LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices

Reply
 
Search this Thread
Old 11-06-2012, 06:56 AM   #1
unixedway
LQ Newbie
 
Registered: Mar 2009
Distribution: Suse , Mint
Posts: 14

Rep: Reputation: 1
recover from deleted luks encryption partition


I had four partitions one of them was encrypted with DM-Crypt with LUKS, i was trying to upgrade the OS but by mistake i deleted all the partitions including the encrypted one , is there anyway to recover the encrypted partition coz it had all the important data ?
 
Old 11-06-2012, 08:34 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,947
Blog Entries: 54

Rep: Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732
Quote:
Originally Posted by unixedway View Post
is there anyway to recover the encrypted partition (..)?
If you previously saved the disk layout with 'sfdisk' (as in 'sfdisk -d /dev/devicename' > /path/somefile') then you can restore it ('cat /path/somefile | sfdisk /dev/devicename'), else boot a Live CD containing Testdisk and do a quick search to see if it can find the partitions. Note while this may restore the partition table you will only be able to access your LUKS partition if nothing was overwritten because by default the LUKS header resides in the first 2 MB of that partition AFAIK.
I should say something about making backups but I guess by now you already know its value.
 
Old 11-07-2012, 02:00 PM   #3
unixedway
LQ Newbie
 
Registered: Mar 2009
Distribution: Suse , Mint
Posts: 14

Original Poster
Rep: Reputation: 1
i used test disk to search for my partitions i could recover my home and root partitions but for the luks one, it found a luks partition with only 2 MB !!! it seems that its the header , do you know what can i do else ?
 
Old 11-07-2012, 03:47 PM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,947
Blog Entries: 54

Rep: Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732
Substitute "devicename", run testdisk like explained before (quick search) then attach /tmp/sfdisk.log and testdisk.log:
Code:
sfdisk -d /dev/devicename | tee /tmp/sfdisk.log
testdisk /debug /log /dev/devicename
 
Old 11-08-2012, 01:11 AM   #5
unixedway
LQ Newbie
 
Registered: Mar 2009
Distribution: Suse , Mint
Posts: 14

Original Poster
Rep: Reputation: 1
Thank you for your response ,
Here is the output of the sfdisk and testdisk commands

sfdisk.log:

# partition table of /dev/sda

unit: sectors


/dev/sda1 : start= 20965376, size= 41943040, Id=83, bootable
/dev/sda2 : start= 62910464, size=125837312, Id=83
/dev/sda3 : start=188747776, size= 4096, Id=83
/dev/sda4 : start=188763750, size=788020380, Id= f
/dev/sda5 : start=964380672, size= 12390384, Id=82

#####################3

testdisk.log :

Hard disk list

Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ATA ST9500325AS
Partition table type (auto): Intel
Disk /dev/sda - 500 GB / 465 GiB - ATA ST9500325AS
Partition table type: Intel


Analyse Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63

Geometry from i386 MBR: head=255 sector=63
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=255 nbr=2

Current partition structure:

1 * Linux 1305 8 48 3915 221 18 41943040
2 P Linux 3915 253 51 11749 1 28 125837312
3 P Linux 11749 1 29 11749 66 29 4096
4 E extended LBA 11750 0 1 60801 254 63 788020380
5 L Linux Swap 60029 234 46 60801 47 30 12390384
 
Old 11-08-2012, 07:29 PM   #6
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,947
Blog Entries: 54

Rep: Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732
Maybe it's because you actually went ahead and recovered your root and home partitions (I only said "do a quick search" not "write the partition table") but your partition table looks skewed. If you don't have an extended partition (there's nothing in it) but you do have the swap partition at the end of the disk then sda3 should start at 188747776 like it does and end near the start of sda5 964380672. Changing the partition table on its own shouldn't hurt (plus I already showed you how to back it up and restore it) as long as you don't mount partitions and write to file systems. Best save the sfdisk output to USB key for easy access then boot a Live CD, preferably one that has the LUKS tools so you can see if it can read the partitions LUKS header.

Last edited by unSpawn; 11-09-2012 at 05:11 AM. Reason: /f/v/
 
Old 11-09-2012, 12:57 AM   #7
unixedway
LQ Newbie
 
Registered: Mar 2009
Distribution: Suse , Mint
Posts: 14

Original Poster
Rep: Reputation: 1
i did boot from live usb and found the 2MB luks partition when i click on it to mount it asked for the password then it accepted the password but gave me that error "Requested offset is beyond real size of device /dev/sda3"
and you are right about the file system problem i think i didnt have extended partition . do you think i can change the lucks partition size ?
 
Old 11-09-2012, 06:21 AM   #8
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,947
Blog Entries: 54

Rep: Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732Reputation: 2732
I don't know if it sunk in yet but saying LUKS partition "had all the important data" and then just going ahead modifying the partition table to restore root and home partitions contradict each other. Your previous post shows partition boundaries now don't start where they should. Testing things I forcefully re-partition a blank disk and I get this:
Code:
]# cat sfdisk.txt | sfdisk -C60801 -H255 -S63 -f /dev/sda
Checking that no-one is using this disk right now ...
OK

Disk /dev/sda: 60801 cylinders, 255 heads, 63 sectors/track
Old situation:
Units = cylinders of 8225280 bytes, blocks of 1024 bytes, counting from 0

   Device Boot Start     End   #cyls    #blocks   Id  System
/dev/sda1          0+  65269   65270- 524281243+  83  Linux
/dev/sda2          0       -       0          0    0  Empty
/dev/sda3          0       -       0          0    0  Empty
/dev/sda4          0       -       0          0    0  Empty
Warning: given size (236542) exceeds max allowable size (0)
Warning: given size (183118) exceeds max allowable size (0)
Warning: given size (4096) exceeds max allowable size (0)
Warning: given size (141848) exceeds max allowable size (45692)
Warning: given size (92314) exceeds max allowable size (31797)
New situation:
Units = cylinders of 8225280 bytes, blocks of 1024 bytes, counting from 0

   Device Boot Start     End   #cyls    #blocks   Id  System
/dev/sda1   * 112126   81318- 236542  1900023615   83  Linux
/dev/sda2      83366  266483  183118  1470895335   83  Linux
/dev/sda3     266484    3230-   4096   32901120   83  Linux
/dev/sda4      15109  156956  141848  1139394060    f  W95 Ext'd (LBA)
/dev/sda5      51569  143882   92314  741512205   82  Linux swap / Solaris
Warning: partitions 1 and 2 overlap
Successfully wrote the new partition table

Re-reading the partition table ...
and verifying with fdisk I get:
Code:
]# fdisk /dev/sda
Partition table entries are not in disk order
Warning: setting sector offset for DOS compatiblity

Expert command (m for help): v
Warning: partition 1 overlaps partition 2.
Warning: partition 1 overlaps partition 3.
Warning: partition 1 overlaps partition 5.
Warning: partition 2 overlaps partition 5.
Total allocated sectors -32248060 greater than the maximum 1048576000

Quote:
Originally Posted by unixedway View Post
do you think i can change the lucks partition size ?
So, in theory yes but practically speaking I would have resorted to Testdisk deep searching for partition boundaries first, then apply common sense to what it returns and then make a logical, informed choice (after all you don't have to apply all it suggests), you modifying the partition table made recovery way more difficult than it should have been in the first place.
 
Old 11-15-2012, 01:44 AM   #9
unixedway
LQ Newbie
 
Registered: Mar 2009
Distribution: Suse , Mint
Posts: 14

Original Poster
Rep: Reputation: 1
First i am sorry for this late reply .
Second I could finally recovered all data and here is what i did ,
i used sfdisk log file so i removed the extended partition and increased sda3 partition size to end before last partition which will be sda4 after i deleted the extended one . then i exported this log file to my hard disk layout. then with live usb i tried to mount the encrypted partition but i couldn't because the file system is broken but i could only opened the LUCK as it accepted my password then i used photorec to recover my files , it could recover everything but without any structure just files only and all file names are changed !! you can imagine around 360 GB of files this way it was a complete miss up, so i tried to use dd from my encrypted partition to another usb disk and it was big surprise when i opened the usb disk and found everything as it is with complete folder structure . ))

thanks a lot for you support
 
1 members found this post helpful.
Old 07-07-2013, 01:49 PM   #10
ehsdav
LQ Newbie
 
Registered: Jul 2013
Posts: 6

Rep: Reputation: Disabled
hi
can you help me on this please
http://www.linuxquestions.org/questi...on-4175468395/
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Recovering deleted file from a LUKS encrypted partition knowing its passhprase Karimo Linux - Security 2 05-28-2012 03:48 PM
Accidently deleted the linux partition(root partition) how to recover it? sanues Linux - Newbie 7 11-30-2009 01:55 PM
Resize ext4 partition with LUKS encryption wsduvall Linux - Software 1 03-09-2009 10:14 AM
Recover encrypted LUKS partition itinlopez Linux - General 3 11-30-2008 02:20 AM
How to recover deleted FAT 32 partition? alan_ri Linux - General 4 02-21-2008 12:06 PM


All times are GMT -5. The time now is 06:09 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration