1

I deleted a LUKS partition by fdisk for some reason; I rebuilt it, but mistakenly did so as an extended container, then hit w.

Although I deleted the extended container later, and rebuilt the LUKS (/dev/sda4) again. However, 'hexdump /dev/sda4 | less' shows that the address before 00000260 contains nearly no printable characters (except dots and an 'U'). Starting from 00000260 are some random characters.

Is it rebuilding LUKS as an extended container because the header was damaged?

  • Can you still decrypt the container? Find the luks "magic bytes"? Have a header backup? – Xen2050 Apr 6 at 1:26
  • No, no backup. After learning, know that before computer reaches the quantum power, I will give up rescue of my LUKS without header. So I'm going to create a new Luks, is LUKS2 a better choice because I hear it stores multiple backups of LUKS2 header? – Maggicmuojet Apr 6 at 14:33
  • I haven't read about LUKS2 yet, but it's most likely an improvement. Anyway, re-partitioning alone might not have overwritten anything, but reformatting could have... luks's "magic bytes" are basically just LUKS ('L','U','K','S', 0xba, 0xbe according to the faq) recovering the header might still be possible, or see other Q's like this one. Also, if you had made a backup of just the master key it would be very useful, it's only about 50 chars – Xen2050 Apr 15 at 7:27
2

If this is related to your earlier question, then yes: setting up an extended partition includes writing an Extended Partition Boot Record (EPBR or sometimes EBR) at the very beginning of the extended partition. Wikipedia has a description of it.

The EPBR would be written exactly where the LUKS header would be, so yes, it would cause the LUKS header to be overwritten.

  • May the logical partition be a danger in re-numbering partition? Is GPT doesn't has logical partition the better choice than MBR? – Maggicmuojet Apr 6 at 14:31
  • If the LUKS partition gets renumbered, it can be fixed: just boot in rescue mode/end up in single user shell because normal boot failed, use cryptsetup luksOpen manually with the new partition number, mount your filesystems, chroot to your real root filesystem if necessary, and then edit the new partition number into /etc/crypttab and rebuild your initramfs. The partition number may change, but as long as the cryptsetup gets the right parameters, LUKS does not care. But as you discovered, overwriting the LUKS header is not fixable unless you have a backup of it. – telcoM Apr 6 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.