1

so I did a very stupid thing (fortunately not on purpose). I had missing superblocks on a ext4 partition, which was encrypted by luks and sitting on an mdadm raid 5. For some reason I ran mke2fs on it (/dev/md1) and managed to ignore the warning that this is a Luks partition. I stopped after it wrote a few inodes.

Now the system will not detection it as a luks partition anymore and luksOpen, etc. fails, which, I guess, makes sense. Currently testdisk is running a deepsearch but I have little hopes.

Anything that comes to mind? The situation is not absolutely dire, since I do have most of the data backed up. Yet, if I could keep the data added between the backup and now (mostly media, ~500GB), I'd certainly be very happy.

Has anyone any leads on how to continue or should I give up?

Best, Patrick

Improve this question

1 Answer 1

Reset to default
0

You can check the LUKS on-disk format and that of ext4. You need the salt, the iterations (which may slightly differ from one create run to another), and one key slot. The key slot data is spread over the first 4MiB.

IIRC ext4 leaves the first one or two sectors untouched (for boot code). Maybe what you need for LUKS is there. If so then you should

  1. backup the first 4 MiB
  2. create a new LUKS volume so that the other metadata (like cipher) is "restored"
  3. copy the bytes you need from the backup
Improve this answer
2
  • Hi, thank you for your answer. That did not seem to work though, I did: dd if=/dev/md1 bs=4MiB count=1 of=luks-header.img, then rebuild the luks+ext4 and did dd if=luks-header.img bs=4MiB count=1 of=/dev/md1 -- same behaviour as before though. Appears back as an unknown volume in disk manager.
    – pAt84
    Commented Nov 18, 2017 at 22:35
  • @pAt84 I said "copy the bytes you need from the backup". It obviously does not make any sense to create a LUKS volume and overwrite all of its metadata with damaged metadata. I also did not say anything about creating a new filesystem within the container. This should now have destroyed all the old filesystem structures. In the future you should make sure you understand what and why you do it before you overwrite essential disk data. And if you do not understand it then you should ask before you do something irreversible...
    – Hauke Laging
    Commented Nov 19, 2017 at 9:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .