You are not logged in.
- Topics: Active | Unanswered
#1 2012-10-20 20:26:15
- thewooster
- Member
- Registered: 2012-10-20
- Posts: 57
Recover Data - Accidentally formatted Luks Partition
Alright, so I am not new to linux (I have used Ubuntu since 6.10 or so and played around with various other distros for years), but I am new to arch. I also am somewhat new to Luks.
Basically, I am multi-booting on two separate hard drives. The first Hard drive has Windows 7 and Arch (well, had Arch). Windows is completely unencrypted (I use it mostly just for gaming), but Arch was using full system encryption. The second hard drive contained my boot information and a second linux distro also using lux. That hard drive is completely intact.
However, the partition on my first hard drive containing my Arch installation was accidentally formatted. I have done quite a bit of reading in the arch forums, wiki, and other places, so if an answer has already been posted I apologize. Anyway, I am guessing the partition table was lost, and my system no longer recognizes the partition as a luks partition. Is it possible the header is still intact, or that I can retrieve my data? The data is fairly important to me, so I am willing to got to a certain amount of trouble to retrieve it. It really should have been backed up, but of course I was stupid and did not do so. I do have the master password.
I've also been running testdisk for quite some time, but to be honest I'm not completely sure what I'm looking for. I will post the output of that as well.
And just to say it, so far the Arch community has been great and I've been quite impressed with the sheer amount of documentation available. I'll just have to try not to screw with system encryption when I'm dead tired anymore . . . at least not without making backups XD. Yay noob mistakes?
Fdisk output:
Disk /dev/sda: 500.1 GB, 500107862016 bytes
255 heads, 63 sectors/track, 60801 cylinders, total 976773168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00024c51
Device Boot Start End Blocks Id System
/dev/sda1 * 63 192779 96358+ 7 HPFS/NTFS/exFAT
/dev/sda2 192780 337397129 168602175 7 HPFS/NTFS/exFAT
/dev/sda3 337397130 976768064 319685467+ 83 Linux
Disk /dev/sdb: 120.0 GB, 120034123776 bytes
255 heads, 63 sectors/track, 14593 cylinders, total 234441648 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x000d9094
Device Boot Start End Blocks Id System
/dev/sdb1 * 63 1044224 522081 83 Linux
/dev/sdb2 1044225 234436544 116696160 5 Extended
/dev/sdb5 1044288 234436544 116696128+ 83 Linux
Disk /dev/mmcblk0: 2032 MB, 2032664576 bytes
16 heads, 24 sectors/track, 10338 cylinders, total 3970048 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xa3a4f5edTestdisk Output:
Sat Oct 20 08:31:37 2012
Command line: TestDisk
TestDisk 6.14-WIP, Data Recovery Utility, May 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.5.6-pmagic (#1 SMP Mon Oct 8 17:36:20 CDT 2012) i686
Compiler: GCC 4.7
Compilation date: 2012-05-30T19:32:33
ext2fs lib: 1.42.6, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 976773168 sectors
/dev/sda: user_max 976773168 sectors
/dev/sda: native_max 976773168 sectors
/dev/sda: dco 976773168 sectors
/dev/sdb: LBA, LBA48, DCO support
/dev/sdb: size 234441648 sectors
/dev/sdb: user_max 234441648 sectors
/dev/sdb: dco 234441648 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST9500420AS, S/N:5VJ08QZR, FW:0002SDM1
Disk /dev/sdb - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - ST9120823AS, S/N:5NJ054VR, FW:3.BHC
Disk /dev/sdc - 1027 MB / 979 MiB - CHS 1011 32 62, sector size=512 - SanDisk U3 Cruzer Micro, FW:3.21
Disk /dev/mmcblk0 - 2032 MB / 1938 MiB - CHS 62032 4 16, sector size=512
Partition table type (auto): Intel
Disk /dev/sda - 500 GB / 465 GiB - ST9500420AS
Partition table type: None
Interface Advanced
P Unknown 0 0 1 60801 80 63 976773168
Change partition type:
P Unknown 0 0 1 60801 80 63 976773168
Incomplete image created.
New options :
Dump : No
Align partition: Yes
Expert mode : Yes
Analyse Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Current partition structure:
P Unknown 0 0 1 60801 80 63 976773168
search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/1/1
filesystem size 192705
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 0 1 1 11 254 51 192705 [System Reserved]
NTFS, blocksize=4096, 98 MB / 94 MiB
NTFS at 11/254/63
filesystem size 192705
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 11 254 63 23 253 50 192705
NTFS, blocksize=4096, 98 MB / 94 MiB
LVM magic value at 84/126/34
HFS magic value at 511/114/34
part_size 1743170382
HFS 511 114 34 109018 200 42 1743170382 [Ìg]
HFS, 892 GB / 831 GiB
This partition ends after the disk limits. (start=8216430, size=1743170382, end=1751386811, disk end=976773168)
HFS magic value at 670/38/9
part_size 8388610
HFS 670 38 9 1192 80 42 8388610 [ÿÿÿºD]
HFS, 4294 MB / 4096 MiB
check_FAT: Bad jump in FAT partition
recover_EXT2: s_block_group_nr=0/16, s_mnt_count=4/20, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 524288
recover_EXT2: part_size 4194304
ext2 1453 153 49 1714 175 1 4194304 [Data]
ext2 blocksize=4096 Sparse superblock, 2147 MB / 2048 MiB
FAT12 at 1868/216/12
FAT1 : 1-8
FAT2 : 9-16
start_rootdir : 17
Data : 49-20736
sectors : 20739
cluster_size : 8
no_of_cluster : 2586 (2 - 2587)
fat_length 8 calculated 8
FAT differs, FAT sectors=0-8/8
heads/cylinder 4 (FAT) != 255 (HD)
sect/track 17 (FAT) != 63 (HD)
FAT12 at 1868/216/12
FAT12 1868 216 12 1870 35 23 20739 [NO NAME]
FAT12, blocksize=4096, 10 MB / 10 MiB
cramfs Marker at 2093/185/50
recover_cramfs
CramFS 2093 185 50 2179 33 19 1371983 [GW¹¤Ø«Ý½Í(bdSÜ]
cramfs, 702 MB / 669 MiB
LVM magic value at 2342/228/37
NTFS at 2728/182/51
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 2728 182 51 2729 25 50 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
LVM magic value at 2743/23/13
check_FAT: Bad number of sectors per cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 2913/11/63
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 34-11517
sectors : 11520
cluster_size : 4
no_of_cluster : 2871 (2 - 2872)
fat_length 9 calculated 9
heads/cylinder 4 (FAT) != 255 (HD)
sect/track 36 (FAT) != 63 (HD)
FAT12 at 2913/11/63
FAT12 2913 11 63 2913 194 53 11520
FAT12, blocksize=2048, 5898 KB / 5760 KiB
HFS magic value at 4147/203/48
part_size 2598944898
HFS 4147 203 48 165924 162 23 2598944898
HFS, 1330 GB / 1239 GiB
This partition ends after the disk limits. (start=66634391, size=2598944898, end=2665579288, disk end=976773168)
recover_EXT2: s_block_group_nr=0/20, s_mnt_count=1/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
ext3 4582 105 24 4603 81 42 335872 [root]
ext3 blocksize=1024 Sparse superblock, 171 MB / 164 MiB
LVM magic value at 4627/234/6
LVM magic value at 4627/234/11
FAT32 at 5005/41/35
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 5005/41/36
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 5005/41/36
FAT12 5005 41 36 5005 87 17 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB
recover_EXT2: s_block_group_nr=0/10, s_mnt_count=2/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
ext3 5006 212 43 5017 203 22 176128 [root]
ext3 blocksize=1024 Sparse superblock, 90 MB / 86 MiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 5509/36/52
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 5509/36/52
FAT12 5509 36 52 5509 82 33 2880 [EFISECTOR]
FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT32 at 5646/63/16
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 5646/63/17
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 5646/63/17
FAT12 5646 63 17 5646 108 61 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB
NTFS at 5742/116/27
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 5742 116 27 5742 214 26 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
FAT32 at 5766/23/40
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 5766/23/41
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 5766/23/41
FAT12 5766 23 41 5766 69 22 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB
LVM magic value at 6340/132/53
LVM magic value at 6340/132/55
LVM magic value at 6340/132/56
LVM magic value at 6340/133/14
NTFS at 6523/99/21
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 6523 99 21 6523 197 20 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 7052/232/17
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 7052/232/17
FAT12 7052 232 17 7053 22 61 2880 [EFISECTOR]
FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT32 at 7217/208/14
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 7217/208/15
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 7217/208/15
FAT12 7217 208 15 7217 253 59 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB
exFAT 7275 82 49 7275 82 48 0
exFAT, 0 B
Partition not added.
NTFS at 7905/165/25
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 7905 165 25 7906 8 24 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
FAT12 at 8836/123/16
FAT1 : 1-8
FAT2 : 9-16
start_rootdir : 17
Data : 49-20736
sectors : 20739
cluster_size : 8
no_of_cluster : 2586 (2 - 2587)
fat_length 8 calculated 8
FAT differs, FAT sectors=0-8/8
heads/cylinder 4 (FAT) != 255 (HD)
sect/track 17 (FAT) != 63 (HD)
FAT12 at 8836/123/16
FAT12 8836 123 16 8837 197 27 20739 [NO NAME]
FAT12, blocksize=4096, 10 MB / 10 MiB
check_FAT: Bad jump in FAT partition
LVM magic value at 9370/246/1
NTFS at 11069/55/39
filesystem size 337204337
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 11069 55 39 32059 55 25 337204337
NTFS, blocksize=4096, 172 GB / 160 GiB
cramfs Marker at 37343/246/31
recover_cramfs
CramFS 37343 246 31 37520 150 45 2837471 [?YËΡh¾ ;ËÇé]
cramfs, 1452 MB / 1385 MiB
check_FAT: Bad jump in FAT partition
HFS magic value at 55243/27/19
part_size 2399049246
HFS 55243 27 19 204577 4 3 2399049246 [B>*´ÉN)#ÚÓE©öøuÙ´î;u£]
HFS, 1228 GB / 1143 GiB
This partition ends after the disk limits. (start=887480514, size=2399049246, end=3286529759, disk end=976773168)
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 1682 GB / 1567 GiB)
The following partitions can't be recovered:
HFS 511 114 34 109018 200 42 1743170382 [Ìg]
HFS, 892 GB / 831 GiB
HFS 4147 203 48 165924 162 23 2598944898
HFS, 1330 GB / 1239 GiB
HFS 55243 27 19 204577 4 3 2399049246 [B>*´ÉN)#ÚÓE©öøuÙ´î;u£]
HFS, 1228 GB / 1143 GiB
Results
P NTFS 0 1 1 11 254 51 192705 [System Reserved]
NTFS, blocksize=4096, 98 MB / 94 MiB
P NTFS 11 254 63 23 253 50 192705
NTFS, blocksize=4096, 98 MB / 94 MiB
P HFS 670 38 9 1192 80 42 8388610 [ÿÿÿºD]
HFS, 4294 MB / 4096 MiB
P ext2 1453 153 49 1714 175 1 4194304 [Data]
ext2 blocksize=4096 Sparse superblock, 2147 MB / 2048 MiB
P FAT12 1868 216 12 1870 35 23 20739 [NO NAME]
FAT12, blocksize=4096, 10 MB / 10 MiB
P CramFS 2093 185 50 2179 33 19 1371984 [GW¹¤Ø«Ý½Í(bdSÜ]
cramfs, 702 MB / 669 MiB
P NTFS 2728 182 51 2729 25 50 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
P FAT12 2913 11 63 2913 194 53 11520
FAT12, blocksize=2048, 5898 KB / 5760 KiB
P ext3 4582 105 24 4603 81 42 335872 [root]
ext3 blocksize=1024 Sparse superblock, 171 MB / 164 MiB
P FAT12 5005 41 36 5005 87 17 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB
P ext3 5006 212 43 5017 203 22 176128 [root]
ext3 blocksize=1024 Sparse superblock, 90 MB / 86 MiB
P FAT12 5509 36 52 5509 82 33 2880 [EFISECTOR]
FAT12, blocksize=512, 1474 KB / 1440 KiB
P FAT12 5646 63 17 5646 108 61 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB
P NTFS 5742 116 27 5742 214 26 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
P FAT12 5766 23 41 5766 69 22 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB
P NTFS 6523 99 21 6523 197 20 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
P FAT12 7052 232 17 7053 22 61 2880 [EFISECTOR]
FAT12, blocksize=512, 1474 KB / 1440 KiB
P FAT12 7217 208 15 7217 253 59 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB
P NTFS 7905 165 25 7906 8 24 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
P FAT12 8836 123 16 8837 197 27 20739 [NO NAME]
FAT12, blocksize=4096, 10 MB / 10 MiB
P NTFS 11069 55 39 32059 55 25 337204337
NTFS, blocksize=4096, 172 GB / 160 GiB
P CramFS 37343 246 31 37520 150 45 2837472 [?YËΡh¾ ;ËÇé]
cramfs, 1452 MB / 1385 MiB
P ext2 1453 153 49 1714 175 1 4194304 [Data]
ext2 blocksize=4096 Sparse superblock, 2147 MB / 2048 MiB
Can't open filesystem. Filesystem seems damaged.
dir_partition inode=0
P FAT12 1868 216 12 1870 35 23 20739 [NO NAME]
FAT12, blocksize=4096, 10 MB / 10 MiB
Directory /
3723 -rwxr-xr-x 0 0 16541059 12-Jul-2003 06:12 À}ë.&
1535 -rwxr-xr-x 0 0 3091564808 31-Dec-1933 10:40 èI÷ÿuð.é
dir_partition inode=2
P ext3 4582 105 24 4603 81 42 335872 [root]
ext3 blocksize=1024 Sparse superblock, 171 MB / 164 MiB
Directory /
2 drwxr-xr-x 1000 1000 1024 27-Mar-2012 10:38 .
2 drwxr-xr-x 1000 1000 1024 27-Mar-2012 10:38 ..
11 drwx------ 0 0 12288 27-Mar-2012 10:38 lost+found
34001 drwxr-xr-x 1000 1000 1024 27-Mar-2012 10:38 android
interface_write()
P NTFS 0 1 1 11 254 51 192705 [System Reserved]
P NTFS 11 254 63 23 253 50 192705
P HFS 670 38 9 1192 80 42 8388610 [ÿÿÿºD]
P ext2 1453 153 49 1714 175 1 4194304 [Data]
P FAT12 1868 216 12 1870 35 23 20739 [NO NAME]
P CramFS 2093 185 50 2179 33 19 1371984 [GW¹¤Ø«Ý½Í(bdSÜ]
P NTFS 2728 182 51 2729 25 50 6174 [Boot]
P FAT12 2913 11 63 2913 194 53 11520
P ext3 4582 105 24 4603 81 42 335872 [root]
P FAT12 5005 41 36 5005 87 17 2880 [NO NAME]
P ext3 5006 212 43 5017 203 22 176128 [root]
P FAT12 5509 36 52 5509 82 33 2880 [EFISECTOR]
P FAT12 5646 63 17 5646 108 61 2880 [NO NAME]
P NTFS 5742 116 27 5742 214 26 6174 [Boot]
P FAT12 5766 23 41 5766 69 22 2880 [NO NAME]
P NTFS 6523 99 21 6523 197 20 6174 [Boot]
P FAT12 7052 232 17 7053 22 61 2880 [EFISECTOR]
P FAT12 7217 208 15 7217 253 59 2880 [NO NAME]
P NTFS 7905 165 25 7906 8 24 6174 [Boot]
P FAT12 8836 123 16 8837 197 27 20739 [NO NAME]
P NTFS 11069 55 39 32059 55 25 337204337
P CramFS 37343 246 31 37520 150 45 2837472 [?YËΡh¾ ;ËÇé]
Write isn't available because the partition table type "None" has been selected.
search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/1/1
filesystem size 192705
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=32256, part_size=98664960, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/1/1
filesystem size 192705
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 0 1 1 11 254 51 192705 [System Reserved]
NTFS, blocksize=4096, 98 MB / 94 MiB
NTFS at 0/6/22
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=204288, part_size=104857600, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/6/22
filesystem size 204800
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 0 6 22 12 197 8 204800
NTFS, blocksize=4096, 104 MB / 100 MiB
FAT32 at 3/60/59
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 3/60/60
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 3/60/60
FAT12 3 60 60 3 106 41 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT32 at 10/33/25
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 10/33/26
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 10/33/26
FAT12 10 33 26 10 79 7 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB
NTFS at 11/254/63
filesystem size 192705
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 0 1 13 11 254 63 192705
NTFS found using backup sector, blocksize=4096, 98 MB / 94 MiB
NTFS at 11/254/63
filesystem size 192705
sectors_per_cluster 8
mft_lcn 8533
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 11 254 63 23 253 50 192705
NTFS, blocksize=4096, 98 MB / 94 MiB
NTFS at 12/0/1
filesystem size 337204337
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=98703360, part_size=172648620544, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 12/0/1
filesystem size 337204337
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 12 0 1 21001 254 50 337204337
NTFS, blocksize=4096, 172 GB / 160 GiB
LVM magic value at 84/126/34
HFS magic value at 511/114/34
part_size 1743170382
HFS 511 114 34 109018 200 42 1743170382 [Ìg]
HFS, 892 GB / 831 GiB
This partition ends after the disk limits. (start=8216430, size=1743170382, end=1751386811, disk end=976773168)
HFS magic value at 511/114/36
HFS magic value at 670/38/9
part_size 8388610
HFS 670 38 9 1192 80 42 8388610 [ÿÿÿºD]
HFS, 4294 MB / 4096 MiB
HFS magic value at 670/38/11
part_size 8388610
HFS 147 250 42 670 38 12 8388610 [ÿÿÿºD]
HFS found using backup sector!, 4294 MB / 4096 MiB
LVM magic value at 866/109/7
LVM magic value at 868/188/23
FAT32 at 929/207/61
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 929/207/62
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 929/207/62
FAT12 929 207 62 929 253 43 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB
HFS magic value at 980/186/14
part_size 3468776067
HFS 980 186 14 216902 13 49 3468776067 [{CD$ØÊi á]
HFS, 1776 GB / 1654 GiB
This partition ends after the disk limits. (start=15755431, size=3468776067, end=3484531497, disk end=976773168)
HFS magic value at 980/186/16
LVM magic value at 985/148/61
check_FAT: Bad jump in FAT partition
recover_EXT2: s_block_group_nr=0/16, s_mnt_count=4/20, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 524288
recover_EXT2: part_size 4194304
ext2 1453 153 49 1714 175 1 4194304 [Data]
ext2 blocksize=4096 Sparse superblock, 2147 MB / 2048 MiB
recover_EXT2: s_block_group_nr=0/16, s_mnt_count=0/20, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 524288
recover_EXT2: part_size 4194304
ext2 1453 224 54 1714 246 6 4194304 [Data]
ext2 blocksize=4096 Sparse superblock, 2147 MB / 2048 MiB
recover_EXT2: s_block_group_nr=0/16, s_mnt_count=0/20, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 524288
recover_EXT2: part_size 4194304
ext2 1454 112 5 1715 133 20 4194304 [Data]
ext2 blocksize=4096 Sparse superblock, 2147 MB / 2048 MiB
recover_EXT2: s_block_group_nr=0/16, s_mnt_count=0/20, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 524288
recover_EXT2: part_size 4194304
ext2 1460 207 30 1721 228 45 4194304 [Data]
ext2 blocksize=4096 Sparse superblock, 2147 MB / 2048 MiB
recover_EXT2: s_block_group_nr=0/16, s_mnt_count=0/20, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 524288
recover_EXT2: part_size 4194304
ext2 1461 157 43 1722 178 58 4194304 [Data]
ext2 blocksize=4096 Sparse superblock, 2147 MB / 2048 MiB
recover_EXT2: s_block_group_nr=0/16, s_mnt_count=0/20, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 524288
recover_EXT2: part_size 4194304
ext2 1462 48 61 1723 70 13 4194304 [Data]
ext2 blocksize=4096 Sparse superblock, 2147 MB / 2048 MiB
FAT32 at 1533/153/9
FAT1 : 6-4094
FAT2 : 4095-8183
start_rootdir : 8184 root cluster : 2
Data : 8184-4194303
sectors : 4194304
cluster_size : 8
no_of_cluster : 523265 (2 - 523266)
fat_length 4089 calculated 4089
FAT32 at 1533/153/9
FAT32 1533 153 9 1794 174 24 4194304 [SDCard]
FAT32, blocksize=4096, 2147 MB / 2048 MiB
FAT32 at 1533/153/12
FAT1 : 6-4094
FAT2 : 4095-8183
start_rootdir : 8184 root cluster : 2
Data : 8184-4194303
sectors : 4194304
cluster_size : 8
no_of_cluster : 523265 (2 - 523266)
fat_length 4089 calculated 4089
set_FAT_info: name from BS used
FAT32 at 1533/153/12
FAT32 1533 153 12 1794 174 27 4194304 [SDCard]
FAT32, blocksize=4096, 2147 MB / 2048 MiB
FAT12 at 1868/216/12
FAT1 : 1-8
FAT2 : 9-16
start_rootdir : 17
Data : 49-20736
sectors : 20739
cluster_size : 8
no_of_cluster : 2586 (2 - 2587)
fat_length 8 calculated 8
FAT differs, FAT sectors=0-8/8
heads/cylinder 4 (FAT) != 255 (HD)
sect/track 17 (FAT) != 63 (HD)
FAT12 at 1868/216/12
FAT12 1868 216 12 1870 35 23 20739 [NO NAME]
FAT12, blocksize=4096, 10 MB / 10 MiB
check_FAT: Unusual, only one FAT
FAT32 at 1868/216/13
check_FAT: Bad number of entries in root dir
cramfs Marker at 2093/185/50
recover_cramfs
CramFS 2093 185 50 2179 33 19 1371983 [GW¹¤Ø«Ý½Í(bdSÜ]
cramfs, 702 MB / 669 MiB
LVM magic value at 2342/228/37
NTFS at 2728/182/51
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 2728 84 52 2728 182 51 6174
NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 2728/182/51
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 2728 182 51 2729 25 50 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
LVM magic value at 2743/23/13
check_FAT: Bad number of sectors per cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 2913/11/63
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 34-11517
sectors : 11520
cluster_size : 4
no_of_cluster : 2871 (2 - 2872)
fat_length 9 calculated 9
heads/cylinder 4 (FAT) != 255 (HD)
sect/track 36 (FAT) != 63 (HD)
FAT12 at 2913/11/63
FAT12 2913 11 63 2913 194 53 11520
FAT12, blocksize=2048, 5898 KB / 5760 KiB
HFS magic value at 4147/203/48
part_size 2598944898
HFS 4147 203 48 165924 162 23 2598944898
HFS, 1330 GB / 1239 GiB
This partition ends after the disk limits. (start=66634391, size=2598944898, end=2665579288, disk end=976773168)
HFS magic value at 4147/203/50
recover_EXT2: s_block_group_nr=0/20, s_mnt_count=1/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
ext3 4582 105 24 4603 81 42 335872 [root]
ext3 blocksize=1024 Sparse superblock, 171 MB / 164 MiB
block_group_nr 1
recover_EXT2: "e2fsck -b 8193 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=1/20, s_mnt_count=0/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
ext3 4582 105 22 4603 81 40 335872 [root]
ext3 blocksize=1024 Sparse superblock Backup superblock, 171 MB / 164 MiB
block_group_nr 1
recover_EXT2: "e2fsck -b 8193 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=1/20, s_mnt_count=0/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
ext3 4582 105 24 4603 81 42 335872 [root]
ext3 blocksize=1024 Sparse superblock Backup superblock, 171 MB / 164 MiB
block_group_nr 3
recover_EXT2: "e2fsck -b 24577 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=3/20, s_mnt_count=0/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
ext3 4582 105 22 4603 81 40 335872 [root]
ext3 blocksize=1024 Sparse superblock Backup superblock, 171 MB / 164 MiB
block_group_nr 3
recover_EXT2: "e2fsck -b 24577 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=3/20, s_mnt_count=0/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
ext3 4582 105 24 4603 81 42 335872 [root]
ext3 blocksize=1024 Sparse superblock Backup superblock, 171 MB / 164 MiB
block_group_nr 5
recover_EXT2: "e2fsck -b 40961 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=5/20, s_mnt_count=0/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
ext3 4582 105 22 4603 81 40 335872 [root]
ext3 blocksize=1024 Sparse superblock Backup superblock, 171 MB / 164 MiB
block_group_nr 5
recover_EXT2: "e2fsck -b 40961 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=5/20, s_mnt_count=0/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
ext3 4582 105 24 4603 81 42 335872 [root]
ext3 blocksize=1024 Sparse superblock Backup superblock, 171 MB / 164 MiB
block_group_nr 7
recover_EXT2: "e2fsck -b 57345 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=7/20, s_mnt_count=0/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
ext3 4582 105 22 4603 81 40 335872 [root]
ext3 blocksize=1024 Sparse superblock Backup superblock, 171 MB / 164 MiB
block_group_nr 7
recover_EXT2: "e2fsck -b 57345 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=7/20, s_mnt_count=0/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
ext3 4582 105 24 4603 81 42 335872 [root]
ext3 blocksize=1024 Sparse superblock Backup superblock, 171 MB / 164 MiB
block_group_nr 9
recover_EXT2: "e2fsck -b 73729 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=9/20, s_mnt_count=0/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
ext3 4582 105 22 4603 81 40 335872 [root]
ext3 blocksize=1024 Sparse superblock Backup superblock, 171 MB / 164 MiB
block_group_nr 9
recover_EXT2: "e2fsck -b 73729 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=9/20, s_mnt_count=0/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
ext3 4582 105 24 4603 81 42 335872 [root]
ext3 blocksize=1024 Sparse superblock Backup superblock, 171 MB / 164 MiB
LVM magic value at 4627/234/6
LVM magic value at 4627/234/11
FAT32 at 5005/41/35
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 5005/41/36
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 5005/41/36
FAT12 5005 41 36 5005 87 17 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB
recover_EXT2: s_block_group_nr=0/10, s_mnt_count=2/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
ext3 5006 212 43 5017 203 22 176128 [root]
ext3 blocksize=1024 Sparse superblock, 90 MB / 86 MiB
block_group_nr 1
recover_EXT2: "e2fsck -b 8193 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=1/10, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
ext3 5006 212 41 5017 203 20 176128 [root]
ext3 blocksize=1024 Sparse superblock Backup superblock, 90 MB / 86 MiB
block_group_nr 1
recover_EXT2: "e2fsck -b 8193 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=1/10, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
ext3 5006 212 43 5017 203 22 176128 [root]
ext3 blocksize=1024 Sparse superblock Backup superblock, 90 MB / 86 MiB
block_group_nr 3
recover_EXT2: "e2fsck -b 24577 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=3/10, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
ext3 5006 212 41 5017 203 20 176128 [root]
ext3 blocksize=1024 Sparse superblock Backup superblock, 90 MB / 86 MiB
block_group_nr 3
recover_EXT2: "e2fsck -b 24577 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=3/10, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
ext3 5006 212 43 5017 203 22 176128 [root]
ext3 blocksize=1024 Sparse superblock Backup superblock, 90 MB / 86 MiB
block_group_nr 5
recover_EXT2: "e2fsck -b 40961 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=5/10, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
ext3 5006 212 41 5017 203 20 176128 [root]
ext3 blocksize=1024 Sparse superblock Backup superblock, 90 MB / 86 MiB
block_group_nr 5
recover_EXT2: "e2fsck -b 40961 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=5/10, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
ext3 5006 212 43 5017 203 22 176128 [root]
ext3 blocksize=1024 Sparse superblock Backup superblock, 90 MB / 86 MiB
block_group_nr 7
recover_EXT2: "e2fsck -b 57345 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=7/10, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
ext3 5006 212 41 5017 203 20 176128 [root]
ext3 blocksize=1024 Sparse superblock Backup superblock, 90 MB / 86 MiB
block_group_nr 7
recover_EXT2: "e2fsck -b 57345 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=7/10, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
ext3 5006 212 43 5017 203 22 176128 [root]
ext3 blocksize=1024 Sparse superblock Backup superblock, 90 MB / 86 MiB
block_group_nr 9
recover_EXT2: "e2fsck -b 73729 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=9/10, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
ext3 5006 212 41 5017 203 20 176128 [root]
ext3 blocksize=1024 Sparse superblock Backup superblock, 90 MB / 86 MiB
block_group_nr 9
recover_EXT2: "e2fsck -b 73729 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=9/10, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
ext3 5006 212 43 5017 203 22 176128 [root]
ext3 blocksize=1024 Sparse superblock Backup superblock, 90 MB / 86 MiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 5509/36/52
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 5509/36/52
FAT12 5509 36 52 5509 82 33 2880 [EFISECTOR]
FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT32 at 5646/63/16
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 5646/63/17
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 5646/63/17
FAT12 5646 63 17 5646 108 61 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB
NTFS at 5742/116/27
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 5742 18 28 5742 116 27 6174
NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 5742/116/27
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 5742 116 27 5742 214 26 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
FAT32 at 5766/23/40
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 5766/23/41
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 5766/23/41
FAT12 5766 23 41 5766 69 22 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB
LVM magic value at 6340/132/53
LVM magic value at 6340/132/55
LVM magic value at 6340/132/56
LVM magic value at 6340/133/14
NTFS at 6523/99/21
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 6523 1 22 6523 99 21 6174
NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 6523/99/21
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 6523 99 21 6523 197 20 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 7052/232/17
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 7052/232/17
FAT12 7052 232 17 7053 22 61 2880 [EFISECTOR]
FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT32 at 7217/208/14
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 7217/208/15
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 7217/208/15
FAT12 7217 208 15 7217 253 59 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB
exFAT 7275 82 49 7275 82 48 0
exFAT, 0 B
Partition not added.
NTFS at 7905/165/25
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 7905 67 26 7905 165 25 6174
NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 7905/165/25
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 7905 165 25 7906 8 24 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
FAT12 at 8836/123/16
FAT1 : 1-8
FAT2 : 9-16
start_rootdir : 17
Data : 49-20736
sectors : 20739
cluster_size : 8
no_of_cluster : 2586 (2 - 2587)
fat_length 8 calculated 8
FAT differs, FAT sectors=0-8/8
heads/cylinder 4 (FAT) != 255 (HD)
sect/track 17 (FAT) != 63 (HD)
FAT12 at 8836/123/16
FAT12 8836 123 16 8837 197 27 20739 [NO NAME]
FAT12, blocksize=4096, 10 MB / 10 MiB
check_FAT: Unusual, only one FAT
FAT32 at 8836/123/17
check_FAT: Bad number of entries in root dir
check_FAT: Bad jump in FAT partition
LVM magic value at 9370/246/1
NTFS at 11069/55/39
filesystem size 337204337
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS part_offset=91047417856, part_size=172648620544, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 11069/55/39
filesystem size 337204337
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS 11069 55 39 32059 55 25 337204337
NTFS, blocksize=4096, 172 GB / 160 GiB
HFS magic value at 12061/135/45
part_size 1637482498
HFS 12061 135 45 113990 26 24 1637482498 [ ´R²,K!¹çº¶m&!"JDDDDH!]
HFS, 838 GB / 780 GiB
This partition ends after the disk limits. (start=193768514, size=1637482498, end=1831251011, disk end=976773168)
HFS magic value at 12061/135/47
HFS magic value at 15260/107/13
part_size 515
HFS 15260 107 13 15260 115 23 515
HFS, 263 KB / 257 KiB
HFS magic value at 15260/107/15
part_size 515
HFS 15260 99 6 15260 107 16 515
HFS found using backup sector!, 263 KB / 257 KiB
FAT32 at 15559/177/57
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 15559/177/58
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 15559/177/58
FAT12 15559 177 58 15559 223 39 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB
LVM magic value at 16306/212/39
LVM magic value at 16567/237/38
NTFS at 16766/104/55
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 16766 6 56 16766 104 55 6174
NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 16766/104/55
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size 6174
sectors_per_cluster 1
mft_lcn 2058
mftmirr_lcn 5162
clusters_per_mft_record 2
clusters_per_index_record 8
NTFS 16766 104 55 16766 202 54 6174 [Boot]
NTFS, blocksize=512, 3161 KB / 3087 KiB
FAT32 at 16839/48/48
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 16839/48/49
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
FAT12 at 16839/48/49
FAT12 16839 48 49 16839 94 30 2880 [NO NAME]
FAT12, blocksize=512, 1474 KB / 1440 KiB
NTFS at 21001/254/63
filesystem size 337204337
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_Output of: grep -a -b -P --only-matching 'LUKS\xba\xbe' /dev/sda
I'm not really sure what what it supposed to tell me, I was just trying to follow instructions in another forum and thought it might be helpful in some way.
root@PartedMagic:~# grep -a -b -P --only-matching 'LUKS\xba\xbe' /dev/sda
8241433522:LUKS
8241438505:LUKS
44127246268:LUKS
53544942034:LUKS
53544947017:LUKS
grep: memory exhaustedGparted (if it helps)
Anyway, I'm really not sure where to go from here. I have a feeling my data is pretty much just gone, but I thought it would be good to see if anyone knows how to proceed from here. Thanks!
I was following:
https://wiki.archlinuax.org/index.php/D … _with_LUKS
https://wiki.archlinux.org/index.php/LVM
https://wiki.archlinux.org/index.php/Beginners%27_Guide
http://lifehacker.com/5680453/build-a-k … he-process
A couple of the forums/pages I've looked to for help include:
http://code.google.com/p/cryptsetup/wik … leshooting
http://ubuntuforums.org/showthread.php?t=1643334
Offline
#2 2012-10-21 14:12:33
- Strike0
- Member
- From: Germany
- Registered: 2011-09-05
- Posts: 1,489
Re: Recover Data - Accidentally formatted Luks Partition
Welcome to the forums here. Sorry to read about your mishap. You don't write exactly how you accidently reformatted the partition (which command you used is important to determine a way forward). I don't know too if you "grep" results reveal something. You have to look at the sectors to see whether those instances of "LUKS" contain other relevant bytes suggesting the header is there (how to do that is described in your linked Ubuntu thread).
Another relevant thread to read for you is: http://www.saout.de/pipermail/dm-crypt/ … 02724.html
It will give you further hints on what to look for to identify the header and also contains links to the relevant cryptsetup FAQ items. Good luck.
Offline
#3 2012-10-22 22:51:38
- thewooster
- Member
- Registered: 2012-10-20
- Posts: 57
Re: Recover Data - Accidentally formatted Luks Partition
Thank you for the reply. I read through that thread, and it was helpful, but unfortunately I am still at a loss.
I cannot remember exactly what I did, or how I formatted my partition (I know that does not help much). It was a couple of months ago, and I was rather busy at the time, so rather than risk messing with something I just let it set until I had time to work on it (the data is not something I need right away, but could need in the future, old college papers etc . . .).
Basically, after an update I could not get arch to boot. I would try to enter my password, and I cannot remember the exact error. I have been googling quite a bit to see if I could find the exact method I used, but I cannot remember. I think the error was something to do with "no lvm volume found," or something of that sort. I know I did end up messing with "vgchange," but I cannot remember exactly what I did. Since I was having trouble getting the device to open I tried changing the volume name to "/dev/mapper/root."
It is possible that I only changed the volume name, but I may have gone in with a gparted and tried to recreate the volume afterwards (be deleting that partition and recreating it. I don't think I would have done something that dumb, but I was quite tired). if that was the case, would the data simply be gone, or is it still possible it could be retrieved?
I'm going to keeping googling and see if I can remember exactly what I did, but if I can't, is there anything else I can do?
cryptsetup luksDump /dev/sda3 output = nothing.
hd /dev/sda3 | less
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00001000 c6 92 f8 24 20 4c 56 4d 32 20 78 5b 35 41 25 72 |...$ LVM2 x[5A%r|
00001010 30 4e 2a 3e 01 00 00 00 00 10 00 00 00 00 00 00 |0N*>............|
00001020 00 f0 02 00 00 00 00 00 00 02 00 00 00 00 00 00 |................|
00001030 7e 02 00 00 00 00 00 00 cc 83 01 03 00 00 00 00 |~...............|
00001040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00001200 56 6f 6c 47 72 6f 75 70 30 30 20 7b 0a 69 64 20 |VolGroup00 {.id |
00001210 3d 20 22 47 64 7a 59 67 64 2d 6f 66 4d 36 2d 6e |= "GdzYgd-ofM6-n|
00001220 57 5a 46 2d 4f 67 50 4a 2d 79 72 62 4a 2d 4e 49 |WZF-OgPJ-yrbJ-NI|
00001230 75 7a 2d 4c 35 4a 76 5a 53 22 0a 73 65 71 6e 6f |uz-L5JvZS".seqno|
00001240 20 3d 20 31 0a 73 74 61 74 75 73 20 3d 20 5b 22 | = 1.status = ["|
00001250 52 45 53 49 5a 45 41 42 4c 45 22 2c 20 22 52 45 |RESIZEABLE", "RE|
00001260 41 44 22 2c 20 22 57 52 49 54 45 22 5d 0a 66 6c |AD", "WRITE"].fl|
00001270 61 67 73 20 3d 20 5b 5d 0a 65 78 74 65 6e 74 5f |ags = [].extent_|
00001280 73 69 7a 65 20 3d 20 38 31 39 32 0a 6d 61 78 5f |size = 8192.max_|
00001290 6c 76 20 3d 20 30 0a 6d 61 78 5f 70 76 20 3d 20 |lv = 0.max_pv = |
000012a0 30 0a 0a 70 68 79 73 69 63 61 6c 5f 76 6f 6c 75 |0..physical_volu|
000012b0 6d 65 73 20 7b 0a 0a 70 76 30 20 7b 0a 69 64 20 |mes {..pv0 {.id |
000012c0 3d 20 22 4e 64 75 34 64 62 2d 34 73 30 54 2d 34 |= "Ndu4db-4s0T-4|
000012d0 38 56 59 2d 71 42 71 5a 2d 59 45 77 52 2d 32 62 |8VY-qBqZ-YEwR-2b|
000012e0 75 76 2d 66 38 52 72 48 39 22 0a 64 65 76 69 63 |uv-f8RrH9".devic|
000012f0 65 20 3d 20 22 2f 64 65 76 2f 73 64 61 33 22 0a |e = "/dev/sda3".|
00001300 0a 73 74 61 74 75 73 20 3d 20 5b 22 41 4c 4c 4f |.status = ["ALLO|
00001310 43 41 54 41 42 4c 45 22 5d 0a 66 6c 61 67 73 20 |CATABLE"].flags |
00001320 3d 20 5b 5d 0a 64 65 76 5f 73 69 7a 65 20 3d 20 |= [].dev_size = |
00001330 36 33 39 33 37 30 39 33 35 0a 70 65 5f 73 74 61 |639370935.pe_sta|
00001340 72 74 20 3d 20 33 38 34 0a 70 65 5f 63 6f 75 6e |rt = 384.pe_coun|
00001350 74 20 3d 20 37 38 30 34 38 0a 7d 0a 7d 0a 0a 7d |t = 78048.}.}..}|
00001360 0a 23 20 47 65 6e 65 72 61 74 65 64 20 62 79 20 |.# Generated by |
00001370 4c 56 4d 32 20 76 65 72 73 69 6f 6e 20 32 2e 30 |LVM2 version 2.0|
00001380 32 2e 35 34 28 31 29 20 28 32 30 30 39 2d 31 30 |2.54(1) (2009-10|
00001390 2d 32 36 29 3a 20 46 72 69 20 53 65 70 20 31 34 |-26): Fri Sep 14|
000013a0 20 31 36 3a 32 30 3a 30 30 20 32 30 31 32 0a 0a | 16:20:00 2012..|
000013b0 63 6f 6e 74 65 6e 74 73 20 3d 20 22 54 65 78 74 |contents = "Text|
000013c0 20 46 6f 72 6d 61 74 20 56 6f 6c 75 6d 65 20 47 | Format Volume G|
000013d0 72 6f 75 70 22 0a 76 65 72 73 69 6f 6e 20 3d 20 |roup".version = |
000013e0 31 0a 0a 64 65 73 63 72 69 70 74 69 6f 6e 20 3d |1..description =|
000013f0 20 22 22 0a 0a 63 72 65 61 74 69 6f 6e 5f 68 6f | ""..creation_ho|
00001400 73 74 20 3d 20 22 62 74 22 09 23 20 4c 69 6e 75 |st = "bt".# Linu|
00001410 78 20 62 74 20 33 2e 32 2e 36 20 23 31 20 53 4d |x bt 3.2.6 #1 SM|
00001420 50 20 46 72 69 20 46 65 62 20 31 37 20 31 30 3a |P Fri Feb 17 10:|
00001430 33 34 3a 32 30 20 45 53 54 20 32 30 31 32 20 78 |34:20 EST 2012 x|
00001440 38 36 5f 36 34 0a 63 72 65 61 74 69 6f 6e 5f 74 |86_64.creation_t|
00001450 69 6d 65 20 3d 20 31 33 34 37 36 35 34 30 30 30 |ime = 1347654000|
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00001000 c6 92 f8 24 20 4c 56 4d 32 20 78 5b 35 41 25 72 |...$ LVM2 x[5A%r|
00001010 30 4e 2a 3e 01 00 00 00 00 10 00 00 00 00 00 00 |0N*>............|
00001020 00 f0 02 00 00 00 00 00 00 02 00 00 00 00 00 00 |................|
00001030 7e 02 00 00 00 00 00 00 cc 83 01 03 00 00 00 00 |~...............|
00001040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00001200 56 6f 6c 47 72 6f 75 70 30 30 20 7b 0a 69 64 20 |VolGroup00 {.id |
00001210 3d 20 22 47 64 7a 59 67 64 2d 6f 66 4d 36 2d 6e |= "GdzYgd-ofM6-n|
00001220 57 5a 46 2d 4f 67 50 4a 2d 79 72 62 4a 2d 4e 49 |WZF-OgPJ-yrbJ-NI|
00001230 75 7a 2d 4c 35 4a 76 5a 53 22 0a 73 65 71 6e 6f |uz-L5JvZS".seqno|
00001240 20 3d 20 31 0a 73 74 61 74 75 73 20 3d 20 5b 22 | = 1.status = ["|
00001250 52 45 53 49 5a 45 41 42 4c 45 22 2c 20 22 52 45 |RESIZEABLE", "RE|
00001260 41 44 22 2c 20 22 57 52 49 54 45 22 5d 0a 66 6c |AD", "WRITE"].fl|
00001270 61 67 73 20 3d 20 5b 5d 0a 65 78 74 65 6e 74 5f |ags = [].extent_|
00001280 73 69 7a 65 20 3d 20 38 31 39 32 0a 6d 61 78 5f |size = 8192.max_|
00001290 6c 76 20 3d 20 30 0a 6d 61 78 5f 70 76 20 3d 20 |lv = 0.max_pv = |
000012a0 30 0a 0a 70 68 79 73 69 63 61 6c 5f 76 6f 6c 75 |0..physical_volu|
000012b0 6d 65 73 20 7b 0a 0a 70 76 30 20 7b 0a 69 64 20 |mes {..pv0 {.id |
000012c0 3d 20 22 4e 64 75 34 64 62 2d 34 73 30 54 2d 34 |= "Ndu4db-4s0T-4|
000012d0 38 56 59 2d 71 42 71 5a 2d 59 45 77 52 2d 32 62 |8VY-qBqZ-YEwR-2b|
000012e0 75 76 2d 66 38 52 72 48 39 22 0a 64 65 76 69 63 |uv-f8RrH9".devic|
000012f0 65 20 3d 20 22 2f 64 65 76 2f 73 64 61 33 22 0a |e = "/dev/sda3".|
00001300 0a 73 74 61 74 75 73 20 3d 20 5b 22 41 4c 4c 4f |.status = ["ALLO|
00001310 43 41 54 41 42 4c 45 22 5d 0a 66 6c 61 67 73 20 |CATABLE"].flags |
00001320 3d 20 5b 5d 0a 64 65 76 5f 73 69 7a 65 20 3d 20 |= [].dev_size = |
00001330 36 33 39 33 37 30 39 33 35 0a 70 65 5f 73 74 61 |639370935.pe_sta|
00001340 72 74 20 3d 20 33 38 34 0a 70 65 5f 63 6f 75 6e |rt = 384.pe_coun|
00001350 74 20 3d 20 37 38 30 34 38 0a 7d 0a 7d 0a 0a 7d |t = 78048.}.}..}|
00001360 0a 23 20 47 65 6e 65 72 61 74 65 64 20 62 79 20 |.# Generated by |
00001370 4c 56 4d 32 20 76 65 72 73 69 6f 6e 20 32 2e 30 |LVM2 version 2.0|
00001380 32 2e 35 34 28 31 29 20 28 32 30 30 39 2d 31 30 |2.54(1) (2009-10|
00001390 2d 32 36 29 3a 20 46 72 69 20 53 65 70 20 31 34 |-26): Fri Sep 14|
000013a0 20 31 36 3a 32 30 3a 30 30 20 32 30 31 32 0a 0a | 16:20:00 2012..|
000013b0 63 6f 6e 74 65 6e 74 73 20 3d 20 22 54 65 78 74 |contents = "Text|
000013c0 20 46 6f 72 6d 61 74 20 56 6f 6c 75 6d 65 20 47 | Format Volume G|
000013d0 72 6f 75 70 22 0a 76 65 72 73 69 6f 6e 20 3d 20 |roup".version = |
000013e0 31 0a 0a 64 65 73 63 72 69 70 74 69 6f 6e 20 3d |1..description =|
000013f0 20 22 22 0a 0a 63 72 65 61 74 69 6f 6e 5f 68 6f | ""..creation_ho|
00001400 73 74 20 3d 20 22 62 74 22 09 23 20 4c 69 6e 75 |st = "bt".# Linu|
00001410 78 20 62 74 20 33 2e 32 2e 36 20 23 31 20 53 4d |x bt 3.2.6 #1 SM|
00001420 50 20 46 72 69 20 46 65 62 20 31 37 20 31 30 3a |P Fri Feb 17 10:|
00001430 33 34 3a 32 30 20 45 53 54 20 32 30 31 32 20 78 |34:20 EST 2012 x|
00001440 38 36 5f 36 34 0a 63 72 65 61 74 69 6f 6e 5f 74 |86_64.creation_t|
00001450 69 6d 65 20 3d 20 31 33 34 37 36 35 34 30 30 30 |ime = 1347654000|
. . . etc . . . etc . . .hexdump -C -n 512 /dev/sda3 output
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000200A straight "hexdump -C /dev/sda3" just outputs tons of seemingly random data (I guess that would be the point of encryption." 
I didn't see anything that I could see as being helpful.
*edit*
I don't know why I would have done this, but I believe this may be similar to what I did.
Last edited by thewooster (2012-10-22 23:20:27)
Offline
#4 2012-10-23 20:07:02
- robug
- Member
- Registered: 2010-11-17
- Posts: 28
Re: Recover Data - Accidentally formatted Luks Partition
Did you tried any of these? https://wiki.archlinux.org/index.php/File_Recovery
Personally i like to use ddrescue, but you'll need extra space for recovered data (it should be able to contain the whole partition you want to recover).
On another note: I don't believe you lost your partition table - all other partitions seem unaffected (based on pics). That's a good start imho.
Deleting and recreating a partition could cause some trouble.
And be careful with writing data on that partition, you might overwrite something important that would cause decrypting to be impossible.
Did you do everything under X11 or can you actually provide something from bash history?
Godspeed.
Offline
#5 2012-10-23 20:50:49
- alphaniner
- Member
- From: Ancapistan
- Registered: 2010-07-12
- Posts: 2,810
Re: Recover Data - Accidentally formatted Luks Partition
One thing I'm curious about is the order of LVM and encryption. The hex dump shows LVM-related data, which suggests to me you were using 'luks over lvm' rather than 'lvm over luks'. If the former is true, you need to start by locating an LVM pv rather than luks headers or whatever.
But whether the Constitution really be one thing, or another, this much is certain - that it has either authorized such a government as we have had, or has been powerless to prevent it. In either case, it is unfit to exist.
-Lysander Spooner
Offline
#6 2012-10-24 21:59:02
- thewooster
- Member
- Registered: 2012-10-20
- Posts: 57
Re: Recover Data - Accidentally formatted Luks Partition
I wish I could remember more, I don't think I have much in the way of a bash history that would be helpful. I did some through command line and some through gparted.
However, I believe what I probably did was closer the the "luks on lvm" like you were saying. Except, now that I think about it, I'm not certain I originally used LVM at all. It is more likely that I did what you see on the second drive. I think I created an extended partition, and followed the archwiki guide to create a "standard" partition with luks. I guess I'm not completely sure if the filesystem itself is created first and then encrypted, or if the partition is encrypted and then the filesystem is encrypted?
So in as far as the original creation of the partition, I would have pretty closely followed the guide:
cryptsetup -c aes-xts-plain -y -s 512 luksFormat /dev/sda3
# cryptsetup luksOpen /dev/sda3 root
Enter any LUKS passphrase: <password>
key slot 0 unlocked.
Command successful.. . . and then continued via this guide.
Prepare hard drive for Arch Install Scripts
This assumes you want to install an encrypted system with the Arch Install Scripts, have created partitions for / (e.g. /dev/sdaX) and /boot (/dev/sdaY) at least, following the Installation Guide and deciding against using LVM. Prior to creating the partitions you have done a preparation of the disk for encryption according to your necessities (the necessary tools are on the installation-ISO).
First check, if the blockdevice mapper dm_mod is loaded with
# lsmod | grep mod
If one wants to use the default LUKS-cipher algorithm, there is no need to specify one for the luksFormat. At the time of writing the default is set to an AES variant with 256 bit key-length. With that a dm-crypt/LUKS blockdevice for the crypted root can be created
# cryptsetup -y -v luksFormat /dev/sdaX
opened
# cryptsetup luksOpen /dev/sdaX cryptroot
formatted with your desired filesystem
# mkfs -t ext4 /dev/mapper/cryptroot
and mounted
# mount -t ext4 /dev/mapper/cryptroot /mnt
At this point, just before installing the base system, it might be useful to check the mapping works as intended:
# umount /mnt
# cryptsetup luksClose cryptroot
and mount it again to check.
If you created a separate /home partition, the steps have to be adapted and repeated for that. What you do have to setup is a non-encrypted /boot partition, which is needed for a crypted root. For a standard MBR/non-EFI /boot partition that may be achieved by formatting
# mkfs -t ext2 /dev/sdaY
creating a mount-point for installation
# mkdir /mnt/boot
and mounting it
# mount -t ext2 /dev/sdaY /mnt/boot
That is basically what is necessary at this point before installing the base system with the Arch Install Scripts. Take care to install the bootloader to /mnt/boot with the pacstrap script. Additional configuration steps must be followed before booting the installed system.
Configure initramfs
One important point is to add the hooks relevant for your particular install in the correct order to /etc/mkinitcpio.conf. The one you have to add when encrypting the root filesystem is encrypt. A recommended hook for LUKS encrypted blockdevices is shutdown to ensure controlled unmounting during system shutdown. Others needed, e.g. keymap, should be clear from other manual steps you follow during the installation and further details in the following. For detailed information about mkinitcpio and its configuration refer to Mkinitcpio.
Note: The encrypt hook is only needed if your root partition is a LUKS partition (or a LUKS partition that needs to be mounted before root). The encrypt hook is not needed for any other encrypted partitions (swap, for example). System initialization scripts (/etc/rc.sysinit and /etc/crypttab among others) take care of those.
You have to make sure that your HOOKS array looks something like this:
etc/mkinitcpio.conf
HOOKS="... encrypt ... filesystems ..."
It is important that the encrypt hook comes before the filesystems hook. If you store your key on an external USB device (e.g. a USB stick), you need to add the USB hook too:
HOOKS="... usb encrypt ... filesystems ..."
For safety, add usb before encrypt because the hooks are run in the order they appear. If you need support for foreign keymaps for your encryption password, you have to specify the hook keymap as well. I suggest putting this in /etc/mkinitcpio.conf immediately before encrypt.
If you have a USB keyboard, you will need the usbinput hook in /etc/mkinitcpio.conf. Without it, no USB keyboard will work in early userspace.
If your root partition is a LUKS partition, add the used filesystem to the MODULES section.
MODULES="... ext3 ext4 xfs ..."
After you are done don't forget:
mkinitcpio -p linuxSo I would have ended up with an encrypted ext4 partition inside the extended partition, I believe. I'm not quite sure why I ended up messing with lvm at all. Though it does show up in my hexdump . . . Either way I've been able to uncover nothing helpful so far with basic file forensics programs such as Testdisk (https://wiki.archlinux.org/index.php/File_Recovery). Is there some way I can determine what my file system originally was, or is there something else I should do to try to restore it? I'm sorry I'm giving such vague information, I probably should have posted this much sooner. I'm getting the feeling my data may just be nuked XD.
Offline
#7 2012-10-25 01:51:57
- alphaniner
- Member
- From: Ancapistan
- Registered: 2010-07-12
- Posts: 2,810
Re: Recover Data - Accidentally formatted Luks Partition
Years ago, before I started using Linux, I got a BSOD when playing a game on Windows. The system wouldn't boot after that. I lost my cool and did some stuff that was "un-undoable" to no avail. After that failed, for whatever reason, I regained my cool and started doing things thoughtfully and deliberately. It turned out the problem was just a bad SATA cable, and I was able to save most of my data with a recovery tool. The recovery tool wouldn't have even been necessary if it weren't for the rash actions I took at the beginning. And presumably, the stuff I couldn't save was lost due to those same rash actions.
Your situation is clearly much more complicated, and will not be solved by simply swapping a cable. The point I'm trying to make is you need to stop assuming, guessing, etc. and focus on what you know. From my perspective, the only thing that's 'known' is that hexdump output you posted. It looks like you pasted the same information twice in that first code block, which had really had me scratching my head at first. That said, the output contains the following information:
Volume Group Name: VolGroup00
Device: /dev/sda3
Creation date: Friday Sept. 14 16:20:00 2012
Host: bt
(Created at exactly 4:20 PM ... hmm... )
Now, it's possible that that LVM metadata or whatever it's called could have been around for a while and is irrelevant to the state the partition was in when you nuked it. So the first question you have to answer is "Does that information sound right?
Actually, the first question you need to ask is "How badly do I want to retrieve this data?" There's no guarantee this will be easy, much less end successfully.
Also, just in case I've fooled you into believing I really know what I'm talking about: I don't. I'm just putting things together as I go along. Also, I've really only stuck around because I find this kind of problem intriguing for some reason. Otherwise, your uncertainty regarding... well, pretty much every aspect of the situation would have run me off before I'd finished reading the first post. With that in mind, I would advise you to gather your thoughts and start a thread on a general Linux forum. Be frank about what you know and don't know, but I would suggest not offering up anything that you're not certain of; more than anything else, it's likely to lead anyone who may try to help you down the wrong path.
Last edited by alphaniner (2012-10-25 01:56:06)
But whether the Constitution really be one thing, or another, this much is certain - that it has either authorized such a government as we have had, or has been powerless to prevent it. In either case, it is unfit to exist.
-Lysander Spooner
Offline
#8 2012-10-25 18:11:47
- Strike0
- Member
- From: Germany
- Registered: 2011-09-05
- Posts: 1,489
Re: Recover Data - Accidentally formatted Luks Partition
You never seemed to complete the grep for a LUKS header on the partition like you started in your first post, but that one did not finish (and the grep command aborted).
sudo hexdump -C /dev/sda3 |grep LUKS then look at the output blocks and the next block to determine whether there might be a LUKS header in place somewhere after the LVM header. There isn't one at the beginning of the partition (before LVM), thats what you have seen already unfortunately.
For the rest, I fully agree with alphaminer also as to how you should proceed - depending on how important that data is for you.
What you wrote in post #6 cannot really have happened, you must have setup the LVM before any cryptsetup. The Arch wiki bit you quote from was only added weeks after September 14 as well, so it's a wrong path. So one _might_ assume you had a LVM setup and inside setup encrypted partition(s) and then maybe changed something to the LVM (in Sept) that messed things? Pure guesswork.
Offline
#9 2012-10-30 18:31:14
- thewooster
- Member
- Registered: 2012-10-20
- Posts: 57
Re: Recover Data - Accidentally formatted Luks Partition
Ok, well thank you all for the time and effort you put into helping me. I know I didn't give you much to go on. I'll give it another try and keep looking. I realize I gave a lot of general information, and unclear questions. I'll keep all of the information you posted in mind and keep looking. I'll probably try a more data-recovery specific forum or general linux forum as suggested. I may end up cutting my losses and move on (would rather not, but I can live without the data). Thanks again, so far I've been very impressed with the Arch community and documentation. If I do end up figuring out what exactly the problem is/was and fixing it, I'll post that here. Thanks again guys! 
Offline
#10 2012-10-31 02:05:16
- cfr
- Member
- From: Cymru
- Registered: 2011-11-27
- Posts: 7,167
Re: Recover Data - Accidentally formatted Luks Partition
Maybe I've missed this, but has anybody clarified that you are working on a COPY of the partition rather than the original partition? As I understand it, that's almost always the recommended course - if you make something worse, you can always recopy the original data and start over.
CLI Paste | How To Ask Questions
Arch Linux | x86_64 | GPT | EFI boot | refind | stub loader | systemd | LVM2 on LUKS
Lenovo x270 | Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz | Intel Wireless 8265/8275 | US keyboard w/ Euro | 512G NVMe INTEL SSDPEKKF512G7L
Offline