LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 08-21-2020, 09:13 PM   #1
skippy36g
LQ Newbie
 
Registered: Aug 2020
Location: U.S.A. Marion, Ohio
Posts: 2

Rep: Reputation: Disabled
Angry Recovery of encrypted data drive


I am not able to recover a data drive (Not a boot drive) I found that the drive was no longer encrypted and empty. I do not remember formatting it but that is what it looks like. The drive had been formatted with ext4 encryption.(LUKS) Is there a way to recover the drive? I have not attempted to write any data to the drive.
 
Old 08-21-2020, 11:49 PM   #2
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 21,142

Rep: Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123
Do you have a backup of the LUKS header ?. Else the prognosis is not good - from the crypsetup FAQ ...
Quote:
For example, if you create a new filesystem on a non-mapped LUKS container, chances are good that all data is lost permanently.
There is one user here that seems to have more expertise than most and will no doubt offer a better opinion.
 
Old 08-22-2020, 09:01 AM   #3
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: Rocky Linux
Posts: 4,783

Rep: Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214
Liklihood of recovery depends on how the drive was formatted and what was overwritten. If the drive had been partitioned and just the partition table was lost, then successful recovery is likely. testdisk should be able to locate the encrypted partition. It will not be able to determine the correct size for the partition (there is nothing in the LUKS header that tells the size), so you will have to use a partitioning tool to extend the size manually.

If the entire, unpartitioned drive was encrypted and the LUKS header is now missing, no recovery is possible.

One fairly quick test you can do to see if there is a LUKS header present somewhere on the drive is to run a hex editor tool like hexedit and search for the hexadecimal sequence "4C 55 4B 53 BA BE" (that's the ASCII characters "LUKS" followed by the hex bytes 0xBA and 0xBE). If that is found, then recovery might be possible. If it is not found, chances for recovery are nil. (It should be at the start of the disk or partition, so waiting several hours for the whole disk to be searched is probably pointless.)
 
Old 08-22-2020, 12:06 PM   #4
skippy36g
LQ Newbie
 
Registered: Aug 2020
Location: U.S.A. Marion, Ohio
Posts: 2

Original Poster
Rep: Reputation: Disabled
I tried typing the above letters and numbers into the hexedit program and received a file not found message. As for a LUKS header I had not even heard of such a thing until now. I certainly did not make a backup of it. How do you make such a backup?
 
Old 08-22-2020, 09:24 PM   #5
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 21,142

Rep: Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123
A good start would be to spend some time on the FAQ I mentioned - here.
 
Old 08-22-2020, 10:46 PM   #6
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: Rocky Linux
Posts: 4,783

Rep: Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214
Quote:
Originally Posted by skippy36g View Post
I tried typing the above letters and numbers into the hexedit program and received a file not found message.
Literally, "file not found"?? If so, you are doing something wrong. The message from hexedit should be just "not found" in the middle of the screen (after some time, quite a long time on a large disk, spent searching).
 
Old 08-23-2020, 04:06 AM   #7
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 21,142

Rep: Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123
I wonder if we have a terminology clash here - (ex-)Windows users use the term "drive" differently to *nix users. Personally I'd just scrape the first couple of meg of the pertinent partition/drive and look for the string LUKS. Then you can mess with hex editors to confirm in need.
Code:
dd if=/dev/sdd1 bs=2M count=1 | strings | grep LUKS
Note the /dev/sdd1 is example only - plucked from the ether.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Recovery of data from encrypted partition Phorize Slackware 27 05-13-2013 01:42 AM
Resizable encrypted LVM requiring just one password on boot (encrypted volume group)? Nyyr Linux - Software 9 01-24-2013 05:52 AM
New HDD install w/data recovery from old HDD w/different distro w/encrypted /home forbinproject Linux - Laptop and Netbook 1 02-27-2012 10:18 PM
[SOLVED] Combining anti-virus + data recovery + image recovery? littlebigman Linux - Software 8 08-12-2010 02:39 AM
LXer: Linux Data Recovery on Windows - Is possible through Disk Doctors Linux Recovery Software LXer Syndicated Linux News 0 10-22-2006 12:21 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 09:22 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration