What does the on-disk structure of LUKS look like?
A LUKS partition consists of a header, followed by 8 key-slot descriptors, followed by 8 key slots, followed by the encrypted data area. Header and key-slot descriptors fill the first 592 bytes. The key-slot size depends on the creation parameters, namely on the number of anti-forensic stripes, key material offset and master key size. With the default parameters, each key-slot is a bit less than 128kiB in size. Due to sector alignment of the key-slot start, that means the key block 0 is at offset 0x1000-0x20400, key block 1 at offset 0x21000-0x40400, and key block 7 at offset 0xc1000-0xe0400. The space to the next full sector address is padded with zeros. Never used key-slots are filled with what the disk originally contained there, a key-slot removed with “luksRemoveKey” or “luksKillSlot” gets filled with 0xff. Start of bulk data is at 0x101000, i.e. at 1’052’672 bytes, i.e. at 1MiB + 4096 bytes from the start of the partition. This is also the value given by command “luksDump” with “
