.xml (#1742 ) * Update Language.de.xml - Translation completed * Update Language.de.xml	2026-05-21 08:27:49 +09:00
Mounir IDRASSI	b97b0f2c06	macOS: fix TC_VERSION extraction in makefiles	2026-05-20 08:38:42 +02:00
Mounir IDRASSI	21f773cd6d	docs: fix Argon2id default PIM	2026-05-20 14:33:06 +09:00
Mounir IDRASSI	aaffec8b5c	Windows: support new Microsoft EFI CA bootloaders Embed both Microsoft UEFI CA 2011 and 2023 signed DCS EFI sets and select the 2023 set only when the firmware db trusts the required 2023 third-party CAs. Fall back to the 2011 EFI set when firmware db state cannot be determined, preserving pre-existing compatibility behavior and recording the reason in HKLM diagnostics. Refresh installed ESP modules during PostOOBE repair, keep backups before replacing existing DCS modules, and use the selected EFI set when creating rescue media. Record the selected EFI bootloader resource set and selection reason in HKLM, allow larger firmware db variables on systems with many Secure Boot certificates, and remove diagnostic registry keys on uninstall. Fix MSI SetupDLL COM typelib version constants so unregister targets the current Main and Format COM typelib versions. References: https://github.com/veracrypt/VeraCrypt/issues/1655	2026-05-20 14:07:47 +09:00
Mounir IDRASSI	4f71883ac1	Windows: Add new signed EFI bootloader files (2011CA and 2023CA)	2026-05-20 14:05:27 +09:00
Mounir IDRASSIandGitHub	964ecde6a1	Linux: add Arch package build support (#1740 )	2026-05-20 09:38:38 +09:00
Thomas De RockerandGitHub	86082f3bf5	Update Language.nl.xml (#1741 )	2026-05-19 18:33:06 +09:00
Marius KjærstadandGitHub	1f256ae3f2	Update to Norwegian Bokmål translation (#1738 ) * Update to Norwegian Bokmål translation * Issues found by Idrassi	2026-05-19 13:25:03 +09:00
MatthaiksandGitHub	8282f17745	Update Polish translation (#1737 ) * Update Polish translation * Update Polish translation	2026-05-19 08:11:58 +09:00
Mounir IDRASSI	dec2bd882f	Linux/macOS: suppress wxWidgets sizer consistency checks	2026-05-19 07:52:14 +09:00
thuraskandGitHub	a93e5d4214	Update FUSE package version for Debian and Ubuntu (#1736 ) libfuse3-3 dropped in Debian 13/Ubuntu 25.10, replaced with libfuse3-4	2026-05-19 07:10:59 +09:00
Mounir IDRASSI	6bef9e009c	Linux: refine in-kernel NTFS driver selection Keep the NTFS kernel-driver option as a generic in-kernel NTFS path rather than an ntfs3-specific path. Add --filesystem=kernel-ntfs and -m kernelntfs routes that select a registered or loadable kernel NTFS driver and mount with -i so mount.ntfs/ntfs-3g helpers are not invoked. Preserve --filesystem=ntfs3 as a literal pin to the ntfs3 driver. Treat both ntfs3 and kernel-ntfs as mount-only selectors; volume creation continues to use filesystem type NTFS. The preference and -m kernelntfs path only select an in-kernel NTFS driver when no explicit filesystem type was supplied and blkid detects NTFS. Treat ntfs as the preferred in-kernel driver on Linux 7.1 and later, where the upstream read/write driver is expected. On earlier kernels, select ntfs only when module metadata identifies the standalone read/write driver and /sys/module confirms it loaded, avoiding ntfs3 read-only ntfs compatibility registrations. Fall back to ntfs3 otherwise, and report a generic kernel-driver error if neither supported driver is available or loadable. Rename the internal preference/config field to MountNtfsWithKernelDriver, migrate the old MountNtfsWithNtfs3 preference key, and update UI strings, CLI help, documentation, release notes, and translation placeholders accordingly. Reference: https://github.com/veracrypt/VeraCrypt/issues/1735	2026-05-18 22:19:23 +09:00
curious-rabbit GitHub curious-rabbit Mounir IDRASSI	9535e65bd8	Ensure reproducible builds on Linux (#1731 ) * ensure reproducible builds * improve patch * improve patch * Narrow reproducibility scope to legacy and DEB Keep the verified Linux legacy Makefile and DEB reproducibility paths, but remove the unverified RPM/openSUSE timestamp changes and AppImage reproducibility behavior from this PR. The CPack mtime/mode clamp is now installed only for Debian/Ubuntu packaging, matching the scope covered by the provided reproducibility logs. Retain umask 022 in the RPM/openSUSE wrappers so staged package permissions do not depend on a restrictive caller umask. * Harden reproducible build cleanup Validate SOURCE_DATE_EPOCH before interpolating it into Make, CMake or shell packaging paths. Refuse live DESTDIR values in the CPack mtime clamp and pass makeself options through normal argv construction instead of eval. --------- Co-authored-by: curious-rabbit <curious-rabbit@local> Co-authored-by: Mounir IDRASSI <mounir.idrassi@amcrypto.jp>	2026-05-18 20:54:13 +09:00
Mounir IDRASSI	8b1c668b77	Linux: Fix PreferencesDialog build with GCC 4.4 Replace the Linux ntfs3 help icon paint lambda with a small wxWindow subclass and regular paint event handler. GCC 4.4, used on CentOS 6, builds with -std=c++0x but does not support the lambda syntax used in PreferencesDialog.cpp, causing compilation to fail at the ntfs3 help icon handler. The drawing behavior is unchanged.	2026-05-17 13:52:45 +09:00
Mounir IDRASSI	80bce77cb9	Fix CMake 4 compatibility for Linux packaging Keep the executable requirement at CMake 2.8.12 for legacy CentOS 6 package builders while using the version-range syntax to declare policy compatibility up to 3.10. Newer CMake versions use the policy maximum to avoid CMake 4 failures, and older CMake versions ignore the suffix and continue to configure as before.	2026-05-17 13:43:00 +09:00
Mounir IDRASSI	70922afe9b	Remove bank transfer donation option	2026-05-16 21:52:58 +09:00
Mounir IDRASSI	46131086e1	Linux/FUSE: honor inodes and map unknown errors to EIO Enable use_ino for Linux FUSE mounts so stable inode numbers returned by getattr and readdir are reported to userspace. For FUSE3, set fuse_config.use_ino from init; for FUSE2, pass -o use_ino because there is no fuse_config init hook. Also map otherwise unhandled FUSE exceptions to EIO instead of EINTR, since these failures are not signal interruptions and should not encourage retry loops.	2026-05-16 17:38:56 +09:00
Mounir IDRASSI	b82f2dd934	CI: skip cache cleanup on pull requests Fork PR GITHUB_TOKENs cannot delete repository Actions caches, so run the cleanup only after trusted pushes to master.	2026-05-16 10:44:40 +09:00
Mounir IDRASSI	cd101433c5	macOS: recover mounted volume mount points Prefer hdiutil plist entities that carry a mount-point when recording the virtual device. This fixes APFS images where the first dev-entry is not the mounted volume. Add a macOS mounted-volume refresh hook that recovers VirtualDevice and MountPoint from hdiutil info when FUSE-T SMB auxiliary metadata is missing or stale.	2026-05-15 15:35:28 +02:00
nkh0472andGitHub	d4a237fbaf	Update Language.zh-cn.xml (#1732 ) * Update Language.zh-cn.xml * Update Language.zh-cn.xml	2026-05-15 14:23:17 +09:00
Mounir IDRASSI	77e4830c99	macOS: run APFS formatter elevated APFS volume creation can still fail with Permission denied after preparing the raw and block device aliases because newfs_apfs performs privileged APFS container and volume operations beyond opening the device nodes. Route APFS formatting through the elevated CoreService path for non-root macOS runs. Keep the elevated interface narrow by sending only the target device and invoking user UID/GID, validate the device path on the privileged side, rebuild the formatter arguments there, and execute /sbin/newfs_apfs by absolute path to avoid PATH shadowing. Pass -U/-G so the created filesystem preserves the invoking user ownership. Apply the same path to GUI and text-mode creation.	2026-05-15 13:52:21 +09:00
Thomas De RockerandGitHub	213dd2e74a	Update Language.nl.xml (#1730 ) * Update Language.nl.xml * Update Language.nl.xml	2026-05-14 17:13:35 +09:00
PatriccolluandGitHub	22aec149de	Update Corsican translation on 2026-05 (3rd) (#1728 ) * Update Corsican translation on 2026-05 (3rd) * Update Corsican translation on 2026-05 (3rd)	2026-05-14 09:19:26 +09:00
Mr-UpdateandGitHub	efdfc4f273	Update Language.de.xml (#1727 ) * Update Language.de.xml - Translation completed * Update Language.de.xml	2026-05-14 09:18:33 +09:00
Mounir IDRASSI	960f5993b2	macOS: prepare APFS formatter device aliases When creating an APFS filesystem inside a newly created device-hosted volume, VeraCrypt prepared only the raw hdiutil device path before invoking newfs_apfs. On macOS, newfs_apfs may resolve or reopen the corresponding block device path, which can fail with Permission denied for non-root GUI runs. Prepare both raw and block aliases for the temporary formatter device, restore changed owners afterward, and share the helper between GUI and text-mode volume creation. Restore each changed alias independently so one restore failure does not skip the rest.	2026-05-13 14:39:06 +09:00