6

I have a hard drive with Ubuntu 14.04 installation - root partition was encrypted with LUKS. I had some configuration problems and wanted to re-install Ubuntu but keep all my data so I moved all my files to a separate folder (/OLD) and tried to run the installer again with the option to NOT format the drive (use existing partition).

It asked me for my password but didn't format the drive. I can't access my data now. I can unlock the drive and it accepts my password (rejects other passwords) but after unlocking it it says unknown filesystem.

I suspect what happened is it created a new LUKS key with different salt and I'm able to unlock the partition but because the key is different the data is garbled.

Questions

  • So my question is does this sound like a good explanation?
  • Does anybody know a way to recreate my previous LUKS key from my known password (same password) but salt is different?
  • Is it easier to brute force now that I know what the password is but I'm just missing the salt?
  • Any apps or scripts to help me do this (LUKS key bruteforce from known password)?
Improve this question
2
  • 1
    It would help if you clarified you clarified your setup, and what is/isn't working currently. For instance: what volumes do you have, where is the system installed, where is your old data meant to be, does the system boot or are you only getting as far as unlocking the encrypted volume, etc?
    – EricM
    Nov 9, 2014 at 16:58
  • The root volume cannot be unlocked. It's not a problem with volumes or boot loader - it's a problem with the encryption key got changed by the installer. The question is about how to generate a LUKS key from a known password.
    – zobo
    Nov 18, 2014 at 7:15

1 Answer 1

Reset to default
4

The master key bears no relationship to any of the possible passwords (recall that with LUKS you can have multiple passwords to unlock a single master key).

Per the cryptsetup FAQ:

LUKS PASSPHRASE IS NOT THE MASTER KEY: The LUKS passphrase is not used in deriving the master key. It is used in decrypting a master key that is randomly selected on header creation. This means that if you create a new LUKS header on top of an old one with exactly the same parameters and exactly the same passphrase as the old one, it will still have a different master key and your data will be permanently lost.

So unfortunately your data is unrecoverable, you need to restore from a backup.

Improve this answer
1
  • Eric - thanks for the response. I had a suspicion this was the case and I believe your answer is correct. Lesson learned - never assume an installer will do what you think it will do and keep a backup.
    – zobo
    Dec 1, 2014 at 4:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .