= cryptsetup-repair(8)
:doctype: manpage
:manmanual: Maintenance Commands
:mansource: cryptsetup {release-version}
:man-linkstyle: pass:[blue R < >]
:COMMON_OPTIONS:
:ACTION_REPAIR:

== Name

cryptsetup-repair - repair the device metadata

== SYNOPSIS

*cryptsetup _repair_ [<options>] <device>*

== DESCRIPTION

Tries to repair the device metadata if possible.
Currently supported only for LUKS device type.

This command is useful for fixing some known benign LUKS metadata header corruptions.
Only basic corruptions of unused keyslot are fixable.
This command will only change the LUKS header, not any keyslot data.
You may enforce LUKS version by adding --type option.

It also repairs (upgrades) LUKS2 reencryption metadata by adding a metadata digest that protects it against malicious changes.

If LUKS2 reencryption was interrupted while writing the reencryption segment, the repair command can perform reencryption recovery so that reencryption can continue later.
Repairing reencryption requires verification of the reencryption keyslot, so a passphrase or keyfile is needed.

*WARNING:* Always create a binary backup of the original header before calling this command.

=== LUKS keyslots corruption detection

The repair command also checks for detectable corruption of keyslot content.
Corruption of a keyslot results in a situation where a known password is no longer accepted.
It can happen due to storage media failure or overwriting the keyslot area with other data.
Only certain corruptions, usually only a low-entropy area (like zeroed blocks), can be detected.

The detection prints only warnings.
It does not modify keyslots.
It can also print more specific offsets on the device for detailed manual inspection.

Please note that the warning can be a false positive (no real corruption happened).
Conversely, if the keyslot is corrupted, no recovery is possible.
You have to use the LUKS header backup.

*<options>* can be [--timeout, --verify-passphrase, --disable-locks, --type, --header, --key-file, --keyfile-size, --keyfile-offset, --key-slot].

include::man/common_options.adoc[]
include::man/common_footer.adoc[]
