A few days ago, I formatted and encrypted (LUKS+Ext4) a solid state drive the lazy way (using gnome-disks). The disk was mounted and I moved some data to the disk from another drive that I was going to zero out and encrypt. Of course, this was literally the only bit of data that I don't have at least 3 copies (or even 1). The next day, I saw the partition was no longer mounted and seemed to be gone.
fdisk -l /dev/sdb
Disk /dev/sdb:
...
Disk identifier: 0x00000000
Disk /dev/sdb doesn't contain a valid partition table
file -s /dev/sdb
/dev/sdb: data
I used hexdump to check that there is data on the drive (to rule out me accidentally zeroing it out).
dd if=/dev/sdb bs=512 count=2048 | hexdump -C shows zeros, but once I hit count=2049, I start seeing some data:
dd if=/dev/sdb bs=512 count=2049 | hexdump -C
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00100000 4c 55 4b 53 ba be 00 01 61 65 73 00 00 00 00 00 |LUKS....aes.....|
00100010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00100020 00 00 00 00 00 00 00 00 78 74 73 2d 70 6c 61 69 |........xts-plai|
00100030 6e 36 34 00 00 00 00 00 00 00 00 00 00 00 00 00 |n64.............|
00100040 00 00 00 00 00 00 00 00 73 68 61 31 00 00 00 00 |........sha1....|
00100050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00100060 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 20 |............... |
00100070 54 de 2e 44 8a 4e f7 04 e2 c5 90 f3 0b 46 37 5c |T..D.N.......F7\|
00100080 69 56 f9 d0 3f f7 e8 b8 cf fa c6 18 0d c1 5e 8c |iV..?.........^.|
00100090 4e 11 73 1c 2b c0 1d 71 7d bb 61 61 10 5d ea 8c |N.s.+..q}.aa.]..|
001000a0 0a 10 96 bc 00 00 c5 44 34 35 38 65 33 34 30 34 |.......D458e3404|
001000b0 2d 64 62 35 38 2d 34 62 38 30 2d 39 32 64 64 2d |-db58-4b80-92dd-|
001000c0 30 38 37 63 30 33 61 36 39 38 38 64 00 00 00 00 |087c03a6988d....|
001000d0 00 ac 71 f3 00 03 0a cf a3 c8 f9 1e 42 bb 99 b0 |..q.........B...|
001000e0 9c 91 4c 66 fb 01 60 47 98 bc d0 b8 e3 3c 6f 64 |..Lf..`G.....<od|
001000f0 9a cf 06 85 ef 1d 42 0c 00 00 00 08 00 00 0f a0 |......B.........|
00100100 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00100110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00100120 00 00 00 00 00 00 00 00 00 00 01 08 00 00 0f a0 |................|
00100130 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00100140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00100150 00 00 00 00 00 00 00 00 00 00 02 08 00 00 0f a0 |................|
00100160 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00100170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00100180 00 00 00 00 00 00 00 00 00 00 03 08 00 00 0f a0 |................|
00100190 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |................|
001001a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
001001b0 00 00 00 00 00 00 00 00 00 00 04 08 00 00 0f a0 |................|
001001c0 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |................|
001001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
001001e0 00 00 00 00 00 00 00 00 00 00 05 08 00 00 0f a0 |................|
001001f0 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00100200
The only other thing I can think to note is that I think I may have accidentally gave another partition the same name later (I figured maybe this caused the unmount).
Any input would be much appreciated.
UPDATE:
lsmod | grep dm_crypt
dm_crypt 23216 2
uname -r
3.16.0-38-generic
UPDATE 2:
Not sure if this is helpful, but I compared the first part of the header with another encrypted partition's header and this was the result.
diff -y <(dd if=/dev/sdb bs=512 skip=2048 count=1 | hexdump -C) <(dd if=/dev/sdc1 bs=512 skip=0 count=1 | hexdump -C)
00000000 4c 55 4b 53 ba be 00 01 61 65 73 00 00 00 00 00 | 00000000 4c 55 4b 53 ba be 00 01 61 65 73 00 00 00 00 00 |
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
00000020 00 00 00 00 00 00 00 00 78 74 73 2d 70 6c 61 69 | 00000020 00 00 00 00 00 00 00 00 78 74 73 2d 70 6c 61 69 |
00000030 6e 36 34 00 00 00 00 00 00 00 00 00 00 00 00 00 | 00000030 6e 36 34 00 00 00 00 00 00 00 00 00 00 00 00 00 |
00000040 00 00 00 00 00 00 00 00 73 68 61 31 00 00 00 00 | 00000040 00 00 00 00 00 00 00 00 73 68 61 31 00 00 00 00 |
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
00000060 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 20 | | 00000060 00 00 00 00 00 00 00 00 00 00 10 01 00 00 00 20 |
00000070 54 de 2e 44 8a 4e f7 04 e2 c5 90 f3 0b 46 37 5c | | 00000070 24 1a 58 e8 ce 91 4b ef db 9d d0 27 9c 27 3c 02 |
00000080 69 56 f9 d0 3f f7 e8 b8 cf fa c6 18 0d c1 5e 8c | | 00000080 b7 27 35 b7 e5 ec 6d 6b 4f af 63 ab 06 03 4d da |
00000090 4e 11 73 1c 2b c0 1d 71 7d bb 61 61 10 5d ea 8c | | 00000090 eb 05 49 29 4b be 98 73 6c 4b 2e 49 b3 75 14 a0 |
000000a0 0a 10 96 bc 00 00 c5 44 34 35 38 65 33 34 30 34 | | 000000a0 69 ef 8a 53 00 00 c4 c7 64 63 64 35 66 65 32 35 |
000000b0 2d 64 62 35 38 2d 34 62 38 30 2d 39 32 64 64 2d | | 000000b0 2d 34 31 34 31 2d 34 35 34 31 2d 39 32 37 39 2d |
000000c0 30 38 37 63 30 33 61 36 39 38 38 64 00 00 00 00 | | 000000c0 37 35 31 38 34 66 64 61 37 39 63 31 00 00 00 00 |
000000d0 00 ac 71 f3 00 03 0a cf a3 c8 f9 1e 42 bb 99 b0 | | 000000d0 00 ac 71 f3 00 03 09 9a eb 00 61 89 23 34 ff b7 |
000000e0 9c 91 4c 66 fb 01 60 47 98 bc d0 b8 e3 3c 6f 64 | | 000000e0 cf 33 12 1e 5d a8 81 8c b6 3c e3 8b 18 b6 1f e5 |
000000f0 9a cf 06 85 ef 1d 42 0c 00 00 00 08 00 00 0f a0 | | 000000f0 24 4b 5a 07 ca b3 49 8c 00 00 00 08 00 00 0f a0 |
00000100 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 | 00000100 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |
00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
00000120 00 00 00 00 00 00 00 00 00 00 01 08 00 00 0f a0 | 00000120 00 00 00 00 00 00 00 00 00 00 01 08 00 00 0f a0 |
00000130 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 | 00000130 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |
00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
00000150 00 00 00 00 00 00 00 00 00 00 02 08 00 00 0f a0 | 00000150 00 00 00 00 00 00 00 00 00 00 02 08 00 00 0f a0 |
00000160 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 | 00000160 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |
00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
00000180 00 00 00 00 00 00 00 00 00 00 03 08 00 00 0f a0 | 00000180 00 00 00 00 00 00 00 00 00 00 03 08 00 00 0f a0 |
00000190 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 | 00000190 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |
000001a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 000001a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
000001b0 00 00 00 00 00 00 00 00 00 00 04 08 00 00 0f a0 | 000001b0 00 00 00 00 00 00 00 00 00 00 04 08 00 00 0f a0 |
000001c0 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 | 000001c0 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |
000001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 000001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
000001e0 00 00 00 00 00 00 00 00 00 00 05 08 00 00 0f a0 | 000001e0 00 00 00 00 00 00 00 00 00 00 05 08 00 00 0f a0 |
000001f0 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 | 000001f0 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |
00000200 00000200
dm_crypt
, and it is updated quite often. First i'd check if it is loaded (lsmod | grep dm_crypt
andmodprobe dm_crypt
if it is not). Only then tryfile -s
. It is perfectly fine to have a LUKS disk without a partition table (I have several) but such a disk can only be understood byfile
is the magic numbers are in place, and for that you needcryptsetup
anddm_crypt
installed. Also, what is your kernel version? (old ones may not havexts-plain64
)lsmod | grep ...
and kernel version into the question (not just leaving it in the comment).