LUKS v2 Support

[atom]

It's usually 4096 anti-forensics blocks, people often confused that with bytes. So basically what you need is a size that allows reading the first encrypted sector, so that hashcat can do the decryption on that sector. Try 128mb instead of 4096, that should be large enough, but on the encrypted partition, not the virtual block device which ewfmount/xmount creates.