diff --git a/sh/cryptsetup.sh b/sh/cryptsetup.sh
index 024a315..b562ce3 100644
--- a/sh/cryptsetup.sh
+++ b/sh/cryptsetup.sh
@@ -1,6 +1,7 @@
 _rwx_cmd_cs() { rwx_crypt "${@}"; }
 
 RWX_CRYPT_ROOT="/data/home/user/crypt"
+RWX_CRYPT_VAR="/var/lib/crypt"
 
 rwx_crypt_device() {
 	local device size
@@ -48,28 +49,35 @@ rwx_crypt() {
 			if [ -f "${crypt_file}" ]; then
 				crypt_map="${mapper}/${crypt_arg}"
 				crypt_mount="${mount_root}/${crypt_arg}"
+				local device
 				case "${action}" in
 				"${action_open}")
-					local device
 					if ! device="$(rwx_crypt_device)"; then
 						rwx_log_error 4 "No device available"
 					fi
+					# record device
+					if ! rwx_file_write \
+						"${RWX_CRYPT_VAR}/${crypt_arg}" "${device}"; then
+						rwx_log_error 5 "Writing failure: ${device}"
+					fi
 					# connect device
 					if ! qemu-nbd --connect "${device}" "${crypt_file}"; then
-						rwx_log_error 5 "Connection failure: ${device}"
+						rwx_log_error 6 "Connection failure: ${device}"
 					fi
 					# open device
-					echo "${pass_phrase}" |
-						cryptsetup luksOpen "${device}" "${crypt_arg}"
+					if ! echo "${pass_phrase}" |
+						cryptsetup luksOpen "${device}" "${crypt_arg}"; then
+						rwx_log_error 7 "Opening failure: ${device}"
+					fi
 					# make mount directory
 					if ! mkdir --parents "${crypt_mount}"; then
-						rwx_log_error 7 "Making failure: ${crypt_mount}"
+						rwx_log_error 8 "Making failure: ${crypt_mount}"
 					fi
 					# mount file system
 					if ! mount \
 						--options "autodefrag,compress-force=zstd" \
 						"${crypt_map}" "${crypt_mount}"; then
-						rwx_log_error 8 "Mounting failure: ${crypt_map}"
+						rwx_log_error 9 "Mounting failure: ${crypt_map}"
 					fi
 					;;
 				"${action_close}")
@@ -85,8 +93,14 @@ rwx_crypt() {
 					if ! cryptsetup luksClose "${crypt_arg}"; then
 						rwx_log_error 6 "Closing failure: ${crypt_arg}"
 					fi
-					# TODO disconnect device
-					rwx_log_error 7 "Disconnecting failure: ${crypt_arg}"
+					# load device
+					if ! device="$(cat "${RWX_CRYPT_ROOT}/${crypt_arg}")"; then
+						rwx_log_error 7 "Loading failure: ${crypt_arg}"
+					fi
+					# disconnect device
+					if ! qemu-nbd --disconnect "${device}"; then
+						rwx_log_error 8 "Disconnection failure: ${device}"
+					fi
 					;;
 				*) ;;
 				esac