I tried to get the position of LUKS header:

grep -a -b -P --only-matching 'LUKS\xba\xbe' /dev/sdb

It is out of memory.

Some sugest me use 'bgrep' instead, but I don't how to make it work.

bgrep -A 20 'LUKS\xba\xbe' /dev/sda
./bgrep: invalid 2-hex-digit byte value: 'LU'

So how to make this work?


grep tends to run out of memory since it reads until end-of-line, but in binary data there might not be an end-of-line for a long time. You could still use grep by grepping chunks of smaller-than-memory size, roughly:

# dd bs=1M iflag=fullblock if=/dev/sdb skip=X count=Y | grep ...

Rinse and repeat for all chunks. If you're not sure about whether the data will be aligned properly, make the chunks overlap some (next X=X+Y-1).

Alternatively, strings would probably avoid the running out of memory part (very long lines of printable ASCII are unlikely to appear). Then you have a list of offsets to check. These can be false matches since strings excludes the \xba\xbe part.

# strings -t d -n 4 /dev/sdb | grep 'LUKS$'
11534336 LUKS
23068672 LUKS
34603008 LUKS
# losetup --find --show --offset=23068672 /dev/sdb
# cryptsetup luksDump /dev/loop9

Tools like testdisk or binwalk (with a custom magic signature) might be able to locate LUKS headers more efficiently. But for a quick hack, strings usually works well enough.

  • No, strings -t d -n 4 /dev/sdb | grep LUKS lists too many iterms about LUKS even out of the number Terminal window can contain, how can I make it print only LUKS header for LUKS partition? – Maggicmuojet Mar 11 at 7:52
  • @Maggicmuojet Not really possible with strings... Terminal window? Redirect output to a file, and script it. Otherwise, if you're sure about the cipher, you could also e.g. grep -B 1 xts-plain (for luks1 headers, for luks2 you want strings -t d -n 100 | grep '"type":"luks2"' and substract 4096). – frostschutz Mar 11 at 9:24
  • sudo grep -B 1 xts-plain /dev/sdb Then a message: Binary file /dev/sdb matches – Maggicmuojet Mar 12 at 12:42
  • Where to bit /dev/sdb to strings -t d -n 100 | grep '"type":"luks2"'? – Maggicmuojet Mar 12 at 12:44
  • Is there any1 in, and any1 help? – Maggicmuojet Mar 14 at 5:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.