CRYPTSETUP-FVAULT2DUMP(8)

💖 CRYPTSETUP-FVAULT2DUMP 💖

okay bestie, you found the cryptsetup-fvault2Dump page — it's one of the cryptsetup family of maintenance commands, and it is literally the one that shows you what's inside a FVAULT2 (FileVault2 compatible) device. let's get into it 🎀

---

✨ NAME ✨

cryptsetup-fvault2Dump — dump the header information of a FVAULT2 (FileVault2 compatible) device 🦋

---

✨ SYNOPSIS ✨

cryptsetup fvault2Dump [<options>] <device>

---

✨ DESCRIPTION ✨

Dump the header information of a FVAULT2 (FileVault2 compatible) device. that's the whole vibe 💅

If you use the --dump-volume-key option, then instead of header info you get the FVAULT2 device volume key dumped out. and yes, to dump the volume key you have to provide a password or a keyfile. no sneaking in without creds, periodt.

🚨 okay so real talk bestie, this next part is important. beware that the volume key can be used to decrypt the data stored in the container without a passphrase. that means if the volume key gets compromised, the whole device has to be erased to prevent further access. so use this option carefully. i'm not being dramatic, that's just the truth 😭

<options> can be [--dump-volume-key, --volume-key-file, --key-file, --keyfile-offset, --keyfile-size, --timeout].

---

✨ OPTIONS ✨

• --batch-mode, -q — suppresses all confirmation questions. use with care! 🫶 also, if the --verify-passphrase option is not specified, this option also switches off the passphrase verification.
• --debug or --debug-json — run in debug mode with full diagnostic logs. debug output lines are always prefixed by #. and if you use --debug-json, extra LUKS2 JSON data structures get printed too. she's thorough 💅
• --dump-volume-key, --dump-master-key (OBSOLETE alias) — print the volume key in the displayed information. use with care, because the volume key can be used to bypass the passphrases. see also the --volume-key-file option. ⚠️
• --help, -? — show help text and default parameters. iconic, always available 🎀
• --key-file, -d file — read the passphrase from the file. if the name you give is -, then the passphrase gets read from stdin. in that case, reading will not stop at newline characters. see the section NOTES ON PASSPHRASE PROCESSING in cryptsetup(8) for more info 🌸
• --keyfile-offset value — skip value bytes at the beginning of the key file.
• --keyfile-size, -l value — read a maximum of value bytes from the key file. the default is to read the whole file up to the compiled-in maximum, which you can query with --help. supplying more data than the compiled-in maximum aborts the operation. this option is useful to cut trailing newlines, for example. and if --keyfile-offset is also given, the size count starts after the offset. ✨
• --timeout, -t seconds — the number of seconds to wait before a timeout on passphrase input via terminal. it's relevant every time a passphrase is asked. it has no effect if used in conjunction with --key-file. this option is useful when the system should not stall if the user doesn't input a passphrase, like during boot. the default is a value of 0 seconds, which means wait forever 💀
• --usage — show short option help.
• --version, -V — show the program version.
• --volume-key-file file, --master-key-file file (OBSOLETE alias) — use a volume key stored in a file. the volume key gets stored in a file instead of being printed out to standard output. very demure, very mindful 🙈

---

✨ REPORTING BUGS ✨

found a bug? report it at the cryptsetup mailing list <cryptsetup@lists.linux.dev> or in the Issues project section <https://gitlab.com/cryptsetup/cryptsetup/-/issues/new>. 🐛

please attach the output of the failed command with the --debug option added. that part is not optional bestie, it helps so much 🫶

---

✨ SEE ALSO ✨

• Cryptsetup FAQ <https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions>
• cryptsetup(8), integritysetup(8) and veritysetup(8)

---

✨ CRYPTSETUP ✨

Part of cryptsetup project <https://gitlab.com/cryptsetup/cryptsetup/>. 👑

---

and that's the whole page, no cap 💜 this was cryptsetup version 2.8.8, dated 2026-09-07, and it's page CRYPTSETUP-FVAULT2DUMP(8) of the Maintenance Commands. go dump some headers responsibly, bestie 🌈✨