Quantcast
Viewing all articles
Browse latest Browse all 65

How to rescue an encrypted LUKS partition that was partially modified by a Windows tool?

On a system with dual boot, the Windows tool Dell SupportAssist started to modify partitions now I ended up with a broken Linux installation.

The Linux installation is/was Ubuntu with an encrypted LUKS partition and before applying a week-old backup I thought that there might be a change of rescuing some data.

A live distribution still found the partitions and testdisk claimed that was able to identify its boundaries.

It seems that there's still some data accessible:

$ cryptsetup luksDumpLUKS header informationVersion:        2Epoch:          3Metadata area:  16384 [bytes]Keyslots area:  16744448 [bytes]UUID:           3ebdbc55-c283-4b33-89f6-b254057db9d0Label:          (no label)Subsystem:      (no subsystem)Flags:          (no flags)Data segments:  0: crypt    offset: 16777216 [bytes]    length: (whole device)    cipher: aes-xts-plain64    sector: 512 [bytes]Keyslots:  0: luks2    Key:        512 bits    Priority:   normal    Cipher:     aes-xts-plain64    Cipher key: 512 bits    PBKDF:      argon2i    Time cost:  7    Memory:     1048576    Threads:    4    Salt:       a5 ff f5 ae 21 38 4f 44 4b af 26 fb bd b5 15 7f                 41 dd 86 4a c1 41 7f 2c 35 f7 52 0b b8 ff 3b a4     AF stripes: 4000    AF hash:    sha512    Area offset:32768 [bytes]    Area length:258048 [bytes]    Digest ID:  0Tokens:Digests:  0: pbkdf2    Hash:       sha512    Iterations: 187513    Salt:       0d 92 31 9c ae 3c a7 d1 aa 04 5f 37 e5 ff 6f 4e                 a7 4f 37 3f a5 0c 2c a4 db 31 69 06 52 91 79 16     Digest:     13 3c 62 0f 06 17 be 9b e5 da 86 05 d5 fb 39 ad                 d8 e2 2f a5 fd 8f 14 55 50 c5 c1 73 e9 e6 84 76                 86 e2 c3 f1 c2 ef 72 c4 bf f5 42 0a 8f 43 5a 0e                 cd a9 2b c4 70 de 0d b8 d5 06 40 2b a6 4e 10 64 

but I'm getting an error message when trying to mount it (WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?):

$ sudo cryptsetup luksOpen /dev/nvme0n1p4 cryptEnter passphrase for /dev/nvme0n1p4:$ sudo vgchange -ay   WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?  WARNING: One or more devices used as PVs in VG vgubuntu have changed sizes.  device-mapper: reload ioctl on  (252:2) failed: Invalid argument  1 logical volume(s) in volume group "vgubuntu" now active

This error pops up on all commands:

$ sudo vgdisplay  WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?  WARNING: One or more devices used as PVs in VG vgubuntu have changed sizes.  --- Volume group ---  VG Name               vgubuntu  System ID               Format                lvm2  Metadata Areas        1  Metadata Sequence No  3  VG Access             read/write  VG Status             resizable  MAX LV                0  Cur LV                2  Open LV               0  Max PV                0  Cur PV                1  Act PV                1  VG Size               <1.67 TiB  PE Size               4.00 MiB  Total PE              437736  Alloc PE / Size       437736 / <1.67 TiB  Free  PE / Size       0 / 0     VG UUID               5v0f8R-w1Qg-SBI2-Ozzb-0f1z-aCML-yyDsxq$ sudo vgchange -ay --activationmode partial  PARTIAL MODE. Incomplete logical volumes will be processed.  WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?  WARNING: One or more devices used as PVs in VG vgubuntu have changed sizes.  device-mapper: reload ioctl on  (252:2) failed: Invalid argument  1 logical volume(s) in volume group "vgubuntu" now active$ sudo lvscan  WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?  WARNING: One or more devices used as PVs in VG vgubuntu have changed sizes.  ACTIVE            '/dev/vgubuntu/swap' [<41.04 GiB] inherit  inactive          '/dev/vgubuntu/root' [<1.63 TiB] inherit

I thought that maybe resetting the boundaries might help but it didn't:

$ sudo lvreduce -L -1M /dev/vgubuntu/root  WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?  WARNING: One or more devices used as PVs in VG vgubuntu have changed sizes.  Rounding size to boundary between physical extents: 0   .  New size (427230 extents) matches existing size (427230 extents).

So maybe that wasn't a good idea on my side.

This is how the structure in testdisk looks like:

Image may be NSFW.
Clik here to view.
Disk /dev/nvme0n1 - 2048 GB / 1907 GiB - CHS 1953514 64 32     Partition               Start        End    Size in sectors >P MS Data                     2048    1085439    1083392 [Recovery] P EFI System               1085440    1290239     204800 [EFI System Partition] [NO NAME] D MS Data                403359745  405266432    1906688 D MS Data                405266432  407173119    1906688 D MS Data                405676033  407175168    1499136 D MS Data                407175168  408674303    1499136 P Linux filesys. data    408674304  412581887    3907584 P Linux filesys. data    412581888 2397717532 1985135645

This is how its intense scan looks like:

Image may be NSFW.
Clik here to view.
testdisk intensive scan result

This is how the structure in DMDE looks like:

Image may be NSFW.
Clik here to view.
partition overview of DMDE

Image may be NSFW.
Clik here to view.
screenshot of DMDE

Any advice on how to proceed to try rescuing the data?


Viewing all articles
Browse latest Browse all 65

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>