1

A few days ago, I formatted and encrypted (LUKS+Ext4) a solid state drive the lazy way (using gnome-disks). The disk was mounted and I moved some data to the disk from another drive that I was going to zero out and encrypt. Of course, this was literally the only bit of data that I don't have at least 3 copies (or even 1). The next day, I saw the partition was no longer mounted and seemed to be gone.

fdisk -l /dev/sdb

Disk /dev/sdb:
...
Disk identifier: 0x00000000

Disk /dev/sdb doesn't contain a valid partition table

file -s /dev/sdb

/dev/sdb: data

I used hexdump to check that there is data on the drive (to rule out me accidentally zeroing it out).

dd if=/dev/sdb bs=512 count=2048 | hexdump -C shows zeros, but once I hit count=2049, I start seeing some data:

dd if=/dev/sdb bs=512 count=2049 | hexdump -C

00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00100000  4c 55 4b 53 ba be 00 01  61 65 73 00 00 00 00 00  |LUKS....aes.....|
00100010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00100020  00 00 00 00 00 00 00 00  78 74 73 2d 70 6c 61 69  |........xts-plai|
00100030  6e 36 34 00 00 00 00 00  00 00 00 00 00 00 00 00  |n64.............|
00100040  00 00 00 00 00 00 00 00  73 68 61 31 00 00 00 00  |........sha1....|
00100050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00100060  00 00 00 00 00 00 00 00  00 00 10 00 00 00 00 20  |............... |
00100070  54 de 2e 44 8a 4e f7 04  e2 c5 90 f3 0b 46 37 5c  |T..D.N.......F7\|
00100080  69 56 f9 d0 3f f7 e8 b8  cf fa c6 18 0d c1 5e 8c  |iV..?.........^.|
00100090  4e 11 73 1c 2b c0 1d 71  7d bb 61 61 10 5d ea 8c  |N.s.+..q}.aa.]..|
001000a0  0a 10 96 bc 00 00 c5 44  34 35 38 65 33 34 30 34  |.......D458e3404|
001000b0  2d 64 62 35 38 2d 34 62  38 30 2d 39 32 64 64 2d  |-db58-4b80-92dd-|
001000c0  30 38 37 63 30 33 61 36  39 38 38 64 00 00 00 00  |087c03a6988d....|
001000d0  00 ac 71 f3 00 03 0a cf  a3 c8 f9 1e 42 bb 99 b0  |..q.........B...|
001000e0  9c 91 4c 66 fb 01 60 47  98 bc d0 b8 e3 3c 6f 64  |..Lf..`G.....<od|
001000f0  9a cf 06 85 ef 1d 42 0c  00 00 00 08 00 00 0f a0  |......B.........|
00100100  00 00 de ad 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00100110  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00100120  00 00 00 00 00 00 00 00  00 00 01 08 00 00 0f a0  |................|
00100130  00 00 de ad 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00100140  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00100150  00 00 00 00 00 00 00 00  00 00 02 08 00 00 0f a0  |................|
00100160  00 00 de ad 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00100170  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00100180  00 00 00 00 00 00 00 00  00 00 03 08 00 00 0f a0  |................|
00100190  00 00 de ad 00 00 00 00  00 00 00 00 00 00 00 00  |................|
001001a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
001001b0  00 00 00 00 00 00 00 00  00 00 04 08 00 00 0f a0  |................|
001001c0  00 00 de ad 00 00 00 00  00 00 00 00 00 00 00 00  |................|
001001d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
001001e0  00 00 00 00 00 00 00 00  00 00 05 08 00 00 0f a0  |................|
001001f0  00 00 de ad 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00100200

The only other thing I can think to note is that I think I may have accidentally gave another partition the same name later (I figured maybe this caused the unmount).

Any input would be much appreciated.

UPDATE:

lsmod | grep dm_crypt

dm_crypt               23216  2

uname -r

3.16.0-38-generic

UPDATE 2:

Not sure if this is helpful, but I compared the first part of the header with another encrypted partition's header and this was the result.

diff -y <(dd if=/dev/sdb bs=512 skip=2048 count=1 | hexdump -C) <(dd if=/dev/sdc1 bs=512 skip=0 count=1 | hexdump -C)

00000000  4c 55 4b 53 ba be 00 01  61 65 73 00 00 00 00 00  |   00000000  4c 55 4b 53 ba be 00 01  61 65 73 00 00 00 00 00  |
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |   00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |
00000020  00 00 00 00 00 00 00 00  78 74 73 2d 70 6c 61 69  |   00000020  00 00 00 00 00 00 00 00  78 74 73 2d 70 6c 61 69  |
00000030  6e 36 34 00 00 00 00 00  00 00 00 00 00 00 00 00  |   00000030  6e 36 34 00 00 00 00 00  00 00 00 00 00 00 00 00  |
00000040  00 00 00 00 00 00 00 00  73 68 61 31 00 00 00 00  |   00000040  00 00 00 00 00 00 00 00  73 68 61 31 00 00 00 00  |
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |   00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |
00000060  00 00 00 00 00 00 00 00  00 00 10 00 00 00 00 20  | | 00000060  00 00 00 00 00 00 00 00  00 00 10 01 00 00 00 20  |
00000070  54 de 2e 44 8a 4e f7 04  e2 c5 90 f3 0b 46 37 5c  | | 00000070  24 1a 58 e8 ce 91 4b ef  db 9d d0 27 9c 27 3c 02  |
00000080  69 56 f9 d0 3f f7 e8 b8  cf fa c6 18 0d c1 5e 8c  | | 00000080  b7 27 35 b7 e5 ec 6d 6b  4f af 63 ab 06 03 4d da  |
00000090  4e 11 73 1c 2b c0 1d 71  7d bb 61 61 10 5d ea 8c  | | 00000090  eb 05 49 29 4b be 98 73  6c 4b 2e 49 b3 75 14 a0  |
000000a0  0a 10 96 bc 00 00 c5 44  34 35 38 65 33 34 30 34  | | 000000a0  69 ef 8a 53 00 00 c4 c7  64 63 64 35 66 65 32 35  |
000000b0  2d 64 62 35 38 2d 34 62  38 30 2d 39 32 64 64 2d  | | 000000b0  2d 34 31 34 31 2d 34 35  34 31 2d 39 32 37 39 2d  |
000000c0  30 38 37 63 30 33 61 36  39 38 38 64 00 00 00 00  | | 000000c0  37 35 31 38 34 66 64 61  37 39 63 31 00 00 00 00  |
000000d0  00 ac 71 f3 00 03 0a cf  a3 c8 f9 1e 42 bb 99 b0  | | 000000d0  00 ac 71 f3 00 03 09 9a  eb 00 61 89 23 34 ff b7  |
000000e0  9c 91 4c 66 fb 01 60 47  98 bc d0 b8 e3 3c 6f 64  | | 000000e0  cf 33 12 1e 5d a8 81 8c  b6 3c e3 8b 18 b6 1f e5  |
000000f0  9a cf 06 85 ef 1d 42 0c  00 00 00 08 00 00 0f a0  | | 000000f0  24 4b 5a 07 ca b3 49 8c  00 00 00 08 00 00 0f a0  |
00000100  00 00 de ad 00 00 00 00  00 00 00 00 00 00 00 00  |   00000100  00 00 de ad 00 00 00 00  00 00 00 00 00 00 00 00  |
00000110  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |   00000110  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |
00000120  00 00 00 00 00 00 00 00  00 00 01 08 00 00 0f a0  |   00000120  00 00 00 00 00 00 00 00  00 00 01 08 00 00 0f a0  |
00000130  00 00 de ad 00 00 00 00  00 00 00 00 00 00 00 00  |   00000130  00 00 de ad 00 00 00 00  00 00 00 00 00 00 00 00  |
00000140  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |   00000140  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |
00000150  00 00 00 00 00 00 00 00  00 00 02 08 00 00 0f a0  |   00000150  00 00 00 00 00 00 00 00  00 00 02 08 00 00 0f a0  |
00000160  00 00 de ad 00 00 00 00  00 00 00 00 00 00 00 00  |   00000160  00 00 de ad 00 00 00 00  00 00 00 00 00 00 00 00  |
00000170  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |   00000170  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |
00000180  00 00 00 00 00 00 00 00  00 00 03 08 00 00 0f a0  |   00000180  00 00 00 00 00 00 00 00  00 00 03 08 00 00 0f a0  |
00000190  00 00 de ad 00 00 00 00  00 00 00 00 00 00 00 00  |   00000190  00 00 de ad 00 00 00 00  00 00 00 00 00 00 00 00  |
000001a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |   000001a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |
000001b0  00 00 00 00 00 00 00 00  00 00 04 08 00 00 0f a0  |   000001b0  00 00 00 00 00 00 00 00  00 00 04 08 00 00 0f a0  |
000001c0  00 00 de ad 00 00 00 00  00 00 00 00 00 00 00 00  |   000001c0  00 00 de ad 00 00 00 00  00 00 00 00 00 00 00 00  |
000001d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |   000001d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |
000001e0  00 00 00 00 00 00 00 00  00 00 05 08 00 00 0f a0  |   000001e0  00 00 00 00 00 00 00 00  00 00 05 08 00 00 0f a0  |
000001f0  00 00 de ad 00 00 00 00  00 00 00 00 00 00 00 00  |   000001f0  00 00 de ad 00 00 00 00  00 00 00 00 00 00 00 00  |
00000200                            00000200
Improve this question
7
  • cryptsetup (the linux piece that performs disk encryption) uses a kernel module called dm_crypt, and it is updated quite often. First i'd check if it is loaded (lsmod | grep dm_crypt and modprobe dm_crypt if it is not). Only then try file -s. It is perfectly fine to have a LUKS disk without a partition table (I have several) but such a disk can only be understood by file is the magic numbers are in place, and for that you need cryptsetup and dm_crypt installed. Also, what is your kernel version? (old ones may not have xts-plain64)
    – grochmal
    Jul 12, 2016 at 23:32
  • Also, please do not post images of text copy the terminal output and paste in the question formatted as code. It is much easier to read. For example, had you pasted the entire LUKS header as text I could try figuring out whether it is a valid header. (there is nothing secret in that header, it is designed to not have anything secret in it.)
    – grochmal
    Jul 12, 2016 at 23:35
  • Yes, dm_crypt is loaded. I should also note that all my other drives are encrypted and working fine, but they all have partition tables. My kernel version is 3.16.0-38-generic.
    – Paul Nordin
    Jul 12, 2016 at 23:37
  • @grochmal I would be happy to edit the post and replace the image with text. However, is the first 512 bytes of the header going to be enough to check whether it is valid? Isn't the full header 2MB?
    – Paul Nordin
    Jul 12, 2016 at 23:41
  • We only really care about the beginning, i.e. the magic number. I would simply like to see how the 0x00090090 line looks like (i'll likely be lazy and just compare it against one of mine). Also, i must ask you to get into the habit of updating the question, i.e. with the output of lsmod | grep ... and kernel version into the question (not just leaving it in the comment).
    – grochmal
    Jul 12, 2016 at 23:46

1 Answer 1

Reset to default
1

Thanks to @grochmal, I was able to access the data that was on the drive by doing the following:

  1. dd if=/dev/sdb of=sdb.img bs=512 skip=2048 conv=noerror,sync
  2. losetup /dev/loop0 sdb.img
  3. cryptsetup luksOpen /dev/loop0 data

I suppose now I can also dd if=sdb.img of=/dev/sdb (after backing up my data of course :)).

Note: If you are in a similar situation, make sure to read the original post and if this solution is applicable, substitute in the proper offset value (skip), device names, etc.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .