table of contents
- Tumbleweed 2.8.0-1.1
- Leap-16.0
- Leap-15.6
CRYPTSETUP-TCRYPTDUMP(8) | Maintenance Commands | CRYPTSETUP-TCRYPTDUMP(8) |
NAME¶
cryptsetup-tcryptDump - dump the header information of a TCRYPT (TrueCrypt or VeraCrypt compatible) device
SYNOPSIS¶
cryptsetup tcryptDump [<options>] <device>
DESCRIPTION¶
Dump the header information of a TCRYPT (TrueCrypt or VeraCrypt compatible) device.
If the --dump-volume-key option is used, the TCRYPT device volume key is dumped instead of TCRYPT header info. Beware that the volume key (or concatenated volume keys if cipher chain is used) can be used to decrypt the data stored in the TCRYPT container without a passphrase. This means that if the volume key is compromised, the whole device has to be erased to prevent further access. Use this option carefully.
<options> can be [--dump-volume-key, --key-file, --tcrypt-hidden, --tcrypt-system, --tcrypt-backup, --veracrypt (ignored), --disable-veracrypt, --veracrypt-pim, --veracrypt-query-pim, --cipher, --hash, --header, --verify-passphrase, --timeout].
The keyfile parameter allows a combination of file content with the passphrase and can be repeated.
OPTIONS¶
--batch-mode, -q
If the --verify-passphrase option is not specified, this option also switches off the passphrase verification.
--cipher, -c <cipher-spec>
For tcrypt device type it restricts checked cipher chains when looking for header.
--debug or --debug-json
If --debug-json is used, additional LUKS2 JSON data structures are printed.
--disable-veracrypt
--dump-volume-key, --dump-master-key (OBSOLETE alias)
--hash, -h <hash-spec>
For tcrypt device type, it restricts checked PBKDF2 variants when looking for header.
--header <device or file storing the LUKS header>
For commands that change the LUKS header (e.g. luksAddKey), specify the device or file with the LUKS header directly as the LUKS device.
--help, -?
--key-file, -d name
If the name given is "-", then the passphrase will be read from stdin. In this case, reading will not stop at newline characters.
See section NOTES ON PASSPHRASE PROCESSING in cryptsetup(8) for more information.
--tcrypt-backup, --tcrypt-hidden, --tcrypt-system
Using a system-encrypted device with the --tcrypt-system option requires specific settings to work as expected.
TrueCrypt/VeraCrypt supports full system encryption (only a partition table is not encrypted) or system partition encryption (only a system partition is encrypted). The metadata header then contains the offset and size of the encrypted area. Cryptsetup needs to know the specific partition offset to calculate encryption parameters. To properly map a partition, you must specify a real partition device so cryptsetup can calculate this offset.
While you can use a full device as a parameter (/dev/sdb), always prefer to specify the partition you want to map (/dev/sdb1) as only system partition mode can be detected this way.
For mapping images (stored in a file), you can use the additional --header option with the real partition device. If the --header is used (and it is different from the data image), cryptsetup expects that the data image contains a snapshot of the data partition only.
If --header is not used (or points to the same image), cryptsetup expects that the image contains a full disk (including the partition table). This can map a full encrypted area not directly mountable as a filesystem. Please prefer creating a loop device with partitions (losetup -P, see losetup(8) man page) and use a real partition (/dev/loopXp1) as the device parameter.
--timeout, -t <number of seconds>
This option is useful when the system should not stall if the user does not input a passphrase, e.g. during boot. The default is a value of 0 seconds, which means to wait forever.
--usage
--veracrypt
--veracrypt-pim, --veracrypt-query-pim
--verify-passphrase, -y
--version, -V
REPORTING BUGS¶
Report bugs at cryptsetup mailing list <cryptsetup@lists.linux.dev> or in Issues project section <https://gitlab.com/cryptsetup/cryptsetup/-/issues/new>.
Please attach output of the failed command with --debug option added.
SEE ALSO¶
Cryptsetup FAQ <https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions>
CRYPTSETUP¶
Part of cryptsetup project <https://gitlab.com/cryptsetup/cryptsetup/>.
2025-06-26 | cryptsetup 2.8.0 |