Recovery of encrypted data drive
 

I am not able to recover a data drive (Not a boot drive) I found that the drive was no longer encrypted and empty. I do not remember formatting it but that is what it looks like. The drive had been formatted with ext4 encryption.(LUKS) Is there a way to recover the drive? I have not attempted to write any data to the drive.

Do you have a backup of the LUKS header ?. Else the prognosis is not good - from the crypsetup FAQ ...There is one user here that seems to have more expertise than most and will no doubt offer a better opinion.

Liklihood of recovery depends on how the drive was formatted and what was overwritten. If the drive had been partitioned and just the partition table was lost, then successful recovery is likely. testdisk should be able to locate the encrypted partition. It will not be able to determine the correct size for the partition (there is nothing in the LUKS header that tells the size), so you will have to use a partitioning tool to extend the size manually.

If the entire, unpartitioned drive was encrypted and the LUKS header is now missing, no recovery is possible.

One fairly quick test you can do to see if there is a LUKS header present somewhere on the drive is to run a hex editor tool like hexedit and search for the hexadecimal sequence "4C 55 4B 53 BA BE" (that's the ASCII characters "LUKS" followed by the hex bytes 0xBA and 0xBE). If that is found, then recovery might be possible. If it is not found, chances for recovery are nil. (It should be at the start of the disk or partition, so waiting several hours for the whole disk to be searched is probably pointless.)

I tried typing the above letters and numbers into the hexedit program and received a file not found message. As for a LUKS header I had not even heard of such a thing until now. I certainly did not make a backup of it. How do you make such a backup?

A good start would be to spend some time on the FAQ I mentioned - here.

Literally, "file not found"?? If so, you are doing something wrong. The message from hexedit should be just "not found" in the middle of the screen (after some time, quite a long time on a large disk, spent searching).

I wonder if we have a terminology clash here - (ex-)Windows users use the term "drive" differently to *nix users. Personally I'd just scrape the first couple of meg of the pertinent partition/drive and look for the string LUKS. Then you can mess with hex editors to confirm in need.Note the /dev/sdd1 is example only - plucked from the ether.