Abstract: LUKS as one of the popular disk encryption technology is common to all versions of Linux and has characteristics as follows: support multi-user / password access to the same device; master key does not rely on user password, the user password can be changed without re-encrypting the user data; use anti-forensic splitter to store the encrypted master key for the sake of safety. Given that most of current forensic software cannot obtain forensics quickly on LUKS volume, this paper researches the principles of LUKS encryption, and based on this, proposes a LUKS decryption method, dependent on the Linux system. This method can greatly improve the forensic efficiency.

Key words: LUKS, master key, key slot, split master key, forensics