[SOLVED] Recovering formatted LUKS EXT4 partition

malougk · 03-23-2015, 10:37 PM

Hello

I accidentally formatted my entire encrypted Ext4 Hard Drive Disk into FAT32.

I have not mounted it or written anything on it since then, but I have tried to use Testdisk, and the only thing I have been able (by following the suggestion of the programm) is to show a 2.1MB (which is way too small to be my original partition) encrypted partition. I then followed that thread : http://forum.cgsecurity.org/phpBB3/r...ize-t2629.html (ie reformatting my drive using fdisk -c=dos -u=cylinders /dev/sda)

And I am now stuck, still enable to acess my datas.

Here is what I have been able to obain before all those operations :

Code:

Disk /dev/sda: 29185 cylinders, 255 heads, 63 sectors/track
Units = sectors of 512 bytes, counting from 0

   Device Boot    Start       End   #sectors  Id  System
/dev/sda1          2048 468860927  468858880   b  W95 FAT32
/dev/sda2             0         -          0   0  Empty
/dev/sda3             0         -          0   0  Empty
/dev/sda4             0         -          0   0  Empty

Disk /dev/sdb: 1021 cylinders, 239 heads, 62 sectors/track
Warning: The partition table looks like it was made
  for C/H/S=*/32/63 (instead of 1021/239/62).
For this listing I'll assume that geometry.
Units = sectors of 512 bytes, counting from 0

and

Code:

ubuntu@ubuntu:~$ udisks --show-info /dev/sda
Showing information for /org/freedesktop/UDisks/devices/sda
  native-path:                 /sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/sda
  device:                      8:0
  device-file:                 /dev/sda
    presentation:              /dev/sda
    by-id:                     /dev/disk/by-id/ata-KINGSTON_SV300S37A240G_50026B7242045BE7
    by-id:                     /dev/disk/by-id/wwn-0x50026b7242045be7
  detected at:                 Mon 23 Mar 2015 06:16:32 PM UTC
  system internal:             1
  removable:                   0
  has media:                   1 (detected at Mon 23 Mar 2015 06:16:32 PM UTC)
    detects change:            0
    detection by polling:      0
    detection inhibitable:     0
    detection inhibited:       0
  is read only:                0
  is mounted:                  0
  mount paths:             
  mounted by uid:              0
  presentation hide:           0
  presentation nopolicy:       0
  presentation name:           
  presentation icon:           
  automount hint:              
  size:                        240057409536
  block size:                  512
  job underway:                no
  usage:                       
  type:                        
  version:                     
  uuid:                        
  label:                       
  partition table:
    scheme:                    mbr
    count:                     1
  drive:
    vendor:                    ATA
    model:                     KINGSTON SV300S37A240G
    revision:                  520ABBF0
    serial:                    50026B7242045BE7
    WWN:                       50026b7242045be7
    detachable:                0
    can spindown:              1
    rotational media:          No
    write-cache:               enabled
    ejectable:                 0
    adapter:                   Unknown
    ports:
    similar devices:
    media:                     
      compat:                 
    interface:                 ata
    if speed:                  (unknown)
    ATA SMART:                 Data not collected

and here is what I currently have

Code:

sudo fdisk -l /dev/sda

Disk /dev/sda: 240.1 GB, 240057409536 bytes
255 heads, 63 sectors/track, 29185 cylinders, total 468862128 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x000456ec

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *        2046      499709      248832   83  Linux
/dev/sda2          501760      505855        2048   83  Linux

Code:

ubuntu@ubuntu:~$ sudo sfdisk -d /dev/sda
# partition table of /dev/sda
unit: sectors

/dev/sda1 : start=     2046, size=   497664, Id=83, bootable
/dev/sda2 : start=   501760, size=     4096, Id=83
/dev/sda3 : start=        0, size=        0, Id= 0
/dev/sda4 : start=        0, size=        0, Id= 0

Code:

Tue Mar 24 03:23:42 2015
Command line: TestDisk /log

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.13.0-32-generic (#57-Ubuntu SMP Tue Jul 15 03:51:08 UTC 2014) x86_64
Compiler: GCC 4.8
Compilation date: 2013-10-29T01:29:29
ext2fs lib: 1.42.9, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48 support
/dev/sda: size       468862128 sectors
/dev/sda: user_max   468862128 sectors
/dev/sda: native_max 468862128 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - KINGSTON SV300S37A240G, S/N:50026B7242045BE7, FW:520ABBF0
Disk /dev/sdb - 7747 MB / 7388 MiB - CHS 1021 239 62, sector size=512 - Kingston DataTraveler 2.0, FW:1.00

Partition table type (auto): Intel
Disk /dev/sda - 240 GB / 223 GiB - KINGSTON SV300S37A240G
Partition table type: Intel

Analyse Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63
Geometry from i386 MBR: head=125 sector=57
check_part_i386 failed for partition type 83
Current partition structure:
No ext2, JFS, Reiser, cramfs or XFS marker
 1 * Linux                    0  32 31    31  26 57     497664
 1 * Linux                    0  32 31    31  26 57     497664
 2 P Linux                   31  59 29    31 124 29       4096

search_part()
Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63
recover_EXT2: "e2fsck -b 8193 -B 1024 device" may be needed
     Linux                    0  32 31    31  26 57     497664
     ext2 blocksize=1024 Sparse superblock Backup superblock, 254 MB / 243 MiB
     Linux                   31  59 29    31 124 29       4096
     LUKS 1 (Data size unknown), 2097 KB / 2048 KiB
BAD_RS LBA=382489306 7760861
check_part_i386 failed for partition type 06
     FAT16 >32M           23808 218 53 136407 244 31 1808904552
This partition ends after the disk limits.
Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (240 GB / 223 GiB) seems too small! (< 1121 GB / 1044 GiB)
The following partition can't be recovered:
     FAT16 >32M           23808 218 53 136407 244 31 1808904552

interface_write()
 1 * Linux                    0  32 31    31  26 57     497664
 2 P Linux                   31  59 29    31 124 29       4096

search_part()
Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63
recover_EXT2: "e2fsck -b 8193 -B 1024 device" may be needed
     Linux                    0  32 31    31  26 57     497664
     ext2 blocksize=1024 Sparse superblock Backup superblock, 254 MB / 243 MiB
recover_EXT2: "e2fsck -b 24577 -B 1024 device" may be needed
     Linux                    0  32 31    31  26 57     497664
     ext2 blocksize=1024 Sparse superblock Backup superblock, 254 MB / 243 MiB
recover_EXT2: "e2fsck -b 40961 -B 1024 device" may be needed
     Linux                    0  32 31    31  26 57     497664
     ext2 blocksize=1024 Sparse superblock Backup superblock, 254 MB / 243 MiB
recover_EXT2: "e2fsck -b 57345 -B 1024 device" may be needed
     Linux                    0  32 31    31  26 57     497664
     ext2 blocksize=1024 Sparse superblock Backup superblock, 254 MB / 243 MiB
recover_EXT2: "e2fsck -b 73729 -B 1024 device" may be needed
     Linux                    0  32 31    31  26 57     497664
     ext2 blocksize=1024 Sparse superblock Backup superblock, 254 MB / 243 MiB
recover_EXT2: "e2fsck -b 204801 -B 1024 device" may be needed
     Linux                    0  32 31    31  26 57     497664
     ext2 blocksize=1024 Sparse superblock Backup superblock, 254 MB / 243 MiB
recover_EXT2: "e2fsck -b 221185 -B 1024 device" may be needed
     Linux                    0  32 31    31  26 57     497664
     ext2 blocksize=1024 Sparse superblock Backup superblock, 254 MB / 243 MiB
     Linux                   31  59 29    31 124 29       4096
     LUKS 1 (Data size unknown), 2097 KB / 2048 KiB
BAD_RS LBA=382489306 7760861
check_part_i386 failed for partition type 06
     FAT16 >32M           23808 218 53 136407 244 31 1808904552
This partition ends after the disk limits.
Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (240 GB / 223 GiB) seems too small! (< 1121 GB / 1044 GiB)
The following partition can't be recovered:
     FAT16 >32M           23808 218 53 136407 244 31 1808904552

interface_write()
 1 * Linux                    0  32 31    31  26 57     497664
 2 P Linux                   31  59 29    31 124 29       4096

I don't rally know what to do, and I would really like to get my data back.
I hope somebody will be able to help me

Thanks

veerain · 03-24-2015, 12:02 AM

Which encryption are you using? Have you tried doing fsck on encrypted partition?

First make a image of the corrupted hard drive to a backup medium.

From testdisk output it appears that your MBR has got corrupted. It recognizing some LUKS 1 header also.

syg00 · 03-24-2015, 12:12 AM

The format command should only over-write (some of) the start of the partition. If it over-wrote the LUKS header and you have no backup, your data is lost. That's why you encrypted it remember.

There are others here better versed in LUKS than me, but if it were me, I'd simply make one big partition over the entire drive - doesn't matter if it's bigger than the crypt container. Make sure it starts on sector 2048.
Then use crypsetup display commands to see if it recognises it. If it does you should be able to open then mount it. If not, bad luck.

rknichols · 03-24-2015, 10:05 AM

Quote:

Originally Posted by malougk

but I have tried to use Testdisk, and the only thing I have been able (by following the suggestion of the programm) is to show a 2.1MB (which is way too small to be my original partition) encrypted partition.

That is actually very good. The LUKS header does not have any information about the size of the container, so testdisk will always report the minimum possible size (just the size of the LUKS header and key material) with the notation, "Data size unknown." Let testdisk create a partition starting at that header and extend it to the end of the disk. You should be able to unlock that and find your data all there.

malougk · 03-24-2015, 11:18 AM

Thank you all for your help.
I finally got my data back.

To Veerain : I was using cryptsetup, and I could not use fsck on the encrypted drive, it just would not work.

To syg000 and rkichols : I did some version of what you sugested.
After letting testdisk create the partition, I extended my sda2 partition (the one with the encrypted file) from sector 501760 (the original beginning) to the end of the disk, using fdisk. I after rebooting, I was able to acess my partition.
Thank you again