12

I have a file (about 13GB).

When I execute the command file "filename" in terminal, It shows tails_filesystem: LUKS encrypted file, ver 1 [aes, xts-plain64, sha1] UUID : blahblah

And, when I mount in FTK imager for viewing filesystem, It shows Unrecognized file system [unknown]

I know LUKS passphrase for this file dump.

But I don't know how to mount this file dump for analysing.

Google contains only a few methods of encrypting volume by dm-crypt... :'( (In addition, I tried to analyse with freeOTFE & librecrypt. This failed.)

How can I see files in LUKS encrypted filesystem dump??

1 Answer 1

15

Be sure dm-crypt kernel module is loaded.

modprobe dm-crypt

Then I would suggest:

cryptsetup open --type luks /path/to/dump desired-name

This should create a device /dev/mapper/desired-name which you can then mount as used to.

mount /dev/mapper/desired-name /mnt

I'm not sure if this works for a dump. But it's quite possible.

2
  • Thanks for your answer. I can mount it and start to analysis. Thanks very much!!! :)
    – Jensen
    Oct 11, 2016 at 5:35
  • 1
    @Jensen Could you be so kind to marks this answer as correct and vote for it? Oct 11, 2016 at 7:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .