cryptsetup-luksHeaderBackup - Linux


cryptsetup-luksHeaderBackup is a utility for backing up the LUKS header of an encrypted block device. It creates a binary file containing the header, which can be used to recover the device if the original header is damaged or lost.


cryptsetup-luksHeaderBackup [options] --header-file=<backup file> <device>


Required arguments:

  • --header-file – Specifies the path to the file where the header backup will be saved.
  • <device> – The encrypted block device to back up the header from.

Optional arguments:

  • -v, --verbose – Enable verbose output.
  • -h, --help – Display help information and exit.


Simple Usage:

cryptsetup-luksHeaderBackup --header-file=/tmp/backup.luks /dev/mapper/my_encrypted_device

Backing up header with custom filename:

cryptsetup-luksHeaderBackup --header-file=/mnt/backup/custom_header.luks /dev/mapper/my_encrypted_device

Common Issues

  • Insufficient permissions: Ensure you have sufficient permissions to access and modify both the device and the backup file.
  • Device not unlocked: Unlock the encrypted device before attempting to back up its header.


cryptsetup-luksHeaderBackup can be integrated with other commands for automated backups. For example, the following script creates a header backup at regular intervals:

while true; do
   cryptsetup-luksHeaderBackup --header-file=/tmp/$(date +%F-%T).luks /dev/mapper/my_encrypted_device
   sleep 3600  # Sleep for 1 hour

Related Commands

  • cryptsetup-luksOpen – Opens an encrypted block device.
  • cryptsetup-luksClose – Closes an opened encrypted block device.
  • cryptsetup-luksFormat – Formats a block device with LUKS encryption.