boot sector (dd size=512 count=1)-ed on encrypted drive

PoleStar · 06-23-2014, 01:23 PM

Hi,

I was re installing fedora on my laptop, I lost track and ended up running dd on master boot sector.

Code:

dd in=/dev/zerro of=/dev/sda size=512 count=1

I had partitions like

/home 120GB
/ 10GB
/swap 4GB
/data 300GB

I have my pictures on /data drive, disk was encrypted using fedora core encryption.

Any way to recover pictures from /data ?

Thank you.

spazticclown · 06-23-2014, 02:44 PM

Booting from a live disk (like Knoppix) you can start by trying to rebuild the partition table, use TestDisk

Code:

# testdisk /dev/sda

And scan the drive looking for an MBR, if the drive was GPT then the backup GPT should be at the end of the disk and it should be easily repaired.

If testdisk finds the partition table you can write it back to the drive, rescan for partitions

Code:

# partprobe -s

and use the older version of Gnome-Disk-Utility (I think it is called palimpsest?) to view/mount the encrypted volume

Code:

# palimpsest

Hope you can recover your files.

jefro · 06-23-2014, 03:00 PM

Might have to recover the partition. Then access the encryption method.

Some clues may be in this link. http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

PoleStar · 06-24-2014, 04:04 PM

Thanks for the help guys.

I don't think knoppix 7 has palimpsest.

So far thats how things look.

Code:

TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63
     Partition               Start        End    Size in sectors
>* Linux                    0  32 33    63 221 30    1024000
 P Linux                   63 221 31 12812  20  8  204800000
 P Linux                12812  20  9 19147 239 36  101785600
 L Linux Swap           19148  17  6 19657 253 52    8192000
 L Linux                19658  31 22 19658  96 22       4096

Code:

TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Please wait...
Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63
Sector size:512
Model: HITACHI HTS725050A9A364, S/N:110211PCK404GLGSURGJ, FW:PC4ZC70F

Disk /dev/mapper/TEST - 28 KB / 28 KiB - 56 sectors
Sector size:512


Disk /dev/sr0 - 734 MB / 700 MiB - 358858 sectors (RO)
Sector size:2048
Model: HL-DT-ST DVDRAM GSA-U10N, S/N:M0083HE4704, FW:1.05

Disk /dev/dm-0 - 28 KB / 28 KiB - 56 sectors
Sector size:512


Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63
     Partition			Start        End    Size in sectors
 1 * Linux                    0  32 33    63 221 30    1024000
     ext4 blocksize=1024 Sparse superblock
 2 P Linux                   63 221 31 12812  20  8  204800000
     ext4 blocksize=4096 Large file Sparse superblock Recover
 3 P Linux                12812  20  9 19147 239 36  101785600
     ext4 blocksize=4096 Large file Sparse superblock
 4 E extended LBA         19147 239 37 60801  80 15  669161472
 5 L Linux Swap           19148  17  6 19657 253 52    8192000
     SWAP2 version 1, pagesize=4096
   X extended             19658  30  1 19658  96 22       4180
 6 L Linux                19658  31 22 19658  96 22       4096
     LUKS 1

Disk /dev/mapper/TEST - 28 KB / 28 KiB - 56 sectors
     Partition			Start        End    Size in sectors
   P ext4                           0         55         56
     ext4 blocksize=4096 Large file Sparse superblock

Disk /dev/sr0 - 734 MB / 700 MiB - 358858 sectors (RO)
     Partition			Start        End    Size in sectors
   P ISO                            0     358857     358858 [KNOPPIX]
     ISO9660 blocksize=2048

Disk /dev/dm-0 - 28 KB / 28 KiB - 56 sectors
     Partition			Start        End    Size in sectors
   P ext4                           0         55         56
     ext4 blocksize=4096 Large file Sparse superblock

root@Microknoppix:~#

Code:

root@Microknoppix:~# partprobe -s
/dev/sdc: msdos partitions 1 2 3 4 <5 6>
Warning: Unable to open /dev/sr0 read-write (Read-only file system).  /dev/sr0 has been opened read-only.
Warning: Unable to open /dev/cloop0 read-write (Read-only file system).  /dev/cloop0 has been opened read-only.
root@Microknoppix:~#

Code:

root@Microknoppix:~# whereis palimpsest
palimpsest:
root@Microknoppix:~#

PasBern · 06-25-2014, 04:00 AM

Quote:

Originally Posted by PoleStar

Thanks for the help guys.

I don't think knoppix 7 has palimpsest.

I'm not sure about that, but there is good chance that palimpsest is in Knoppix/Debain-repositories.

Try:

Code:

# apt-cache search palimpsest

In case your are lucky, you could then install it via:

Code:

# apt-get install palimpsest ##### using the EXACT PACKAGE NAME or
# aptitude install palimpsest

You probably already know the commands, so please don't feel offended, in case I put info here you are familiar with.

spazticclown · 06-26-2014, 11:02 AM

Once you have written the partition table back to the disk, you can also access the Gnome Disk Utility from LXDE menu -> Accessories -> Disk Utility

Then select the partition and there should be a mount option, this should mount on a /media/*** location for access via terminal or graphical utility.

You can also try pali[tab] for auto-completion, the spelling of some of these programs drives me up the wall and I am a slave to auto-complete.

It does look like you have the partition table back on /dev/sdc which is the first major step, congrats!