LUKS encrypted disk forensics
This great article from Sans Computer Forensics shows how to perform forensics investigations in a disk image that contains LUKS volumes.
The following tricks appear in the article:
- Use losetup to create a read-only logical device pointing to the LUKS partition.
- Use cryptsetup to verify that the partitions is LUKS and then mount it.
- LVM2 Fu to load/unload the Volum Groups