Inspect a TCRYPT Header with cryptsetup tcryptDump

cryptsetup tcryptDump reads the header of a TrueCrypt or VeraCrypt-compatible volume without opening a mapping or changing the device. The examples target cryptsetup 2.7.0 from the installed cryptsetup-bin package, version 2:2.7.0-1ubuntu4.2. Allow about ten minutes for a read-only inspection, plus time to find the right device.

You need a shell, the device or image file, and a passphrase if the header requires one. A device path such as /dev/sdb must be readable by your account; use sudo only when ordinary read access fails. Do not run these examples against a device you intend to modify until you have checked the path carefully.

1. Confirm the installed command

Check the version and action-specific help first. Both are ordinary, read-only checks:

$ cryptsetup --version
cryptsetup 2.7.0 flags: UDEV BLKID KEYRING FIPS KERNEL_CAPI HW_OPAL
$ cryptsetup tcryptDump --help

The command shape is cryptsetup tcryptDump [options] device. Keep the capital D in the action name when copying it into scripts and notes.

$ command -v cryptsetup
/usr/sbin/cryptsetup

2. Inspect the normal header

Replace /path/to/tcrypt-device with an exact block-device path or a file containing the volume. This reads metadata and asks for the passphrase interactively when needed:

$ cryptsetup tcryptDump /path/to/tcrypt-device

Successful output begins with TCRYPT header information: cipher chain, cipher mode, payload offset, key size. Exact values depend on the volume, and a successful dump does not open the volume or create a device-mapper mapping.

Do not copy a guessed path from a listing into a destructive workflow. Check the candidate first:

$ ls -l /path/to/tcrypt-device
$ file /path/to/tcrypt-device

If the device is only readable by root, rerun the same inspection with elevated privileges:

$ sudo cryptsetup tcryptDump /dev/sdb

Elevated privileges change who can read the volume. They do not repair a wrong path, missing header or incorrect passphrase.

3. Select a non-default TCRYPT header

TrueCrypt-compatible volumes can have more than one relevant header location. Use an explicit selector only when you know the volume layout:

• Hidden volume: --tcrypt-hidden selects the hidden-volume header.
• System volume: --tcrypt-system selects a system TCRYPT drive with a bootloader.
• Backup header: --tcrypt-backup selects the backup, or secondary, header.

$ cryptsetup tcryptDump --tcrypt-backup /path/to/tcrypt-device

Use one selector at a time unless you have a specific reason to combine options and have checked the result. A header selector is not a conversion or repair operation: if the selected header is not present or cannot be opened, cryptsetup errors out and leaves the device unchanged.

4. Handle VeraCrypt volumes deliberately

In cryptsetup 2.7.0, VeraCrypt-compatible mode is enabled by default for TCRYPT operations. The explicit --veracrypt option is accepted but ignored. To restrict detection to TrueCrypt-compatible modes:

$ cryptsetup tcryptDump --disable-veracrypt /path/to/tcrypt-device

For a VeraCrypt volume using a custom Personal Iteration Multiplier, supply the known value:

$ cryptsetup tcryptDump --veracrypt-pim 123 /path/to/veracrypt-volume

Replace 123 with the actual PIM; do not guess it repeatedly on a slow or busy system. If the PIM is unknown, ask for it interactively instead:

$ cryptsetup tcryptDump --veracrypt-query-pim /path/to/veracrypt-volume

These options change how the header is searched and derived. They do not make a VeraCrypt volume compatible with another tool or change its on-disk format.

5. Supply a passphrase without putting it in shell history

The normal interactive prompt is usually safest for a one-off check. If a process needs a key file, use --key-file and protect it with normal filesystem permissions:

$ cryptsetup tcryptDump --key-file /secure/path/tcrypt-passphrase /path/to/tcrypt-device

A key file is combined with cryptsetup's passphrase processing, so treat it as secret material. The option can repeat when the volume needs more than one key-file input. Avoid a passphrase directly on the command line: it can appear in shell history or process inspection.

To read from standard input, use a literal hyphen:

$ printf '%s' 'REPLACE_WITH_PASSPHRASE' | cryptsetup tcryptDump --key-file - /path/to/tcrypt-device

Safe to understand, not safe to paste with a real passphrase into a shared shell transcript. Standard-input reading does not stop at newline characters, so control exactly what your calling process supplies. Do not add --verify-passphrase to a key-file or stdin workflow: the manpage says verification applies to interactive input and is ignored for file or stdin input.

6. Use timeouts and diagnostics without leaking secrets

The default interactive timeout is zero: wait forever. Set a finite timeout when a check runs from a boot or monitoring path that must not stall:

$ cryptsetup tcryptDump --timeout 30 /path/to/tcrypt-device

The timeout applies to terminal passphrase input and has no effect with --key-file. It does not limit every part of header detection or key derivation.

When a dump fails, repeat the command with the path and header selection reviewed first. Add debug output only if you need a report for diagnosis:

$ cryptsetup tcryptDump --debug /path/to/tcrypt-device

Debug lines are prefixed with #. Review the output before sending it anywhere: never include passphrases, key files or volume-key output in an issue, ticket or chat transcript.

7. Never expose the volume key casually

--dump-volume-key prints the volume key instead of ordinary header information. Anyone who obtains that key can decrypt the data without the passphrase. The installed manpage warns that compromising it means the whole device must be erased to prevent further access.

If you ran the option by accident, assume the displayed key is compromised. Stop distributing the output, preserve evidence for whoever is responsible for the volume, and follow your key-compromise response plan. There is no undo for a key that has already been displayed.

Common failures

Device or file not found, or permission denied: check the path with ls -l, confirm the device is present, and use sudo only for the read permission problem. Do not create or format anything to make the command accept the path.

No valid TCRYPT header: check whether the input is the right container, whether it is a system or hidden volume, and whether --tcrypt-backup is appropriate. For VeraCrypt, confirm the PIM and remember that VeraCrypt mode is already on by default.

Passphrase rejected: stop retrying if the volume may use a key file, hidden header or different PIM. Check the input method and header selection without changing the device. A failed dump does not justify --batch-mode: that option suppresses confirmation questions and also disables passphrase verification unless verification was explicitly requested.

Done means

• Version and path confirmed: you checked the installed cryptsetup version and exact device path.
• Header dumped safely: you dumped the intended TCRYPT header without opening or modifying a mapping.
• Right selector used: hidden, system, backup or VeraCrypt parameters used only when the volume needs them.
• Secrets kept out of logs: passphrases and especially volume keys stayed out of shared transcripts.
• Failures explained, not guessed: any failure traced to path, header selection, passphrase method or PIM.