9

I have a file (about 13GB).

When I execute the command file "filename" in terminal, It shows tails_filesystem: LUKS encrypted file, ver 1 [aes, xts-plain64, sha1] UUID : blahblah

And, when I mount in FTK imager for viewing filesystem, It shows Unrecognized file system [unknown]

I know LUKS passphrase for this file dump.

But I don't know how to mount this file dump for analysing.

Google contains only a few methods of encrypting volume by dm-crypt... :'( (In addition, I tried to analyse with freeOTFE & librecrypt. This failed.)

How can I see files in LUKS encrypted filesystem dump??

11

Be sure dm-crypt kernel module is loaded.

modprobe dm-crypt

Then I would suggest:

cryptsetup open --type luks /path/to/dump desired-name

This should create a device /dev/mapper/desired-name which you can then mount as used to.

mount /dev/mapper/desired-name /mnt

I'm not sure if this works for a dump. But it's quite possible.

| improve this answer | |
  • Thanks for your answer. I can mount it and start to analysis. Thanks very much!!! :) – Jensen Oct 11 '16 at 5:35
  • 1
    @Jensen Could you be so kind to marks this answer as correct and vote for it? – Ulrich-Lorenz Schlüter Oct 11 '16 at 7:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.