LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware
User Name
Password
Slackware This Forum is for the discussion of Slackware Linux.

Notices

Reply
 
LinkBack Search this Thread
Old 01-15-2013, 03:05 AM   #16
Phorize
Member
 
Registered: Sep 2005
Location: UK
Distribution: Slackware
Posts: 216

Original Poster
Rep: Reputation: 22

This is going to come across as a very strange question, but what happens if I use the cfdisk on the slackware dvd to rewrite the partition table precisely as I did before?
 
Old 01-15-2013, 06:12 AM   #17
TobiSGD
Moderator
 
Registered: Dec 2009
Location: Hanover, Germany
Distribution: Gentoo, Slackware
Posts: 14,896
Blog Entries: 2

Rep: Reputation: 3810Reputation: 3810Reputation: 3810Reputation: 3810Reputation: 3810Reputation: 3810Reputation: 3810Reputation: 3810Reputation: 3810Reputation: 3810Reputation: 3810
This looks like a valid bootrecord. Have you tried just mounting your partitions? What is the output of
Code:
fdisk -l
 
1 members found this post helpful.
Old 01-15-2013, 06:30 AM   #18
Phorize
Member
 
Registered: Sep 2005
Location: UK
Distribution: Slackware
Posts: 216

Original Poster
Rep: Reputation: 22
Quote:
Originally Posted by TobiSGD View Post
This looks like a valid bootrecord. Have you tried just mounting your partitions? What is the output of
Code:
fdisk -l
Code:
fdisk -l
Gives
Code:
Disk /dev/sda: 500.1 GB, 500107862016 bytes
255 heads, 63 sectors/track, 60801 cylinders, total 976773168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System
 
Old 01-15-2013, 07:47 AM   #19
GazL
Senior Member
 
Registered: May 2008
Posts: 3,231

Rep: Reputation: 828Reputation: 828Reputation: 828Reputation: 828Reputation: 828Reputation: 828Reputation: 828
Do a
Code:
dd if=/dev/sda | hexdump -C | grep 'LUKS'
(you can probably cancel this fairly early on as it should be within the first couple of hundred mb if what you say about your layout is accurate)

If you don't see a line starting with the characters "LUKS" then your luks header is gone and whatever else has happened to the drive really doesn't matter.
 
1 members found this post helpful.
Old 01-15-2013, 07:52 AM   #20
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,539
Blog Entries: 51

Rep: Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604
Quote:
Originally Posted by kristizz View Post
testdisk doesn't find anything.
Please run testdisk again as
Code:
testdisk /debug /log /dev/sda
have it do a search and attach resultant "testdisk.log" as plain text file?
 
Old 01-15-2013, 07:58 AM   #21
GazL
Senior Member
 
Registered: May 2008
Posts: 3,231

Rep: Reputation: 828Reputation: 828Reputation: 828Reputation: 828Reputation: 828Reputation: 828Reputation: 828
unSpawn, Does testdisk detect luks headers? I didn't see any mention of it on its website?
 
Old 01-15-2013, 08:08 AM   #22
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,539
Blog Entries: 51

Rep: Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604
AFAIK no. The only reason why I would want the PT restored is to have a boundary for running 'isLuks'. One could look for
Code:
#define LUKS_MAGIC {'L','U','K','S', 0xba, 0xbe};
(http://code.google.com/p/cryptsetup/wiki/Specification -> http://code.google.com/p/cryptsetup/...9584a05f81f#51). Also see http://code.google.com/p/cryptsetup/...AskedQuestions.
 
Old 01-15-2013, 08:52 AM   #23
Phorize
Member
 
Registered: Sep 2005
Location: UK
Distribution: Slackware
Posts: 216

Original Poster
Rep: Reputation: 22
Quote:
Originally Posted by GazL View Post
Do a
Code:
dd if=/dev/sda | hexdump -C | grep 'LUKS'
(you can probably cancel this fairly early on as it should be within the first couple of hundred mb if what you say about your layout is accurate)

If you don't see a line starting with the characters "LUKS" then your luks header is gone and whatever else has happened to the drive really doesn't matter.
Code:
dd if=/dev/sda | hexdump -C | grep 'LUKS'
gives

Code:
1de41bb20  b7 01 4c 55 4b 53 af 44  31 72 fa 19 f6 54 d4 6b  |..LUKS.D1r...T.k|
 
Old 01-15-2013, 09:09 AM   #24
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 1,171

Rep: Reputation: 511Reputation: 511Reputation: 511Reputation: 511Reputation: 511Reputation: 511
You have obviously not re-zeroed the MBR since you still show data beginning at address 0. Easiest thing to do is just skip over the first megabyte and see how much of the rest of the drive got zeroed:
Code:
dd if=/dev/sda bs=1M skip=1 | hexdump | head
You'll then need to add 1 megabyte (0x100000) to the address of that first non-zero line to see where your remaining data begins.
 
1 members found this post helpful.
Old 01-15-2013, 09:31 AM   #25
Phorize
Member
 
Registered: Sep 2005
Location: UK
Distribution: Slackware
Posts: 216

Original Poster
Rep: Reputation: 22
[QUOTE=kristizz;4870578]
Code:
dd if=/dev/sda | hexdump -C | grep 'LUKS'
contnued running and gives:

Code:
1de41bb20  b7 01 4c 55 4b 53 af 44  31 72 fa 19 f6 54 d4 6b  |..LUKS.D1r...T.k|
26d09d8d0  ed 5d 63 45 1f 7f b6 61  8e a2 4c 55 4b 53 49 64  |.]cE...a..LUKSId|
364edab20  7e 17 8e b3 fd 34 ae af  4c 55 4b 53 07 91 0b 54  |~....4..LUKS...T|
 
Old 01-15-2013, 09:31 AM   #26
GazL
Senior Member
 
Registered: May 2008
Posts: 3,231

Rep: Reputation: 828Reputation: 828Reputation: 828Reputation: 828Reputation: 828Reputation: 828Reputation: 828
Quote:
Originally Posted by kristizz View Post
Code:
dd if=/dev/sda | hexdump -C | grep 'LUKS'
gives

Code:
1de41bb20  b7 01 4c 55 4b 53 af 44  31 72 fa 19 f6 54 d4 6b  |..LUKS.D1r...T.k|
Hmm...I don't think that's it. It's about 8GB into your disk, 290 characters into a sector and It's not followed by the 0xba, 0xbe one would expect to see..
 
1 members found this post helpful.
Old 01-15-2013, 09:57 AM   #27
Phorize
Member
 
Registered: Sep 2005
Location: UK
Distribution: Slackware
Posts: 216

Original Poster
Rep: Reputation: 22
Quote:
Originally Posted by rknichols View Post
You have obviously not re-zeroed the MBR since you still show data beginning at address 0. Easiest thing to do is just skip over the first megabyte and see how much of the rest of the drive got zeroed:
Code:
dd if=/dev/sda bs=1M skip=1 | hexdump | head
You'll then need to add 1 megabyte (0x100000) to the address of that first non-zero line to see where your remaining data begins.
Code:
dd if=/dev/sda bs=1M skip=1 | hexdump | head
gives:

Code:
0000000 0000 0000 0000 0000 0000 0000 0000 0000
*
61e5000 4387 4e9c 5bab 1ec4 25b8 1ac7 4bb2 30a1
61e5010 726b 0969 c203 6937 9c9c 1010 4a06 e133
61e5020 2719 6dfc 2bfb 7874 24aa e053 a94b c68d
61e5030 a90d 2ce5 1572 7fd4 6cf8 3c61 de51 de71
61e5040 7de8 dca1 2bd0 072b f06e f9e0 c53a 5cc0
61e5050 e61f e091 b17b 5aa5 221f 3095 8af9 e83a
61e5060 922d d813 9a40 d4a0 dae6 39a9 d8ec 67da
61e5070 4f72 0e77 3b9f 9714 8f73 d701 1eef 830f
 
Old 05-13-2013, 01:42 AM   #28
Phorize
Member
 
Registered: Sep 2005
Location: UK
Distribution: Slackware
Posts: 216

Original Poster
Rep: Reputation: 22
Smile

I just wanted to say a big thank you to those of you who helped out on this. I wasn't able to locate the partition in the end and ran out of time due to the arrival of my baby daughter. Fortunately I was able to use testdisk to recover the files from my wife's external hard drive; she had forgotten that they had been backed up on there a while ago and then deleted, but it looks like they were never overwritten.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
New HDD install w/data recovery from old HDD w/different distro w/encrypted /home forbinproject Linux - Laptop and Netbook 1 02-27-2012 10:18 PM
[SOLVED] Want to recover data from Encrypted partition (created by EXT3 Ubuntu 10.04) shikhar623 Linux - Newbie 34 10-21-2010 07:40 PM
ext3 Data Recovery, Old Partition anonymous_noob_01 Linux - Hardware 1 02-07-2008 07:30 PM
data recovery of ext3 partition awalp Linux - Software 14 09-04-2007 05:07 PM
partition data recovery rlg Linux - Newbie 5 04-22-2005 12:27 AM


All times are GMT -5. The time now is 10:21 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration