LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices

Reply
 
LinkBack Search this Thread
Old 11-27-2008, 03:56 PM   #1
pianeta_rosso
LQ Newbie
 
Registered: Nov 2008
Posts: 4

Rep: Reputation: 0
Ubuntu overwrite mbr of a XFS-Dmcrypted-Raid 1 disks. How recover data?


Hi to all, my name is Marco.
Some time ago I set up an encrypted system with two 320 Gb disks on raid 1.
I created the raid 1 system with mdadm, I encrypted the hole new device with dmcryp and in this I built an XFS partition using all 320 Gb.
I used this encrypted disk to backup my personal data and other things. Software and system was on another hd, where it was installed Slackware. Unfortunately, I had problems with the Slackware, so I decided to remove this and install the last version of Ubuntu, just to try, on the partition where was the Slackware (I used the manual partition, I haven't touch the other disks). After installation I removed Ubuntu (I didn't like it), and I used Slax to access to my crypted disks, and than, after have assembled the raid 1 and create the mapper, I found out that I can't mount the xfs system.
I tried with fdisk and it can't find any partition, I have done a scan with testdisk on SystemRescueCd but it can't find anything.
After a lot of tests I find out that if I try to boot the pc with the 320 Gb disks, on the screen came out a Grub error. So I think that Grub have overwrite the mbr of the 320Gb disks, but I used all the disks as an encrypted device, so Grub must have overwritten encrypted data.
I would recover the data on the disks, can anyone help me???
Thank you for your time.
 
Old 11-28-2008, 12:42 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,521
Blog Entries: 51

Rep: Reputation: 2600Reputation: 2600Reputation: 2600Reputation: 2600Reputation: 2600Reputation: 2600Reputation: 2600Reputation: 2600Reputation: 2600Reputation: 2600Reputation: 2600
I think that unless you tell it otherwise LUKS writes its header to the start of the device by default. So if you assemble your RAID-1 then if 'cryptsetup luksDump' does not return info then I think your LUKS header might be gone. Making backups of that metadata is discouraged in the HOWTO, but if you would have it could have saved you in this instance, if that's what's missing. Of course there's a chance I'm horribly wrong but I think there'll no way to recover that data. Else LUKS encryption wouldn't be any good...
 
Old 11-28-2008, 04:01 PM   #3
pianeta_rosso
LQ Newbie
 
Registered: Nov 2008
Posts: 4

Original Poster
Rep: Reputation: 0
I didn't used luks, lukly, but only dm-crypt in the most simple way, so dmcrypt stored his data to the end of the disk (I think). Today I tried to see the hex of the decripted disk from sector 63, and I found out the names of the files that was on the disks.
Now I will try to copy the decrypted disk from sector 63 ( to remove the overwritted data) to another disk, and I will try to recover data.
Somebody know if is it possible recover data from xfs??? I read on their site, and it's seems to be impossible... Tomorrow I will try Helix on the disks.
 
Old 11-29-2008, 03:50 PM   #4
pianeta_rosso
LQ Newbie
 
Registered: Nov 2008
Posts: 4

Original Poster
Rep: Reputation: 0
RESOLVED!!!!!!!!!!

The solution was so stupid that I haven't tried for first...
I used only 1 of the 2 hd (in case of problems I would use the other...), I used dm-crypt, insert the passw, open the console, run xfs_repair... and mount... I recovered all the data!!!!! I'm Happy!!!!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How to recover overwrite 35 GB data Bharat Kumar pankaj Solaris / OpenSolaris 6 08-24-2008 11:20 AM
Newby that needs to recover data from failed NAS drive (xfs formatted) MargJT Linux - Newbie 6 02-24-2008 02:13 AM
Raid 5 XFS FC2 recover disk failure mattma Linux - Hardware 1 11-11-2006 06:12 PM
XFS + Raid and how to test SATA disks Krugger Linux - Software 0 05-10-2006 04:55 PM
Software RAID to recover data from HW RAID ocschwar Linux - Hardware 5 02-25-2005 10:05 PM


All times are GMT -5. The time now is 08:00 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration