Thursday, October 7, 2010

LUKS encrypted disk forensics

This great article from Sans Computer Forensics  shows how to perform forensics investigations in a disk image that contains LUKS volumes.

The following tricks appear in the article:
  • Use 'losetup' to create a read-only logical device pointing to the LUKS partition.
  • Use 'cryptsetup' to verify that the partitions is LUKS and then mount it.
  • LVM2 Fu to load/unload the Volum Groups

No comments:

Post a Comment