LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 05-24-2022, 03:34 AM   #1
2022
LQ Newbie
 
Registered: May 2022
Posts: 4

Rep: Reputation: 0
Question Can you read data of LUKS drive if header is damaged?


This is a weird situation. I have two disks, which I sort-of passed to a QEMU/KVM virtual machine using the "raw" disk option.

* Disk1: 1TB, label1, LUKS + EXT4
* Disk2: 2TB, label2, Btrfs

After disk reinstallation and guest's memory state save/restoring, it seems that the guest OS mistook the two and probably overwrote Disk1's header with Disk2's. It now appears in Gnome Disks as:

* Disk1: 1TB, label2, EXT4
* Disk2: 2TB, label2, EXT4

Also, the GUID's of the two disks are the same. This is when I accessed the disk from the host, and I have rebooted the host. I tried mounting them in Gnome disks, and mounting Disk1 failed (quarks) and mounting Disk2 worked. I think it is strange that I can access the files of Disk2, when Gnome Disks says that its partition type is EXT4, because its actual partition type is Btrfs.

In this case, can I read the data of Disk1? Or should I give up? I have tried

cryptsetup luksOpen /dev/sdc1 rootvol

, but it said that it is not a valid LUKS device.

Last edited by 2022; 05-24-2022 at 04:10 AM. Reason: clarification
 
Old 05-24-2022, 04:47 AM   #2
2022
LQ Newbie
 
Registered: May 2022
Posts: 4

Original Poster
Rep: Reputation: 0
Well... I did researching whilst a reply, and found this answer in Ask Ubuntu:

"LUKS header: If the header of a LUKS volume gets damaged, all data is permanently lost unless you have a header-backup. "

Basically, it means there is hope. What I think about this is that Linux needs to learn from Windows' mistake. In the early days of NTFS file encryption, I encrypted some files without knowing that I need the hidden encryption key, not the Windows user account password to decrypt them after reinstalling Windows. So, I lost my files. Back then, Windows did not notice users of backing up the encryption key. In recent versions of Windows, if the user tries using NTFS file encryption for the first time, Windows tells the user that he needs to back up the encryption key. Since Windows has a lot more users, probably Microsoft got a lot of feedbacks from users who lost data because they did not know they had to back up the key. If Linux's disk management GUI (like Gnome Disks) notified the users about backing up the header when they create LUKS (maybe with "do not show again"), it would have prevented a lot of miseries.

Last edited by 2022; 05-24-2022 at 04:49 AM.
 
Old 05-24-2022, 05:01 AM   #3
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 21,126

Rep: Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120
The other side of that proposition is that it's your data, so your responsibility. Note my sigline - especially when "sort-of" playing around with your partitions.

There are occasions other than the initial creation that require the header to be re-backedup - likely done from the command line; I'm not sure how all the various GUI interfaces would be expected to be made aware of that.
Nice thought though.
 
Old 05-24-2022, 10:16 AM   #4
suramya
Member
 
Registered: Jan 2022
Location: Earth
Distribution: Debian
Posts: 249

Rep: Reputation: 102Reputation: 102
Quote:
Originally Posted by 2022 View Post
If Linux's disk management GUI (like Gnome Disks) notified the users about backing up the header when they create LUKS (maybe with "do not show again"), it would have prevented a lot of miseries.
I do remember seeing a warning when I was creating my LUKS encryption as it is in the man page for the program. They even talk about how it makes it a little harder to securely wipe data since you need to wipe all the header backups as well.

The fact you didn't read it, doesn't change much... As syg00 said "it's your data, so your responsibility." Especially since you were playing with partitions.
 
Old 05-25-2022, 12:11 AM   #5
2022
LQ Newbie
 
Registered: May 2022
Posts: 4

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by syg00 View Post
The other side of that proposition is that it's your data, so your responsibility.
I had created that partition using Gnome's Disk Utility, which has the encryption checkbox. Otherwise, I would not have known LUKS. Users are responsible for backing up things but my point is that novice users would not know the fact itself that they need to back up the header, and I think it is the software's responsibility to inform the user about that fact. I don't know how many GUI's are there, but as far as I know, Gnome is the most popular DE and it mostly comes with Gnome Disk Utility and most users would use that (not the command line). I don't think it would be that difficult to show some sort of dialogue box like below. Again, see what Windows is doing.

[Format Complete]
The disk has been formatted using LUKS. If the beginning of the disk (header) is damaged, the entire data will be inaccessible. Only a header backup can recover the data. Would you like to back up the disk header now?

[Yes] [No]

[ ] Don't show this again.
 
Old 05-25-2022, 12:20 AM   #6
2022
LQ Newbie
 
Registered: May 2022
Posts: 4

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by suramya View Post
I do remember seeing a warning when I was creating my LUKS encryption as it is in the man page for the program. They even talk about how it makes it a little harder to securely wipe data since you need to wipe all the header backups as well.

The fact you didn't read it, doesn't change much... As syg00 said "it's your data, so your responsibility." Especially since you were playing with partitions.
Maybe you created it using some sort of command-line utility. I used Gnome Disk Utility, as most non-expert users would, and the app had no mention about the header. All the GUI said was not to forget the password, which is useless when the header is damaged. How about not expecting most computer users to be computer enthusiasts like the programmers themselves who would spend most of their time in front of computers reading manuals and doing things in command line? What is so repulsive about the idea of making the GUI inform such critical information to novice users than expecting them to read the man page? It won't be that difficult to implement, so to me it just seems like some sort of weird puritanism.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Cannot get past GDISK- Caution: Invalid backup GPT header, but valid main header, regenerating backup header from main header. murde Linux - Newbie 2 05-30-2020 08:23 PM
[SOLVED] It's possible to recover a LUKS header with this data? Adriano_B Linux - Security 13 12-16-2017 08:36 AM
Disk Partition damaged - how can I rescue damaged partition ray98 Linux - General 7 10-24-2014 08:05 AM
YUM: Damaged header.info the_styler Fedora 6 10-25-2004 01:58 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 01:07 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration