Open an Encrypted Device with cryptsetup Without Losing the Mapping

You will finish with an encrypted device opened as /dev/mapper/backup01, a way to verify that the mapping is active, and the exact command to remove it cleanly. The examples target cryptsetup 2.7.0 from cryptsetup-bin 2:2.7.0-1ubuntu4.2. Allow about fifteen minutes, plus the time needed to identify the right device and enter its passphrase.

You need a root shell or sudo, an existing encrypted device, and its passphrase or key file. This guide opens an existing volume. It does not format, erase, resize or repair one. Those operations can destroy data.

1. Identify the device and mapping name

Use a stable device path when possible. A filesystem label or UUID is easier to review than a guessed partition number, but the path must identify the encrypted device itself. Inspect the block-device inventory as an ordinary, read-only command:

$ lsblk -o NAME,PATH,SIZE,FSTYPE,LABEL,UUID,MOUNTPOINTS
$ cryptsetup --version
cryptsetup 2.7.0 flags: UDEV BLKID KEYRING FIPS KERNEL_CAPI HW_OPAL

Set a short mapping name that describes the purpose, not the secret. In the remaining examples, replace /dev/disk/by-uuid/DEVICE-UUID with the encrypted device you checked above:

DEVICE=/dev/disk/by-uuid/DEVICE-UUID
NAME=backup01

Checkpoint: confirm that lsblk shows the device you intend to unlock. Do not infer it from its size alone. Opening the wrong block device can expose the wrong data and may interrupt another system's storage.

2. Validate the command line without touching the device

Before a real activation, cryptsetup can validate the arguments and then stop. This is a useful check for scripts and copied commands:

$ cryptsetup open --test-args --type luks "$DEVICE" "$NAME"
No action taken. Invoked with --test-args option.

The installed command returns status 0 for this argument check. The check does not read the LUKS header, test the passphrase or create /dev/mapper/backup01. It catches option and positional-argument mistakes only.

For a disposable syntax check of a plain mapping, cryptsetup 2.7.0 also accepts an explicit cipher, key size and hash:

$ cryptsetup open --test-args --type plain \
    --cipher aes-cbc-essiv:sha256 --key-size 256 --hash sha256 \
    /path/to/raw-device backup-plain
No action taken. Invoked with --test-args option.

Do not use --type plain for a LUKS device. Plain dm-crypt has no LUKS metadata to identify its parameters, so the cipher, key size, hash, offset and other values must match the original setup exactly. The manpage warns that defaults can differ between cryptsetup versions.

3. Test a LUKS passphrase without activating the mapping

LUKS is the default device type, but stating it makes a script easier to review. This command needs elevated privileges because it reads the device and may consult protected key material:

$ sudo cryptsetup open --type luks --test-passphrase "$DEVICE"
Enter passphrase for /dev/disk/by-uuid/DEVICE-UUID:
$ printf 'exit status: %s\n' "$?"
exit status: 0

--test-passphrase checks the supplied passphrase and does not activate a device mapping. The prompt text and device wording can vary. A non-zero status means the check failed; it does not justify repeated guesses against a live service or a volume you do not own.

On LUKS2, cryptsetup first considers eligible tokens that do not need a PIN. If no token unlocks a keyslot and no key file was supplied, it prompts interactively. Use --token-id, --token-type or --token-only only when you have confirmed how that volume's token setup is meant to work.

4. Open the mapping

When the passphrase check is correct, activate the mapping with the normal LUKS command:

$ sudo cryptsetup open --type luks "$DEVICE" "$NAME"
Enter passphrase for /dev/disk/by-uuid/DEVICE-UUID:
$ printf 'exit status: %s\n' "$?"
exit status: 0

A successful command normally prints no success message. The result is a device-mapper node at /dev/mapper/backup01. Do not assume that a zero exit status means a filesystem is mounted; activation and mounting are separate operations.

For a read-only inspection, add --readonly before the device and name:

$ sudo cryptsetup open --type luks --readonly "$DEVICE" "$NAME"
Enter passphrase for /dev/disk/by-uuid/DEVICE-UUID:

This creates a read-only mapping, but it does not make every later operation safe. A filesystem can still require its own read-only mount rules, and applications can still make mistakes against the exposed data.

5. Verify what is active

Check the mapping immediately after opening it:

$ sudo cryptsetup status "$NAME"
/dev/mapper/backup01 is active and is in use.
  type:    LUKS2
  cipher:  ...
  device:  /dev/...
  offset:  ... sectors
  size:    ... sectors
  mode:    read/write
$ lsblk -o NAME,TYPE,SIZE,FSTYPE,MOUNTPOINTS /dev/mapper/"$NAME"
NAME     TYPE  SIZE FSTYPE MOUNTPOINTS
backup01 crypt    ...

The details depend on the volume. The useful checks are the active status, the expected device type, and the expected backing device. If the mapping name already exists, stop and inspect it rather than refreshing or overwriting parameters by guesswork.

If you only need a passphrase check, use --test-passphrase and do not open the mapping. If you need an application to use the volume, mount only the filesystem you identified, using your normal mount policy. Opening an encrypted device does not validate the filesystem inside it.

6. Use the right type for compatible formats

The command also supports older or foreign formats when the matching type is known. The standard positional order remains <device> <name>:

$ sudo cryptsetup open --type bitlk /dev/sdb2 windows-data
$ sudo cryptsetup open --type tcrypt /dev/sdc1 vault-data
$ sudo cryptsetup open --type loopaes --key-file /root/keys/loopaes.key /dev/sdd1 archive-data
$ sudo cryptsetup open --type fvault2 /dev/sde2 mac-data

These examples are templates, not safe guesses. BitLocker, TrueCrypt or VeraCrypt, loop-AES and FileVault2 each have format-specific requirements. For TCRYPT, --tcrypt-hidden can select a hidden header, and --allow-discards must not be combined with it because discard activity can destroy hidden-volume data. For loop-AES, do not type a multi-key file directly at a terminal; use a key file or a controlled stdin pipeline.

The historical aliases still exist: luksOpen, plainOpen, loopaesOpen, tcryptOpen, bitlkOpen and fvault2Open. create is different: it is the old plain mode and reverses the positional order to create <name> <device>. Prefer open --type ... in new commands so the type and argument order are visible.

7. Close the mapping when finished

Unmount any filesystem first, stop processes using it, and then remove the mapping. Closing is an elevated, service-disrupting action:

$ findmnt /dev/mapper/"$NAME"
$ sudo cryptsetup close "$NAME"
$ sudo cryptsetup status "$NAME"
Device backup01 is not active.

If close reports that the device is busy, find the remaining mount or process before trying again. Do not use force-like workarounds during a write. Check with findmnt and your usual process tools, allow outstanding I/O to finish, then retry the close. A successful close removes the mapping and makes its key unavailable to the kernel dm-crypt target; it does not erase the encrypted data.