Operation Manual

149
VeraCrypt Volume Format Specification
Offset
(bytes)
Size
(bytes)
Encryption
Status
*
Description
0
64
Unencrypted
‡
Salt
64
4
Encrypted
ASCII string “VERA”
68
2
Encrypted
Volume header format version (2)
70
2
Encrypted
Minimum program version required to open the volume
72
4
Encrypted
CRC-32 checksum of the (decrypted) bytes 256–511
76
16
Encrypted
Reserved (must contain zeroes)
92
8
Encrypted
Size of hidden volume (set to zero in non-hidden volumes)
100
8
Encrypted
Size of volume
108
8
Encrypted
Byte offset of the start of the master key scope
116
8
Encrypted
Size of the encrypted area within the master key scope
124
4
Encrypted
Flag bits (bit 0 set: system encryption; bit 1 set: non-system
in-place-encrypted volume; bits 2-31 are reserved)
128
4
Encrypted
Sector size (in bytes)
132
120
Encrypted
Reserved (must contain zeroes)
252
4
Encrypted
CRC-32 checksum of the (decrypted) bytes 64–251
256
Var.
Encrypted
Concatenated primary and secondary master keys
§
512
65024
Encrypted
Reserved (for system encryption, this item is omitted
††
)
65536
65536
Encrypted /
Area for hidden volume header (if there is no hidden volume
Unencrypted
‡
within the volume, this area contains random data
**
). For
system encryption, this item is omitted.
††
See bytes 0–65535.
131072
Var.
Encrypted
Data area (master key scope). For system encryption, offset
may be different (depending on offset of system partition).
S–131072
†
65536
Encrypted /
Backup header (encrypted with a different header key derived
Unencrypted
‡
using a different salt). For system encryption, this item is
omitted.
††
See bytes 0–65535.
S–65536
65536
Encrypted /
Backup header for hidden volume (encrypted with a different
Unencrypted
‡
header key derived using a different salt). If there is no hidden
volume within the volume, this area contains random data.
**
For
system encryption, this item is omitted.
††
See bytes 0–65535.
*
The encrypted areas of the volume header are encrypted in XTS mode using the primary and secondary header keys. For more
information, see the section Encryption Scheme and the section Header Key Derivation, Salt, and Iteration Count.
†
S denotes the size of the volume host (in bytes).
‡
Note that the salt does not need to be encrypted, as it does not have to be kept secret [7] (salt is a sequence of random values).
§
Multiple concatenated master keys are stored here when the volume is encrypted using a cascade of ciphers (secondary master keys
are used for XTS mode).
**
See below in this section for information on the method used to fill free volume space with random data when the volume is
created.
††
Here, the meaning of "system encryption" does not include a hidden volume containing a hidden operating system.