Lesson 3.52: Recovering a damaged LUKS header
The LUKS header is a few megabytes at the start of the device, and without it the encrypted data is permanently unreadable, even with the right passphrase. A wrong partitioning command, a disk-wiping script pointed at the wrong device or ransomware that overwrites the first sectors is enough. In the lab Northwind's backup server can't open its backup volume after a storage migration. You confirm the header is gone, pick the right backup by its UUID (not by its file name), test it as a detached header before writing anything, restore it and open the volume.
17 min
You will learn to
- Recognise a missing LUKS header
- Match header backups to a device by UUID
- Test a backup as a detached header
- Restore a header safely
- Open the volume and verify
Key terms
- Header backup
- A file copy of the LUKS header and key slots (luksHeaderBackup).
- Detached header
- Using a header from a file with --header instead of the one on the device.
- luksHeaderRestore
- Writes a header backup back onto the device.
- crypttab
- /etc/crypttab: which encrypted devices to open at boot, by UUID, with which key.
- UUID
- A unique ID written into the header when the volume is created; it identifies the volume, not the disk.
← Writing an AppArmor profile from its logs · All lessons · The IMA measurement log →