LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 09-16-2009, 05:55 AM   #1
carlitoco
Member
 
Registered: Jan 2008
Location: Berlin
Distribution: Slackware / Arch
Posts: 142

Rep: Reputation: 15
data recovery from dm-crypted partition


Hello,

I've a dm-crypted disk with one partition. One day fdisk -l give me a strange output obout these, something like 4 partitions and wired types etc. In a moment of shaddowing mind i've make a testdisk run on the crypted /dev/sdc1, ! I dont decrypted it before!

After my mind is awakend again I've tried to open the device (cryptsetup luksOpen), it works. But I can not mount the /dev/mapper/mydev.

It gives me:
mount: wrong fs type, bad option, bad superblock on /dev/mapper/speicherluks,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg | tail or so

Did you have any idea how I can restore the old structure?

here the testdisk log
Code:
Sat Sep 12 13:13:08 2009
Command line: TestDisk

TestDisk 6.10, Data Recovery Utility, July 2008
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.28-11-generic (#42-Ubuntu SMP Fri Apr 17 01:58:03 UTC 2009)
Compiler: GCC 4.3 - Nov  8 2008 03:50:20
ext2fs lib: 1.41.4, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
Warning: can't get size for /dev/mapper/control
Hard disk list
...
Disk /dev/sdc - 400 GB / 372 GiB - CHS 48641 255 63, sector size=512 - ATA ST3400833AS
...

Partition table type (auto): None
Disk /dev/sdc - 400 GB / 372 GiB - ATA ST3400833AS
Partition table type: Intel

Analyse Disk /dev/sdc - 400 GB / 372 GiB - CHS 48641 255 63
Geometry from i386 MBR: head=116 sector=52
BAD_RS LBA=1768778098 4634016
check_part_i386 1 type 6B: no test
BAD_RS LBA=1830843506 5735848
check_part_i386 2 type 75: no test
BAD_RS LBA=1718906437 4810655
check_part_i386 3 type 41: no test
Current partition structure:
 1 * Sys=6B               110101  87 53 110576  97  8    7631461

Bad relative sector.
 2 * PC/IX                113964 188  3 200776 205 32 1394635881

Bad relative sector.
 3 * PPC PReP Boot        106996 249 11 106997  34 63       2573

Bad relative sector.
Only one partition must be bootable
Ask the user for vista mode
Allow partial last cylinder : No
search_vista_part: 0

search_part()
Disk /dev/sdc - 400 GB / 372 GiB - CHS 48641 255 63

   D Linux                    0   1  1     0  33 40       2056
     LUKS 1 (Data size unknown), 1052 KB / 1028 KiB
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
 
Old 10-17-2009, 04:57 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
//NTLB: Was this problem superseded slash alleviated by http://www.linuxquestions.org/questi...m-hdds-756782/ ?
 
Old 10-18-2009, 02:06 AM   #3
carlitoco
Member
 
Registered: Jan 2008
Location: Berlin
Distribution: Slackware / Arch
Posts: 142

Original Poster
Rep: Reputation: 15
no its totaly a deifferent thing!
 
Old 10-18-2009, 04:53 AM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
Quote:
Originally Posted by carlitoco View Post
no its totaly a deifferent thing!
OK. On a different machine?


Quote:
Originally Posted by carlitoco View Post
i've make a testdisk run on the crypted /dev/sdc1, ! I dont decrypted it before!
You mean you ran 'testdisk' and allowed it to "correct" (perceived) errors?


Quote:
Originally Posted by carlitoco View Post
TestDisk 6.10, Data Recovery Utility, July 2008
That's an old version. In this case newer == bug fixes, more features == better.
* BTW it would be more efficient/better to post/attach the unobfuscated "testdisk.log" from running 'testdisk /debug /log /dev/sdc'.


Quote:
Originally Posted by carlitoco View Post
Code:
Partition table type (auto): None
Partition table type: Intel
I don't know if it's a telltale sign but detection did not automagically see the disk as having a Intel partition table.
* Please post output from running 'fdisk -l /dev/sdc'.


Quote:
Originally Posted by carlitoco View Post
Code:
Geometry from i386 MBR: head=116 sector=52
Maybe somebody else could comment if CHS/LBA translation looks OK.


Quote:
Originally Posted by carlitoco View Post
Code:
check_part_i386 1 type 6B: no test
check_part_i386 2 type 75: no test
check_part_i386 3 type 41: no test
AFAIK the PT (partition table) should list one partition (or one used and 3 empty as per default DOS PT?), so to me this looks like partition table corruption or guesswork filling it in.



Quote:
Originally Posted by carlitoco View Post
Code:
search_part()
Disk /dev/sdc - 400 GB / 372 GiB - CHS 48641 255 63

   D Linux                    0   1  1     0  33 40       2056
     LUKS 1 (Data size unknown), 1052 KB / 1028 KiB
OK, so at least it found *something*... What I'd do is confirm 'testdisk' is using the right disk geometry as advertised by your BIOS and verify that with 'dmesg' output when booting from Live CD or from previosuly saved 'sfdisk -' or 'fdisk -' output. Then I'd make a 'dd' backup of the whole disk before mucking around. Better safe than sorry. Then, if you have a backup of your MBR/PT, restore that. If you don't have a backup you could let 'testdisk' (or 'fdisk') write a pristine MBR and PT (that's why you make backups). This should not affect the encrypted volume (as it starts after PT+some bytes) so this should also not affect the LUKS phdr and keys as they reside inside the partition (the phdr being written before the payload but is there a backup phdr written by default? Hopefully somebody could chip in details). Anyway, first things first: best post full output as requested.
 
Old 10-19-2009, 06:57 AM   #5
carlitoco
Member
 
Registered: Jan 2008
Location: Berlin
Distribution: Slackware / Arch
Posts: 142

Original Poster
Rep: Reputation: 15
Ok I think I missunderstood you.

These theme is finished because I stoped to try to recover my data.
I have a backup of my important documents.
thanks carlitoco
 
Old 10-19-2009, 07:15 AM   #6
carlitoco
Member
 
Registered: Jan 2008
Location: Berlin
Distribution: Slackware / Arch
Posts: 142

Original Poster
Rep: Reputation: 15
But I have test it again.
If you delete your partition table of a dm-crypted hdd with one big partition.

You can build a new (restore) these partion table with fdisk.
After the table is restored you can open the partition usualy with cryptestup luksOpen /dev/sdx slackcrypt.

Because the data is not deleted if the partition table is deleted and these dm-crypt key informations seems to be on a different place of the hdd.

I dont know how good it works with lvms inside the dm-crypted partition.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
ext3 Data Recovery, Old Partition anonymous_noob_01 Linux - Hardware 1 02-07-2008 07:30 PM
data recovery of ext3 partition awalp Linux - Software 14 09-04-2007 05:07 PM
Recovery of lost data from FAT32 partition... devis Linux - Software 1 07-11-2005 08:10 AM
partition data recovery rlg Linux - Newbie 5 04-22-2005 12:27 AM
Data Recovery from former NTFS partition exark237 Linux - Hardware 3 07-21-2004 06:27 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 06:00 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration