Quantcast
Channel: Active questions tagged partition - Server Fault
Viewing all articles
Browse latest Browse all 71

How to rescue an encrypted LUKS partition that was partially modified by a Windows tool?

$
0
0

On a system with dual boot, the Windows tool Dell SupportAssist started to modify partitions now I ended up with a broken Linux installation.

The Linux installation is/was Ubuntu with an encrypted LUKS partition and before applying a week-old backup I thought that there might be a change of rescuing some data.

A live distribution still found the partitions and testdisk claimed that was able to identify its boundaries.

It seems that there's still some data accessible:

$ cryptsetup luksDumpLUKS header informationVersion:        2Epoch:          3Metadata area:  16384 [bytes]Keyslots area:  16744448 [bytes]UUID:           3ebdbc55-c283-4b33-89f6-b254057db9d0Label:          (no label)Subsystem:      (no subsystem)Flags:          (no flags)Data segments:  0: crypt    offset: 16777216 [bytes]    length: (whole device)    cipher: aes-xts-plain64    sector: 512 [bytes]Keyslots:  0: luks2    Key:        512 bits    Priority:   normal    Cipher:     aes-xts-plain64    Cipher key: 512 bits    PBKDF:      argon2i    Time cost:  7    Memory:     1048576    Threads:    4    Salt:       a5 ff f5 ae 21 38 4f 44 4b af 26 fb bd b5 15 7f                 41 dd 86 4a c1 41 7f 2c 35 f7 52 0b b8 ff 3b a4     AF stripes: 4000    AF hash:    sha512    Area offset:32768 [bytes]    Area length:258048 [bytes]    Digest ID:  0Tokens:Digests:  0: pbkdf2    Hash:       sha512    Iterations: 187513    Salt:       0d 92 31 9c ae 3c a7 d1 aa 04 5f 37 e5 ff 6f 4e                 a7 4f 37 3f a5 0c 2c a4 db 31 69 06 52 91 79 16     Digest:     13 3c 62 0f 06 17 be 9b e5 da 86 05 d5 fb 39 ad                 d8 e2 2f a5 fd 8f 14 55 50 c5 c1 73 e9 e6 84 76                 86 e2 c3 f1 c2 ef 72 c4 bf f5 42 0a 8f 43 5a 0e                 cd a9 2b c4 70 de 0d b8 d5 06 40 2b a6 4e 10 64 

but I'm getting an error message when trying to mount it (WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?):

$ sudo cryptsetup luksOpen /dev/nvme0n1p4 cryptEnter passphrase for /dev/nvme0n1p4:$ sudo vgchange -ay   WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?  WARNING: One or more devices used as PVs in VG vgubuntu have changed sizes.  device-mapper: reload ioctl on  (252:2) failed: Invalid argument  1 logical volume(s) in volume group "vgubuntu" now active

This error pops up on all commands:

$ sudo vgdisplay  WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?  WARNING: One or more devices used as PVs in VG vgubuntu have changed sizes.  --- Volume group ---  VG Name               vgubuntu  System ID               Format                lvm2  Metadata Areas        1  Metadata Sequence No  3  VG Access             read/write  VG Status             resizable  MAX LV                0  Cur LV                2  Open LV               0  Max PV                0  Cur PV                1  Act PV                1  VG Size               <1.67 TiB  PE Size               4.00 MiB  Total PE              437736  Alloc PE / Size       437736 / <1.67 TiB  Free  PE / Size       0 / 0     VG UUID               5v0f8R-w1Qg-SBI2-Ozzb-0f1z-aCML-yyDsxq$ sudo vgchange -ay --activationmode partial  PARTIAL MODE. Incomplete logical volumes will be processed.  WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?  WARNING: One or more devices used as PVs in VG vgubuntu have changed sizes.  device-mapper: reload ioctl on  (252:2) failed: Invalid argument  1 logical volume(s) in volume group "vgubuntu" now active$ sudo lvscan  WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?  WARNING: One or more devices used as PVs in VG vgubuntu have changed sizes.  ACTIVE            '/dev/vgubuntu/swap' [<41.04 GiB] inherit  inactive          '/dev/vgubuntu/root' [<1.63 TiB] inherit

I thought that maybe resetting the boundaries might help but it didn't:

$ sudo lvreduce -L -1M /dev/vgubuntu/root  WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?  WARNING: One or more devices used as PVs in VG vgubuntu have changed sizes.  Rounding size to boundary between physical extents: 0   .  New size (427230 extents) matches existing size (427230 extents).

So maybe that wasn't a good idea on my side.

This is how the structure in testdisk looks like:

Disk /dev/nvme0n1 - 2048 GB / 1907 GiB - CHS 1953514 64 32     Partition               Start        End    Size in sectors >P MS Data                     2048    1085439    1083392 [Recovery] P EFI System               1085440    1290239     204800 [EFI System Partition] [NO NAME] D MS Data                403359745  405266432    1906688 D MS Data                405266432  407173119    1906688 D MS Data                405676033  407175168    1499136 D MS Data                407175168  408674303    1499136 P Linux filesys. data    408674304  412581887    3907584 P Linux filesys. data    412581888 2397717532 1985135645

This is how its intense scan looks like:

testdisk intensive scan result

This is how the structure in DMDE looks like:

partition overview of DMDE

screenshot of DMDE

Any advice on how to proceed to try rescuing the data?


Viewing all articles
Browse latest Browse all 71

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>