Embedded Backup Headers
Each VeraCrypt volume contains an embedded backup header, located at the end of the volume
(see above). The header backup is not a copy of the volume header because it is encrypted with a
different header key derived using a different salt (see the section Header Key Derivation, Salt,
and Iteration Count).
When the volume password and/or PIM and/or keyfiles are changed, or when the header is restored
from the embedded (or an external) header backup, both the volume header and the backup header
(embedded in the volume) are re-encrypted with different header keys (derived using newly
generated salts – the salt for the volume header is different from the salt for the backup header).
Each salt is generated by the VeraCrypt random number generator (see the section Random Number
Generator).
For more information about header backups, see the subsection Tools
