LUKS Encrypted Volume
| Format | LUKS Encrypted Volume |
|---|---|
| Short name | LUKS |
| Category | filesystem |
| Platforms | Linux |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Linux Unified Key Setup, the standard Linux disk encryption format. A header with cipher, UUID and up to 8 (LUKS1) or 32 (LUKS2) key slots, each holding the volume key encrypted with a passphrase or key file; LUKS2 adds a JSON metadata area and a secondary header copy. Key slot material is stored using an anti-forensic splitter, so a wiped key slot is practically unrecoverable. The header can also be detached and stored separately; the encrypted volume then shows no signature and appears as random data, and a header backup may be required for decryption. Without a slot's secret the data area is ciphertext.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 4C 55 4B 53 BA BE | LUKS.. | Primary header magic 'LUKS' 0xBA 0xBE |
| offset 16384 (0x4000) | 53 4B 55 4C BA BE | SKUL.. | LUKS2 secondary header magic 'SKUL' 0xBA 0xBE at default offset 0x4000 (other fixed offsets up to 4 MiB possible) |
Known extensions
None recorded
References
- LUKS1 On-Disk Format Specification (cryptsetup) https://gitlab.com/cryptsetup/cryptsetup/-/wikis/LUKS-standard/on-disk-format.pdf
- LUKS2 On-Disk Format Specification (cryptsetup) https://gitlab.com/cryptsetup/LUKS2-docs/-/raw/main/luks2_doc_wip.pdf
- LUKS Disk Encryption format (libyal/libluksde) https://github.com/libyal/libluksde/blob/main/documentation/Linux%20Unified%20Key%20Setup%20(LUKS)%20Disk%20Encryption%20format.asciidoc
- ForensicsWiki — Linux unified key setup (LUKS) https://forensics.wiki/linux_unified_key_setup_(luks)/
Cite this entry
Crush Format Reference, “LUKS Encrypted Volume”. https://kalink0.github.io/crush-forensics/formats/luks/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction