I'm trying to gain access to my LUKS partitions after suddenly discovering that my password stopped working on all 4 LUKS partitions. 7 days ago when I tried booting and logging into my linux OS, my password stopped working.
I have 4 partitions that are encrypted with LUKS. 3 Partitions are on my linux main drive, they include the root filesystem, the home partition and the swap. Another extended home partition is on another drive. They are all encrypted with the same password. 3 partitions are auto decrypted with a keyfile from the root filesystem LUKS partition on startup, so only one password is required for me to login.
I encrypted my drives 5 months ago, and I was using the password every single day. Is it possible I had sudden loss of memory of my password? I don't feel like my password is incorrect. Password looks correct when typed out on screen.
I also have a dual boot setup with windows 7 on a separate drive. I logged in to windows the day before my linux password stopped working. Could windows 7 have corrupted 4 LUKS partitions on 2 drives at the same time without asking me? Has anything like this happened before?
Unfortunately I don't have a password or header backup for the partitions.
I've tried accessing my LUKS partitions many times over the last week. I used a live linux cd to attempt opening my partitions, but every time cryptsetup says the password is incorrect.
sudo cryptsetup --type luks open /dev/sdb1 encrypted sudo cryptsetup --type luks open /dev/sdf2 encrypted2 sudo cryptsetup --type luks open /dev/sdf3 encrypted3 sudo cryptsetup --type luks open /dev/sdf4 encrypted4 No key available with this passphrase.
I've tried opening all 4 partitions with cryptsetup. I've tried changing my keyboard layout between UK and US, but no luck. Cryptsetup luksdump shows that all 4 partitions still have LUKS headers; one partition (root fs) with 1 keyslot, and the other 3 with 2 keyslots, I'm guessing the second keyslot is the auto keyfile.
$ sudo cryptsetup -v isLuks /dev/sdb1 Command successful. $ sudo cryptsetup luksDump /dev/sdb1 LUKS header information for /dev/sdb1 Version: 1 Cipher name: aes Cipher mode: xts-plain64 Hash spec: sha512 Payload offset: 4096 MK bits: 512 MK digest: 08 ca 09 9f c3 b0 cf cf bc 36 97 52 2c 03 4d c3 1e 0b fe c9 MK salt: 4b 76 75 23 1e d5 7a ad 18 bc 37 e4 42 55 51 a3 7a ef e1 f2 c4 dc d0 fe 71 27 f1 64 d7 b6 1c ba MK iterations: 732500 UUID: 89e80b59-cb5a-42c8-8001-ecf92206aca6 Key Slot 0: ENABLED Iterations: 5878300 Salt: 59 3e cb 7f 11 c8 93 db 1e 62 0c 98 d1 c6 6e fc ea 65 f2 6d ff a7 20 c2 48 69 d2 2a 5b 76 07 2e Key material offset: 8 AF stripes: 4000 Key Slot 1: ENABLED Iterations: 2400937 Salt: 18 26 74 ce 42 57 cc e8 82 f5 23 ef 65 1d a0 67 65 52 c2 3e 3f 2c d0 9f 00 88 e2 6d 7c 14 e6 fa Key material offset: 512 AF stripes: 4000 Key Slot 2: DISABLED Key Slot 3: DISABLED Key Slot 4: DISABLED Key Slot 5: DISABLED Key Slot 6: DISABLED Key Slot 7: DISABLED
Is there any hope of decrypting the drives?
What do you think could have done this? Windows messing with my drives, password amnesia, or something else?
EDIT: This forum post suggests a link between Samsung SSDs, and a discard flag in crypttab causing corruption: https://bbs.archlinux.org/viewtopic.php?pid=1846810#p1846810
Three of my LUKS partitions were on a Samsung EVO SSD. I can't confirm I wasn't using a discard flag in my crypttab.
EDIT: Hexdumps: https://mega.nz/#!QZxRDCzA!254HtfzHibAkJXcO6BcEZuoRpjLvQBXV7WjKYMgvbfs
cryptsetup -v isLuks /dev/sdb1and/or
cryptsetup luksDump /dev/sdb1
hexdump -C? it's impossible to validate a LUKS header, you can only check for obvious corruption (obvious nonrandom data where random data should be in the key material or the like)