1

Is there a way to recover an overwritten LUKS partition? Consider the following case:

I had a (external) hard drive (not SSD) which is completely LUKS encrypted containing an ext4 file system with some (important) data (in my case images and videos). The passphrase is known. I don't have a LUKS header backup.

Now I accidentally created a new LUKS partition on that drive (which overwrote the old one) and a new ext4 file system inside. Then I copied some new data (in my case the some backup data from my laptop; 160 GB (the external drive has a size of 1TB) to it.

Is there any way to recover the old LUKS partition with all the data or at least the images and videos (maybe without filenames).

Edit: Additional questions

  1. Is there any way to revert bitwise the last operations (i.e. data transfer to the new partition, creation of the ext4 file-system, and creation of the LUKS volume)?

  2. Maybe this reversion is possible on a physical level if one analyzes the magnetic structure of the disk surface? Can a forensic professional do this?

  3. Are there any other promising approaches a forensic professional would try in this case?

  4. As already said I didn't backup the LUKS header of the old volume. However as indicated by frostschutz, if I had opened the old volume before the accident and didn't reboot, the header might be found in the memory (but I did reboot in my case). Are there other places where I can search for the header? I usually mounted the old volume using the pmount tool.

Improve this question
2
  • 1
    Your additional questions is asking for myths. There's nothing anyone can do. Sorry. – frostschutz Apr 26 '19 at 16:36
  • 1
    It is not reasonable for a mortal person (put aside rumors about government agency capabilities) to recover data that has already been overwritten. So your point "old LUKS partition with all the data" is, as frostschutz put it, myth. Once it is overwritten it is gone. Barring mythical microscopic magnetic analysis of molecules on the data stripes of the HDD platters. – 0xSheepdog Apr 26 '19 at 17:08
3

I'm afraid there's no chance without a header backup.

The passphrase is only useful when a LUKS header is available that has that passphrase in a keyslot. Without that, there's pretty much no way to recover the volume key.

Part of the LUKS design is that if the LUKS header is erased (and any backups) then it's forensically infeasible to access the container.

Improve this answer
3
  • Can the LUKS header recovered with something like testdisk? – student Apr 26 '19 at 14:53
  • @student Not if you have created the new LUKS container in exactly the same place where the old one was (so the new header completely overwrote the old header). The header is the only place that contains the encryption key, so if a new key got written over it, the old one can't be recovered at all. – TooTea Apr 26 '19 at 14:55
  • 1
    @student IIRC tools like testdisk work by looking for structures in the whole partition. With LUKS you have one giant high entropy block of data with no visible structure – Torin Apr 26 '19 at 14:58
3

If you damaged the LUKS header, and the LUKS container is not still open (not rebooted since accident and dmsetup table --showkeys still has the original one, not the new one you made), there is no way to recover any of the encrypted data. It's gone.

That leaves recovering old unencrypted data (if the drive was not wiped when encrypting).

As well as recovering data from third party sources - depending where these images and videos originally came from, you might be able to recover some from a camera SD card or something. Same if you ever copied them for anyone, or had them stored internally before putting them on the external drive, you might find something there.

But don't get your hopes up, SSD also have miniscule chances at recovery (due to TRIM cleaning out the free space).

Essentially this is a case where you restore from backup, or - not.

Improve this answer
2
  • Thanks for your answer. However the drive is a HDD not a SSD. – student Apr 26 '19 at 15:59
  • @student Sorry, apparently I misread the SSD part. Either way - if LUKS header was overwritten as you say, and no backups of this header nor knowledge of the master key exists, the data is gone from this device. That's the downside of encryption (or rather, its purpose) – frostschutz Apr 26 '19 at 16:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.