I have a dd of a computer which has a LUKS-encrypted partition. I do not have the password but I do have a recovery key which would allow me to change the password through a GUI interface when the computer is booted. Unfortunately, I no longer have direct access to the source computer to reset the password.

What I wish to do is reset the password using the recovery key so I can then access the data. I can obviously dump the dd copy to a HDD and boot the system but is there a way to reset the LUKS password with the recovery key through a CLI? I am thinking the ideal scenario is to mount the DD and then reset the password.


  • 2
    What's the original OS? I can't seem to find a reference to a recovery key in luks. May 22 '17 at 16:07
  • Still can't find a reference to a recovery key. I see two possibilities : either it's a second key, or it's the master key. access.redhat.com/solutions/1543373 covers how to add a new password in both cases. If it's neither, someone with more knowledge of RHEL might be able to answer. May 22 '17 at 20:08
  • Is there anything else you want me to add to my answer?
    – forest
    May 20 at 1:58

For the partition which is encrypted with LUKS, you will need to get the offset for the partition as well as the logical sector size of the device. Using sfdisk together with a regex expression is useful for this. Assuming the partition number with LUKS is partition 2, and the image file is backup.img:

# set the partition number for LUKS and the image file

# get offset of partition, sector size, and the next free loop device
partoff=$(sfdisk -d $partdev | grep -oP "$partnum : start= .*\K[0-9]*"
secsize=$(stat -c %B $partdev)
loopdev=$(losetup -f)

# using these values, create a loop device, decrypt, and mount LUKS
losetup $loopdev -o $((partoff * secsize)) $partdev
cryptsetup luksOpen $loopdev backup_crypt
mount /dev/mapper/backup_crypt /mnt

You now have the decrypted filesystem available at /mnt. Do what you want with it. When you're finished, you need to unmount, close the LUKS device, and remove the loop device:

umount /mnt
cryptsetup luksClose backup_crypt
losetup -d $loopdev

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.