You are not logged in.

#1 2012-10-20 20:26:15

thewooster
Member
Registered: 2012-10-20
Posts: 57

Recover Data - Accidentally formatted Luks Partition

Alright, so I am not new to linux (I have used Ubuntu since 6.10 or so and played around with various other distros for years), but I am new to arch.  I also am somewhat new to Luks. 

Basically,  I am multi-booting on two separate hard drives.  The first Hard drive has Windows 7 and Arch (well, had Arch).  Windows is completely unencrypted (I use it mostly just for gaming), but Arch was using full system encryption.  The second hard drive contained my boot information and a second linux distro also using lux.  That hard drive is completely intact. 

However, the partition on my first hard drive containing my Arch installation was accidentally formatted.  I have done quite a bit of reading in the arch forums, wiki, and other places, so if an answer has already been posted I apologize.  Anyway,  I am guessing the partition table was lost, and my system no longer recognizes the partition as a luks partition.  Is it possible the header is still intact, or that I can retrieve my data?  The data is fairly important to me, so I am willing to got to a certain amount of trouble to retrieve it.   It really should have been backed up, but of course I was stupid and did not do so.  I do have the master password.

I've also been running testdisk for quite some time, but to be honest I'm not completely sure what I'm looking for.  I will post the output of that as well.

And just to say it, so far the Arch community has been great and I've been quite impressed with the sheer amount of documentation available.  I'll just have to try not to screw with system encryption when I'm dead tired anymore . . . at least not without making backups XD. Yay noob mistakes?


Fdisk output:

Disk /dev/sda: 500.1 GB, 500107862016 bytes
255 heads, 63 sectors/track, 60801 cylinders, total 976773168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00024c51

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *          63      192779       96358+   7  HPFS/NTFS/exFAT
/dev/sda2          192780   337397129   168602175    7  HPFS/NTFS/exFAT
/dev/sda3       337397130   976768064   319685467+  83  Linux

Disk /dev/sdb: 120.0 GB, 120034123776 bytes
255 heads, 63 sectors/track, 14593 cylinders, total 234441648 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x000d9094

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1   *          63     1044224      522081   83  Linux
/dev/sdb2         1044225   234436544   116696160    5  Extended
/dev/sdb5         1044288   234436544   116696128+  83  Linux

Disk /dev/mmcblk0: 2032 MB, 2032664576 bytes
16 heads, 24 sectors/track, 10338 cylinders, total 3970048 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xa3a4f5ed

Testdisk Output:

Sat Oct 20 08:31:37 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, May 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.5.6-pmagic (#1 SMP Mon Oct 8 17:36:20 CDT 2012) i686
Compiler: GCC 4.7
Compilation date: 2012-05-30T19:32:33
ext2fs lib: 1.42.6, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       976773168 sectors
/dev/sda: user_max   976773168 sectors
/dev/sda: native_max 976773168 sectors
/dev/sda: dco        976773168 sectors
/dev/sdb: LBA, LBA48, DCO support
/dev/sdb: size       234441648 sectors
/dev/sdb: user_max   234441648 sectors
/dev/sdb: dco        234441648 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - ST9500420AS, S/N:5VJ08QZR, FW:0002SDM1
Disk /dev/sdb - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - ST9120823AS, S/N:5NJ054VR, FW:3.BHC
Disk /dev/sdc - 1027 MB / 979 MiB - CHS 1011 32 62, sector size=512 - SanDisk U3 Cruzer Micro, FW:3.21
Disk /dev/mmcblk0 - 2032 MB / 1938 MiB - CHS 62032 4 16, sector size=512

Partition table type (auto): Intel
Disk /dev/sda - 500 GB / 465 GiB - ST9500420AS
Partition table type: None

Interface Advanced
   P Unknown                  0   0  1 60801  80 63  976773168
Change partition type:
   P Unknown                  0   0  1 60801  80 63  976773168
Incomplete image created.
New options :
 Dump : No
 Align partition: Yes
 Expert mode : Yes

Analyse Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Current partition structure:
   P Unknown                  0   0  1 60801  80 63  976773168

search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/1/1
filesystem size           192705
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     NTFS                     0   1  1    11 254 51     192705 [System Reserved]
     NTFS, blocksize=4096, 98 MB / 94 MiB
NTFS at 11/254/63
filesystem size           192705
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     NTFS                    11 254 63    23 253 50     192705
     NTFS, blocksize=4096, 98 MB / 94 MiB

LVM magic value at 84/126/34

HFS magic value at 511/114/34
part_size 1743170382
     HFS                    511 114 34 109018 200 42 1743170382 [Ìg]
     HFS, 892 GB / 831 GiB
This partition ends after the disk limits. (start=8216430, size=1743170382, end=1751386811, disk end=976773168)

HFS magic value at 670/38/9
part_size 8388610
     HFS                    670  38  9  1192  80 42    8388610 [ÿÿÿºD]
     HFS, 4294 MB / 4096 MiB
check_FAT: Bad jump in FAT partition

recover_EXT2: s_block_group_nr=0/16, s_mnt_count=4/20, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 524288
recover_EXT2: part_size 4194304
     ext2                  1453 153 49  1714 175  1    4194304 [Data]
     ext2 blocksize=4096 Sparse superblock, 2147 MB / 2048 MiB
FAT12 at 1868/216/12
FAT1 : 1-8
FAT2 : 9-16
start_rootdir : 17
Data : 49-20736
sectors : 20739
cluster_size : 8
no_of_cluster : 2586 (2 - 2587)
fat_length 8 calculated 8
FAT differs, FAT sectors=0-8/8
heads/cylinder 4 (FAT) != 255 (HD)
sect/track 17 (FAT) != 63 (HD)

FAT12 at 1868/216/12
     FAT12                 1868 216 12  1870  35 23      20739 [NO NAME]
     FAT12, blocksize=4096, 10 MB / 10 MiB

cramfs Marker at 2093/185/50

recover_cramfs
     CramFS                2093 185 50  2179  33 19    1371983 [GW¹¤Ø«ÝнÍ(bždSÜ]
     cramfs, 702 MB / 669 MiB

LVM magic value at 2342/228/37
NTFS at 2728/182/51
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  2728 182 51  2729  25 50       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB

LVM magic value at 2743/23/13
check_FAT: Bad number of sectors per cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 2913/11/63
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 34-11517
sectors : 11520
cluster_size : 4
no_of_cluster : 2871 (2 - 2872)
fat_length 9 calculated 9
heads/cylinder 4 (FAT) != 255 (HD)
sect/track 36 (FAT) != 63 (HD)

FAT12 at 2913/11/63
     FAT12                 2913  11 63  2913 194 53      11520
     FAT12, blocksize=2048, 5898 KB / 5760 KiB

HFS magic value at 4147/203/48
part_size 2598944898
     HFS                   4147 203 48 165924 162 23 2598944898
     HFS, 1330 GB / 1239 GiB
This partition ends after the disk limits. (start=66634391, size=2598944898, end=2665579288, disk end=976773168)

recover_EXT2: s_block_group_nr=0/20, s_mnt_count=1/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
     ext3                  4582 105 24  4603  81 42     335872 [root]
     ext3 blocksize=1024 Sparse superblock, 171 MB / 164 MiB

LVM magic value at 4627/234/6

LVM magic value at 4627/234/11
FAT32 at 5005/41/35
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 5005/41/36
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 5005/41/36
     FAT12                 5005  41 36  5005  87 17       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB

recover_EXT2: s_block_group_nr=0/10, s_mnt_count=2/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
     ext3                  5006 212 43  5017 203 22     176128 [root]
     ext3 blocksize=1024 Sparse superblock, 90 MB / 86 MiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 5509/36/52
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 5509/36/52
     FAT12                 5509  36 52  5509  82 33       2880 [EFISECTOR]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT32 at 5646/63/16
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 5646/63/17
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 5646/63/17
     FAT12                 5646  63 17  5646 108 61       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
NTFS at 5742/116/27
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  5742 116 27  5742 214 26       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
FAT32 at 5766/23/40
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 5766/23/41
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 5766/23/41
     FAT12                 5766  23 41  5766  69 22       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB

LVM magic value at 6340/132/53

LVM magic value at 6340/132/55

LVM magic value at 6340/132/56

LVM magic value at 6340/133/14
NTFS at 6523/99/21
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  6523  99 21  6523 197 20       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 7052/232/17
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 7052/232/17
     FAT12                 7052 232 17  7053  22 61       2880 [EFISECTOR]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT32 at 7217/208/14
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 7217/208/15
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 7217/208/15
     FAT12                 7217 208 15  7217 253 59       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
     exFAT                 7275  82 49  7275  82 48          0
     exFAT, 0 B
Partition not added.
NTFS at 7905/165/25
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  7905 165 25  7906   8 24       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
FAT12 at 8836/123/16
FAT1 : 1-8
FAT2 : 9-16
start_rootdir : 17
Data : 49-20736
sectors : 20739
cluster_size : 8
no_of_cluster : 2586 (2 - 2587)
fat_length 8 calculated 8
FAT differs, FAT sectors=0-8/8
heads/cylinder 4 (FAT) != 255 (HD)
sect/track 17 (FAT) != 63 (HD)

FAT12 at 8836/123/16
     FAT12                 8836 123 16  8837 197 27      20739 [NO NAME]
     FAT12, blocksize=4096, 10 MB / 10 MiB
check_FAT: Bad jump in FAT partition

LVM magic value at 9370/246/1
NTFS at 11069/55/39
filesystem size           337204337
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     NTFS                 11069  55 39 32059  55 25  337204337
     NTFS, blocksize=4096, 172 GB / 160 GiB

cramfs Marker at 37343/246/31

recover_cramfs
     CramFS               37343 246 31 37520 150 45    2837471 [š?YËΡh¾ ;ËÇé]
     cramfs, 1452 MB / 1385 MiB
check_FAT: Bad jump in FAT partition

HFS magic value at 55243/27/19
part_size 2399049246
     HFS                  55243  27 19 204577   4  3 2399049246 [B>•*´ÉN)#ÚÓE©’öøuÙ­´î;u£]
     HFS, 1228 GB / 1143 GiB
This partition ends after the disk limits. (start=887480514, size=2399049246, end=3286529759, disk end=976773168)
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 1682 GB / 1567 GiB)
The following partitions can't be recovered:
     HFS                    511 114 34 109018 200 42 1743170382 [Ìg]
     HFS, 892 GB / 831 GiB
     HFS                   4147 203 48 165924 162 23 2598944898
     HFS, 1330 GB / 1239 GiB
     HFS                  55243  27 19 204577   4  3 2399049246 [B>•*´ÉN)#ÚÓE©’öøuÙ­´î;u£]
     HFS, 1228 GB / 1143 GiB

Results
   P NTFS                     0   1  1    11 254 51     192705 [System Reserved]
     NTFS, blocksize=4096, 98 MB / 94 MiB
   P NTFS                    11 254 63    23 253 50     192705
     NTFS, blocksize=4096, 98 MB / 94 MiB
   P HFS                    670  38  9  1192  80 42    8388610 [ÿÿÿºD]
     HFS, 4294 MB / 4096 MiB
   P ext2                  1453 153 49  1714 175  1    4194304 [Data]
     ext2 blocksize=4096 Sparse superblock, 2147 MB / 2048 MiB
   P FAT12                 1868 216 12  1870  35 23      20739 [NO NAME]
     FAT12, blocksize=4096, 10 MB / 10 MiB
   P CramFS                2093 185 50  2179  33 19    1371984 [GW¹¤Ø«ÝнÍ(bždSÜ]
     cramfs, 702 MB / 669 MiB
   P NTFS                  2728 182 51  2729  25 50       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
   P FAT12                 2913  11 63  2913 194 53      11520
     FAT12, blocksize=2048, 5898 KB / 5760 KiB
   P ext3                  4582 105 24  4603  81 42     335872 [root]
     ext3 blocksize=1024 Sparse superblock, 171 MB / 164 MiB
   P FAT12                 5005  41 36  5005  87 17       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
   P ext3                  5006 212 43  5017 203 22     176128 [root]
     ext3 blocksize=1024 Sparse superblock, 90 MB / 86 MiB
   P FAT12                 5509  36 52  5509  82 33       2880 [EFISECTOR]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
   P FAT12                 5646  63 17  5646 108 61       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
   P NTFS                  5742 116 27  5742 214 26       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
   P FAT12                 5766  23 41  5766  69 22       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
   P NTFS                  6523  99 21  6523 197 20       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
   P FAT12                 7052 232 17  7053  22 61       2880 [EFISECTOR]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
   P FAT12                 7217 208 15  7217 253 59       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
   P NTFS                  7905 165 25  7906   8 24       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
   P FAT12                 8836 123 16  8837 197 27      20739 [NO NAME]
     FAT12, blocksize=4096, 10 MB / 10 MiB
   P NTFS                 11069  55 39 32059  55 25  337204337
     NTFS, blocksize=4096, 172 GB / 160 GiB
   P CramFS               37343 246 31 37520 150 45    2837472 [š?YËΡh¾ ;ËÇé]
     cramfs, 1452 MB / 1385 MiB

   P ext2                  1453 153 49  1714 175  1    4194304 [Data]
     ext2 blocksize=4096 Sparse superblock, 2147 MB / 2048 MiB
Can't open filesystem. Filesystem seems damaged.


dir_partition inode=0
   P FAT12                 1868 216 12  1870  35 23      20739 [NO NAME]
     FAT12, blocksize=4096, 10 MB / 10 MiB
Directory /
    3723 -rwxr-xr-x     0      0  16541059 12-Jul-2003 06:12 À}‰ëƒ.&
    1535 -rwxr-xr-x     0      0 3091564808 31-Dec-1933 10:40 è‘I÷ÿ‹uð.é


dir_partition inode=2
   P ext3                  4582 105 24  4603  81 42     335872 [root]
     ext3 blocksize=1024 Sparse superblock, 171 MB / 164 MiB
Directory /
       2 drwxr-xr-x  1000   1000      1024 27-Mar-2012 10:38 .
       2 drwxr-xr-x  1000   1000      1024 27-Mar-2012 10:38 ..
      11 drwx------     0      0     12288 27-Mar-2012 10:38 lost+found
   34001 drwxr-xr-x  1000   1000      1024 27-Mar-2012 10:38 android

interface_write()
   P NTFS                     0   1  1    11 254 51     192705 [System Reserved]
   P NTFS                    11 254 63    23 253 50     192705
   P HFS                    670  38  9  1192  80 42    8388610 [ÿÿÿºD]
   P ext2                  1453 153 49  1714 175  1    4194304 [Data]
   P FAT12                 1868 216 12  1870  35 23      20739 [NO NAME]
   P CramFS                2093 185 50  2179  33 19    1371984 [GW¹¤Ø«ÝнÍ(bždSÜ]
   P NTFS                  2728 182 51  2729  25 50       6174 [Boot]
   P FAT12                 2913  11 63  2913 194 53      11520
   P ext3                  4582 105 24  4603  81 42     335872 [root]
   P FAT12                 5005  41 36  5005  87 17       2880 [NO NAME]
   P ext3                  5006 212 43  5017 203 22     176128 [root]
   P FAT12                 5509  36 52  5509  82 33       2880 [EFISECTOR]
   P FAT12                 5646  63 17  5646 108 61       2880 [NO NAME]
   P NTFS                  5742 116 27  5742 214 26       6174 [Boot]
   P FAT12                 5766  23 41  5766  69 22       2880 [NO NAME]
   P NTFS                  6523  99 21  6523 197 20       6174 [Boot]
   P FAT12                 7052 232 17  7053  22 61       2880 [EFISECTOR]
   P FAT12                 7217 208 15  7217 253 59       2880 [NO NAME]
   P NTFS                  7905 165 25  7906   8 24       6174 [Boot]
   P FAT12                 8836 123 16  8837 197 27      20739 [NO NAME]
   P NTFS                 11069  55 39 32059  55 25  337204337
   P CramFS               37343 246 31 37520 150 45    2837472 [š?YËΡh¾ ;ËÇé]
 
Write isn't available because the partition table type "None" has been selected.

search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/1/1
filesystem size           192705
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=32256, part_size=98664960, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/1/1
filesystem size           192705
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     NTFS                     0   1  1    11 254 51     192705 [System Reserved]
     NTFS, blocksize=4096, 98 MB / 94 MiB
NTFS at 0/6/22
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=204288, part_size=104857600, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/6/22
filesystem size           204800
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     NTFS                     0   6 22    12 197  8     204800
     NTFS, blocksize=4096, 104 MB / 100 MiB
FAT32 at 3/60/59
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 3/60/60
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 3/60/60
     FAT12                    3  60 60     3 106 41       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT32 at 10/33/25
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 10/33/26
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 10/33/26
     FAT12                   10  33 26    10  79  7       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
NTFS at 11/254/63
filesystem size           192705
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     NTFS                     0   1 13    11 254 63     192705
     NTFS found using backup sector, blocksize=4096, 98 MB / 94 MiB
NTFS at 11/254/63
filesystem size           192705
sectors_per_cluster       8
mft_lcn                   8533
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     NTFS                    11 254 63    23 253 50     192705
     NTFS, blocksize=4096, 98 MB / 94 MiB
NTFS at 12/0/1
filesystem size           337204337
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=98703360, part_size=172648620544, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 12/0/1
filesystem size           337204337
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     NTFS                    12   0  1 21001 254 50  337204337
     NTFS, blocksize=4096, 172 GB / 160 GiB

LVM magic value at 84/126/34

HFS magic value at 511/114/34
part_size 1743170382
     HFS                    511 114 34 109018 200 42 1743170382 [Ìg]
     HFS, 892 GB / 831 GiB
This partition ends after the disk limits. (start=8216430, size=1743170382, end=1751386811, disk end=976773168)

HFS magic value at 511/114/36

HFS magic value at 670/38/9
part_size 8388610
     HFS                    670  38  9  1192  80 42    8388610 [ÿÿÿºD]
     HFS, 4294 MB / 4096 MiB

HFS magic value at 670/38/11
part_size 8388610
     HFS                    147 250 42   670  38 12    8388610 [ÿÿÿºD]
     HFS found using backup sector!, 4294 MB / 4096 MiB

LVM magic value at 866/109/7

LVM magic value at 868/188/23
FAT32 at 929/207/61
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 929/207/62
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 929/207/62
     FAT12                  929 207 62   929 253 43       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB

HFS magic value at 980/186/14
part_size 3468776067
     HFS                    980 186 14 216902  13 49 3468776067 [{CD$؀ʀi  á]
     HFS, 1776 GB / 1654 GiB
This partition ends after the disk limits. (start=15755431, size=3468776067, end=3484531497, disk end=976773168)

HFS magic value at 980/186/16

LVM magic value at 985/148/61
check_FAT: Bad jump in FAT partition

recover_EXT2: s_block_group_nr=0/16, s_mnt_count=4/20, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 524288
recover_EXT2: part_size 4194304
     ext2                  1453 153 49  1714 175  1    4194304 [Data]
     ext2 blocksize=4096 Sparse superblock, 2147 MB / 2048 MiB

recover_EXT2: s_block_group_nr=0/16, s_mnt_count=0/20, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 524288
recover_EXT2: part_size 4194304
     ext2                  1453 224 54  1714 246  6    4194304 [Data]
     ext2 blocksize=4096 Sparse superblock, 2147 MB / 2048 MiB

recover_EXT2: s_block_group_nr=0/16, s_mnt_count=0/20, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 524288
recover_EXT2: part_size 4194304
     ext2                  1454 112  5  1715 133 20    4194304 [Data]
     ext2 blocksize=4096 Sparse superblock, 2147 MB / 2048 MiB

recover_EXT2: s_block_group_nr=0/16, s_mnt_count=0/20, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 524288
recover_EXT2: part_size 4194304
     ext2                  1460 207 30  1721 228 45    4194304 [Data]
     ext2 blocksize=4096 Sparse superblock, 2147 MB / 2048 MiB

recover_EXT2: s_block_group_nr=0/16, s_mnt_count=0/20, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 524288
recover_EXT2: part_size 4194304
     ext2                  1461 157 43  1722 178 58    4194304 [Data]
     ext2 blocksize=4096 Sparse superblock, 2147 MB / 2048 MiB

recover_EXT2: s_block_group_nr=0/16, s_mnt_count=0/20, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 524288
recover_EXT2: part_size 4194304
     ext2                  1462  48 61  1723  70 13    4194304 [Data]
     ext2 blocksize=4096 Sparse superblock, 2147 MB / 2048 MiB
FAT32 at 1533/153/9
FAT1 : 6-4094
FAT2 : 4095-8183
start_rootdir : 8184 root cluster : 2
Data : 8184-4194303
sectors : 4194304
cluster_size : 8
no_of_cluster : 523265 (2 - 523266)
fat_length 4089 calculated 4089

FAT32 at 1533/153/9
     FAT32                 1533 153  9  1794 174 24    4194304 [SDCard]
     FAT32, blocksize=4096, 2147 MB / 2048 MiB
FAT32 at 1533/153/12
FAT1 : 6-4094
FAT2 : 4095-8183
start_rootdir : 8184 root cluster : 2
Data : 8184-4194303
sectors : 4194304
cluster_size : 8
no_of_cluster : 523265 (2 - 523266)
fat_length 4089 calculated 4089
set_FAT_info: name from BS used

FAT32 at 1533/153/12
     FAT32                 1533 153 12  1794 174 27    4194304 [SDCard]
     FAT32, blocksize=4096, 2147 MB / 2048 MiB
FAT12 at 1868/216/12
FAT1 : 1-8
FAT2 : 9-16
start_rootdir : 17
Data : 49-20736
sectors : 20739
cluster_size : 8
no_of_cluster : 2586 (2 - 2587)
fat_length 8 calculated 8
FAT differs, FAT sectors=0-8/8
heads/cylinder 4 (FAT) != 255 (HD)
sect/track 17 (FAT) != 63 (HD)

FAT12 at 1868/216/12
     FAT12                 1868 216 12  1870  35 23      20739 [NO NAME]
     FAT12, blocksize=4096, 10 MB / 10 MiB
check_FAT: Unusual, only one FAT
FAT32 at 1868/216/13
check_FAT: Bad number of entries in root dir

cramfs Marker at 2093/185/50

recover_cramfs
     CramFS                2093 185 50  2179  33 19    1371983 [GW¹¤Ø«ÝнÍ(bždSÜ]
     cramfs, 702 MB / 669 MiB

LVM magic value at 2342/228/37
NTFS at 2728/182/51
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  2728  84 52  2728 182 51       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 2728/182/51
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  2728 182 51  2729  25 50       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB

LVM magic value at 2743/23/13
check_FAT: Bad number of sectors per cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 2913/11/63
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 34-11517
sectors : 11520
cluster_size : 4
no_of_cluster : 2871 (2 - 2872)
fat_length 9 calculated 9
heads/cylinder 4 (FAT) != 255 (HD)
sect/track 36 (FAT) != 63 (HD)

FAT12 at 2913/11/63
     FAT12                 2913  11 63  2913 194 53      11520
     FAT12, blocksize=2048, 5898 KB / 5760 KiB

HFS magic value at 4147/203/48
part_size 2598944898
     HFS                   4147 203 48 165924 162 23 2598944898
     HFS, 1330 GB / 1239 GiB
This partition ends after the disk limits. (start=66634391, size=2598944898, end=2665579288, disk end=976773168)

HFS magic value at 4147/203/50

recover_EXT2: s_block_group_nr=0/20, s_mnt_count=1/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
     ext3                  4582 105 24  4603  81 42     335872 [root]
     ext3 blocksize=1024 Sparse superblock, 171 MB / 164 MiB

block_group_nr 1

recover_EXT2: "e2fsck -b 8193 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=1/20, s_mnt_count=0/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
     ext3                  4582 105 22  4603  81 40     335872 [root]
     ext3 blocksize=1024 Sparse superblock Backup superblock, 171 MB / 164 MiB

block_group_nr 1

recover_EXT2: "e2fsck -b 8193 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=1/20, s_mnt_count=0/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
     ext3                  4582 105 24  4603  81 42     335872 [root]
     ext3 blocksize=1024 Sparse superblock Backup superblock, 171 MB / 164 MiB

block_group_nr 3

recover_EXT2: "e2fsck -b 24577 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=3/20, s_mnt_count=0/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
     ext3                  4582 105 22  4603  81 40     335872 [root]
     ext3 blocksize=1024 Sparse superblock Backup superblock, 171 MB / 164 MiB

block_group_nr 3

recover_EXT2: "e2fsck -b 24577 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=3/20, s_mnt_count=0/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
     ext3                  4582 105 24  4603  81 42     335872 [root]
     ext3 blocksize=1024 Sparse superblock Backup superblock, 171 MB / 164 MiB

block_group_nr 5

recover_EXT2: "e2fsck -b 40961 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=5/20, s_mnt_count=0/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
     ext3                  4582 105 22  4603  81 40     335872 [root]
     ext3 blocksize=1024 Sparse superblock Backup superblock, 171 MB / 164 MiB

block_group_nr 5

recover_EXT2: "e2fsck -b 40961 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=5/20, s_mnt_count=0/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
     ext3                  4582 105 24  4603  81 42     335872 [root]
     ext3 blocksize=1024 Sparse superblock Backup superblock, 171 MB / 164 MiB

block_group_nr 7

recover_EXT2: "e2fsck -b 57345 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=7/20, s_mnt_count=0/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
     ext3                  4582 105 22  4603  81 40     335872 [root]
     ext3 blocksize=1024 Sparse superblock Backup superblock, 171 MB / 164 MiB

block_group_nr 7

recover_EXT2: "e2fsck -b 57345 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=7/20, s_mnt_count=0/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
     ext3                  4582 105 24  4603  81 42     335872 [root]
     ext3 blocksize=1024 Sparse superblock Backup superblock, 171 MB / 164 MiB

block_group_nr 9

recover_EXT2: "e2fsck -b 73729 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=9/20, s_mnt_count=0/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
     ext3                  4582 105 22  4603  81 40     335872 [root]
     ext3 blocksize=1024 Sparse superblock Backup superblock, 171 MB / 164 MiB

block_group_nr 9

recover_EXT2: "e2fsck -b 73729 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=9/20, s_mnt_count=0/26, s_blocks_per_group=8192, s_inodes_per_group=2000
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 167936
recover_EXT2: part_size 335872
     ext3                  4582 105 24  4603  81 42     335872 [root]
     ext3 blocksize=1024 Sparse superblock Backup superblock, 171 MB / 164 MiB

LVM magic value at 4627/234/6

LVM magic value at 4627/234/11
FAT32 at 5005/41/35
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 5005/41/36
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 5005/41/36
     FAT12                 5005  41 36  5005  87 17       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB

recover_EXT2: s_block_group_nr=0/10, s_mnt_count=2/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
     ext3                  5006 212 43  5017 203 22     176128 [root]
     ext3 blocksize=1024 Sparse superblock, 90 MB / 86 MiB

block_group_nr 1

recover_EXT2: "e2fsck -b 8193 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=1/10, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
     ext3                  5006 212 41  5017 203 20     176128 [root]
     ext3 blocksize=1024 Sparse superblock Backup superblock, 90 MB / 86 MiB

block_group_nr 1

recover_EXT2: "e2fsck -b 8193 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=1/10, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
     ext3                  5006 212 43  5017 203 22     176128 [root]
     ext3 blocksize=1024 Sparse superblock Backup superblock, 90 MB / 86 MiB

block_group_nr 3

recover_EXT2: "e2fsck -b 24577 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=3/10, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
     ext3                  5006 212 41  5017 203 20     176128 [root]
     ext3 blocksize=1024 Sparse superblock Backup superblock, 90 MB / 86 MiB

block_group_nr 3

recover_EXT2: "e2fsck -b 24577 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=3/10, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
     ext3                  5006 212 43  5017 203 22     176128 [root]
     ext3 blocksize=1024 Sparse superblock Backup superblock, 90 MB / 86 MiB

block_group_nr 5

recover_EXT2: "e2fsck -b 40961 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=5/10, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
     ext3                  5006 212 41  5017 203 20     176128 [root]
     ext3 blocksize=1024 Sparse superblock Backup superblock, 90 MB / 86 MiB

block_group_nr 5

recover_EXT2: "e2fsck -b 40961 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=5/10, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
     ext3                  5006 212 43  5017 203 22     176128 [root]
     ext3 blocksize=1024 Sparse superblock Backup superblock, 90 MB / 86 MiB

block_group_nr 7

recover_EXT2: "e2fsck -b 57345 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=7/10, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
     ext3                  5006 212 41  5017 203 20     176128 [root]
     ext3 blocksize=1024 Sparse superblock Backup superblock, 90 MB / 86 MiB

block_group_nr 7

recover_EXT2: "e2fsck -b 57345 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=7/10, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
     ext3                  5006 212 43  5017 203 22     176128 [root]
     ext3 blocksize=1024 Sparse superblock Backup superblock, 90 MB / 86 MiB

block_group_nr 9

recover_EXT2: "e2fsck -b 73729 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=9/10, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
     ext3                  5006 212 41  5017 203 20     176128 [root]
     ext3 blocksize=1024 Sparse superblock Backup superblock, 90 MB / 86 MiB

block_group_nr 9

recover_EXT2: "e2fsck -b 73729 -B 1024 device" may be needed
recover_EXT2: s_block_group_nr=9/10, s_mnt_count=0/30, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 88064
recover_EXT2: part_size 176128
     ext3                  5006 212 43  5017 203 22     176128 [root]
     ext3 blocksize=1024 Sparse superblock Backup superblock, 90 MB / 86 MiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 5509/36/52
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 5509/36/52
     FAT12                 5509  36 52  5509  82 33       2880 [EFISECTOR]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT32 at 5646/63/16
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 5646/63/17
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 5646/63/17
     FAT12                 5646  63 17  5646 108 61       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
NTFS at 5742/116/27
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  5742  18 28  5742 116 27       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 5742/116/27
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  5742 116 27  5742 214 26       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
FAT32 at 5766/23/40
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 5766/23/41
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 5766/23/41
     FAT12                 5766  23 41  5766  69 22       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB

LVM magic value at 6340/132/53

LVM magic value at 6340/132/55

LVM magic value at 6340/132/56

LVM magic value at 6340/133/14
NTFS at 6523/99/21
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  6523   1 22  6523  99 21       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 6523/99/21
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  6523  99 21  6523 197 20       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 7052/232/17
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 7052/232/17
     FAT12                 7052 232 17  7053  22 61       2880 [EFISECTOR]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
FAT32 at 7217/208/14
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 7217/208/15
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 7217/208/15
     FAT12                 7217 208 15  7217 253 59       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
     exFAT                 7275  82 49  7275  82 48          0
     exFAT, 0 B
Partition not added.
NTFS at 7905/165/25
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  7905  67 26  7905 165 25       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 7905/165/25
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  7905 165 25  7906   8 24       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
FAT12 at 8836/123/16
FAT1 : 1-8
FAT2 : 9-16
start_rootdir : 17
Data : 49-20736
sectors : 20739
cluster_size : 8
no_of_cluster : 2586 (2 - 2587)
fat_length 8 calculated 8
FAT differs, FAT sectors=0-8/8
heads/cylinder 4 (FAT) != 255 (HD)
sect/track 17 (FAT) != 63 (HD)

FAT12 at 8836/123/16
     FAT12                 8836 123 16  8837 197 27      20739 [NO NAME]
     FAT12, blocksize=4096, 10 MB / 10 MiB
check_FAT: Unusual, only one FAT
FAT32 at 8836/123/17
check_FAT: Bad number of entries in root dir
check_FAT: Bad jump in FAT partition

LVM magic value at 9370/246/1
NTFS at 11069/55/39
filesystem size           337204337
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=91047417856, part_size=172648620544, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 11069/55/39
filesystem size           337204337
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     NTFS                 11069  55 39 32059  55 25  337204337
     NTFS, blocksize=4096, 172 GB / 160 GiB

HFS magic value at 12061/135/45
part_size 1637482498
     HFS                  12061 135 45 113990  26 24 1637482498 [ ´R–²,K!¹Žçº¶m&!"JDDDD‰Hˆ!]
     HFS, 838 GB / 780 GiB
This partition ends after the disk limits. (start=193768514, size=1637482498, end=1831251011, disk end=976773168)

HFS magic value at 12061/135/47

HFS magic value at 15260/107/13
part_size 515
     HFS                  15260 107 13 15260 115 23        515
     HFS, 263 KB / 257 KiB

HFS magic value at 15260/107/15
part_size 515
     HFS                  15260  99  6 15260 107 16        515
     HFS found using backup sector!, 263 KB / 257 KiB
FAT32 at 15559/177/57
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 15559/177/58
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 15559/177/58
     FAT12                15559 177 58 15559 223 39       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB

LVM magic value at 16306/212/39

LVM magic value at 16567/237/38
NTFS at 16766/104/55
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                 16766   6 56 16766 104 55       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 16766/104/55
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                 16766 104 55 16766 202 54       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
FAT32 at 16839/48/48
Bad root_cluster
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 16839/48/49
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 16839/48/49
     FAT12                16839  48 49 16839  94 30       2880 [NO NAME]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
NTFS at 21001/254/63
filesystem size           337204337
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_

Output of: grep -a -b -P --only-matching 'LUKS\xba\xbe' /dev/sda
I'm not really sure what what it supposed to tell me, I was just trying to follow instructions in another forum and thought it might be helpful in some way.

 
root@PartedMagic:~# grep -a -b -P --only-matching 'LUKS\xba\xbe' /dev/sda
8241433522:LUKS
8241438505:LUKS
44127246268:LUKS
53544942034:LUKS
53544947017:LUKS
grep: memory exhausted

Gparted (if it helps)
gparted
gparted_2



Anyway, I'm really not sure where to go from here.  I have a feeling my data is pretty much just gone, but I thought it would be good to see if anyone knows how to proceed from here. Thanks!


I was following:
https://wiki.archlinuax.org/index.php/D … _with_LUKS
https://wiki.archlinux.org/index.php/LVM
https://wiki.archlinux.org/index.php/Beginners%27_Guide
http://lifehacker.com/5680453/build-a-k … he-process

A couple of the forums/pages I've looked to for help include:
http://code.google.com/p/cryptsetup/wik … leshooting
http://ubuntuforums.org/showthread.php?t=1643334

Offline

#2 2012-10-21 14:12:33

Strike0
Member
From: Germany
Registered: 2011-09-05
Posts: 1,489

Re: Recover Data - Accidentally formatted Luks Partition

Welcome to the forums here. Sorry to read about your mishap. You don't write exactly how you accidently reformatted the partition (which command you used is important to determine a way forward). I don't know too if you "grep" results reveal something. You have to look at the sectors to see whether those instances of "LUKS" contain other relevant bytes suggesting the header is there (how to do that is described in your linked Ubuntu thread).

Another relevant thread to read for you is: http://www.saout.de/pipermail/dm-crypt/ … 02724.html
It will give you further hints on what to look for to identify  the header and also contains links to the relevant cryptsetup FAQ items. Good luck.

Offline

#3 2012-10-22 22:51:38

thewooster
Member
Registered: 2012-10-20
Posts: 57

Re: Recover Data - Accidentally formatted Luks Partition

Thank you for the reply.  I read through that thread, and it was helpful, but unfortunately I am still at a loss.

I cannot remember exactly what I did, or how I formatted my partition (I know that does not help much).  It was a couple of months ago, and I was rather busy at the time, so rather than risk messing with something I just let it set until I had time to work on it (the data is not something I need right away, but could need in the future, old college papers etc . . .).

Basically, after an update I could not get arch to boot.  I would try to enter my password, and I cannot remember the exact error.  I have been googling quite a bit to see if I could find the exact method I used, but I cannot remember.  I think the error was something to do with "no lvm volume found," or something of that sort.  I know I did end up messing with "vgchange," but I cannot remember exactly what I did.  Since I was having trouble getting the device to open I tried changing the volume name to "/dev/mapper/root." 

It is possible that I only changed the volume name, but I may have gone in with a gparted and tried to recreate the volume afterwards (be deleting that partition and recreating it.  I don't think I would have done something that dumb, but I was quite tired).  if that was the case, would the data simply be gone, or is it still possible it could be retrieved?

I'm going to keeping googling and see if I can remember exactly what I did, but if I can't, is there anything else I can do?


cryptsetup luksDump /dev/sda3 output = nothing.

hd /dev/sda3 | less

00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001000  c6 92 f8 24 20 4c 56 4d  32 20 78 5b 35 41 25 72  |...$ LVM2 x[5A%r|
00001010  30 4e 2a 3e 01 00 00 00  00 10 00 00 00 00 00 00  |0N*>............|
00001020  00 f0 02 00 00 00 00 00  00 02 00 00 00 00 00 00  |................|
00001030  7e 02 00 00 00 00 00 00  cc 83 01 03 00 00 00 00  |~...............|
00001040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001200  56 6f 6c 47 72 6f 75 70  30 30 20 7b 0a 69 64 20  |VolGroup00 {.id |
00001210  3d 20 22 47 64 7a 59 67  64 2d 6f 66 4d 36 2d 6e  |= "GdzYgd-ofM6-n|
00001220  57 5a 46 2d 4f 67 50 4a  2d 79 72 62 4a 2d 4e 49  |WZF-OgPJ-yrbJ-NI|
00001230  75 7a 2d 4c 35 4a 76 5a  53 22 0a 73 65 71 6e 6f  |uz-L5JvZS".seqno|
00001240  20 3d 20 31 0a 73 74 61  74 75 73 20 3d 20 5b 22  | = 1.status = ["|
00001250  52 45 53 49 5a 45 41 42  4c 45 22 2c 20 22 52 45  |RESIZEABLE", "RE|
00001260  41 44 22 2c 20 22 57 52  49 54 45 22 5d 0a 66 6c  |AD", "WRITE"].fl|
00001270  61 67 73 20 3d 20 5b 5d  0a 65 78 74 65 6e 74 5f  |ags = [].extent_|
00001280  73 69 7a 65 20 3d 20 38  31 39 32 0a 6d 61 78 5f  |size = 8192.max_|
00001290  6c 76 20 3d 20 30 0a 6d  61 78 5f 70 76 20 3d 20  |lv = 0.max_pv = |
000012a0  30 0a 0a 70 68 79 73 69  63 61 6c 5f 76 6f 6c 75  |0..physical_volu|
000012b0  6d 65 73 20 7b 0a 0a 70  76 30 20 7b 0a 69 64 20  |mes {..pv0 {.id |
000012c0  3d 20 22 4e 64 75 34 64  62 2d 34 73 30 54 2d 34  |= "Ndu4db-4s0T-4|
000012d0  38 56 59 2d 71 42 71 5a  2d 59 45 77 52 2d 32 62  |8VY-qBqZ-YEwR-2b|
000012e0  75 76 2d 66 38 52 72 48  39 22 0a 64 65 76 69 63  |uv-f8RrH9".devic|
000012f0  65 20 3d 20 22 2f 64 65  76 2f 73 64 61 33 22 0a  |e = "/dev/sda3".|
00001300  0a 73 74 61 74 75 73 20  3d 20 5b 22 41 4c 4c 4f  |.status = ["ALLO|
00001310  43 41 54 41 42 4c 45 22  5d 0a 66 6c 61 67 73 20  |CATABLE"].flags |
00001320  3d 20 5b 5d 0a 64 65 76  5f 73 69 7a 65 20 3d 20  |= [].dev_size = |
00001330  36 33 39 33 37 30 39 33  35 0a 70 65 5f 73 74 61  |639370935.pe_sta|
00001340  72 74 20 3d 20 33 38 34  0a 70 65 5f 63 6f 75 6e  |rt = 384.pe_coun|
00001350  74 20 3d 20 37 38 30 34  38 0a 7d 0a 7d 0a 0a 7d  |t = 78048.}.}..}|
00001360  0a 23 20 47 65 6e 65 72  61 74 65 64 20 62 79 20  |.# Generated by |
00001370  4c 56 4d 32 20 76 65 72  73 69 6f 6e 20 32 2e 30  |LVM2 version 2.0|
00001380  32 2e 35 34 28 31 29 20  28 32 30 30 39 2d 31 30  |2.54(1) (2009-10|
00001390  2d 32 36 29 3a 20 46 72  69 20 53 65 70 20 31 34  |-26): Fri Sep 14|
000013a0  20 31 36 3a 32 30 3a 30  30 20 32 30 31 32 0a 0a  | 16:20:00 2012..|
000013b0  63 6f 6e 74 65 6e 74 73  20 3d 20 22 54 65 78 74  |contents = "Text|
000013c0  20 46 6f 72 6d 61 74 20  56 6f 6c 75 6d 65 20 47  | Format Volume G|
000013d0  72 6f 75 70 22 0a 76 65  72 73 69 6f 6e 20 3d 20  |roup".version = |
000013e0  31 0a 0a 64 65 73 63 72  69 70 74 69 6f 6e 20 3d  |1..description =|
000013f0  20 22 22 0a 0a 63 72 65  61 74 69 6f 6e 5f 68 6f  | ""..creation_ho|
00001400  73 74 20 3d 20 22 62 74  22 09 23 20 4c 69 6e 75  |st = "bt".# Linu|
00001410  78 20 62 74 20 33 2e 32  2e 36 20 23 31 20 53 4d  |x bt 3.2.6 #1 SM|
00001420  50 20 46 72 69 20 46 65  62 20 31 37 20 31 30 3a  |P Fri Feb 17 10:|
00001430  33 34 3a 32 30 20 45 53  54 20 32 30 31 32 20 78  |34:20 EST 2012 x|
00001440  38 36 5f 36 34 0a 63 72  65 61 74 69 6f 6e 5f 74  |86_64.creation_t|
00001450  69 6d 65 20 3d 20 31 33  34 37 36 35 34 30 30 30  |ime = 1347654000|
00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001000  c6 92 f8 24 20 4c 56 4d  32 20 78 5b 35 41 25 72  |...$ LVM2 x[5A%r|
00001010  30 4e 2a 3e 01 00 00 00  00 10 00 00 00 00 00 00  |0N*>............|
00001020  00 f0 02 00 00 00 00 00  00 02 00 00 00 00 00 00  |................|
00001030  7e 02 00 00 00 00 00 00  cc 83 01 03 00 00 00 00  |~...............|
00001040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001200  56 6f 6c 47 72 6f 75 70  30 30 20 7b 0a 69 64 20  |VolGroup00 {.id |
00001210  3d 20 22 47 64 7a 59 67  64 2d 6f 66 4d 36 2d 6e  |= "GdzYgd-ofM6-n|
00001220  57 5a 46 2d 4f 67 50 4a  2d 79 72 62 4a 2d 4e 49  |WZF-OgPJ-yrbJ-NI|
00001230  75 7a 2d 4c 35 4a 76 5a  53 22 0a 73 65 71 6e 6f  |uz-L5JvZS".seqno|
00001240  20 3d 20 31 0a 73 74 61  74 75 73 20 3d 20 5b 22  | = 1.status = ["|
00001250  52 45 53 49 5a 45 41 42  4c 45 22 2c 20 22 52 45  |RESIZEABLE", "RE|
00001260  41 44 22 2c 20 22 57 52  49 54 45 22 5d 0a 66 6c  |AD", "WRITE"].fl|
00001270  61 67 73 20 3d 20 5b 5d  0a 65 78 74 65 6e 74 5f  |ags = [].extent_|
00001280  73 69 7a 65 20 3d 20 38  31 39 32 0a 6d 61 78 5f  |size = 8192.max_|
00001290  6c 76 20 3d 20 30 0a 6d  61 78 5f 70 76 20 3d 20  |lv = 0.max_pv = |
000012a0  30 0a 0a 70 68 79 73 69  63 61 6c 5f 76 6f 6c 75  |0..physical_volu|
000012b0  6d 65 73 20 7b 0a 0a 70  76 30 20 7b 0a 69 64 20  |mes {..pv0 {.id |
000012c0  3d 20 22 4e 64 75 34 64  62 2d 34 73 30 54 2d 34  |= "Ndu4db-4s0T-4|
000012d0  38 56 59 2d 71 42 71 5a  2d 59 45 77 52 2d 32 62  |8VY-qBqZ-YEwR-2b|
000012e0  75 76 2d 66 38 52 72 48  39 22 0a 64 65 76 69 63  |uv-f8RrH9".devic|
000012f0  65 20 3d 20 22 2f 64 65  76 2f 73 64 61 33 22 0a  |e = "/dev/sda3".|
00001300  0a 73 74 61 74 75 73 20  3d 20 5b 22 41 4c 4c 4f  |.status = ["ALLO|
00001310  43 41 54 41 42 4c 45 22  5d 0a 66 6c 61 67 73 20  |CATABLE"].flags |
00001320  3d 20 5b 5d 0a 64 65 76  5f 73 69 7a 65 20 3d 20  |= [].dev_size = |
00001330  36 33 39 33 37 30 39 33  35 0a 70 65 5f 73 74 61  |639370935.pe_sta|
00001340  72 74 20 3d 20 33 38 34  0a 70 65 5f 63 6f 75 6e  |rt = 384.pe_coun|
00001350  74 20 3d 20 37 38 30 34  38 0a 7d 0a 7d 0a 0a 7d  |t = 78048.}.}..}|
00001360  0a 23 20 47 65 6e 65 72  61 74 65 64 20 62 79 20  |.# Generated by |
00001370  4c 56 4d 32 20 76 65 72  73 69 6f 6e 20 32 2e 30  |LVM2 version 2.0|
00001380  32 2e 35 34 28 31 29 20  28 32 30 30 39 2d 31 30  |2.54(1) (2009-10|
00001390  2d 32 36 29 3a 20 46 72  69 20 53 65 70 20 31 34  |-26): Fri Sep 14|
000013a0  20 31 36 3a 32 30 3a 30  30 20 32 30 31 32 0a 0a  | 16:20:00 2012..|
000013b0  63 6f 6e 74 65 6e 74 73  20 3d 20 22 54 65 78 74  |contents = "Text|
000013c0  20 46 6f 72 6d 61 74 20  56 6f 6c 75 6d 65 20 47  | Format Volume G|
000013d0  72 6f 75 70 22 0a 76 65  72 73 69 6f 6e 20 3d 20  |roup".version = |
000013e0  31 0a 0a 64 65 73 63 72  69 70 74 69 6f 6e 20 3d  |1..description =|
000013f0  20 22 22 0a 0a 63 72 65  61 74 69 6f 6e 5f 68 6f  | ""..creation_ho|
00001400  73 74 20 3d 20 22 62 74  22 09 23 20 4c 69 6e 75  |st = "bt".# Linu|
00001410  78 20 62 74 20 33 2e 32  2e 36 20 23 31 20 53 4d  |x bt 3.2.6 #1 SM|
00001420  50 20 46 72 69 20 46 65  62 20 31 37 20 31 30 3a  |P Fri Feb 17 10:|
00001430  33 34 3a 32 30 20 45 53  54 20 32 30 31 32 20 78  |34:20 EST 2012 x|
00001440  38 36 5f 36 34 0a 63 72  65 61 74 69 6f 6e 5f 74  |86_64.creation_t|
00001450  69 6d 65 20 3d 20 31 33  34 37 36 35 34 30 30 30  |ime = 1347654000|

. . . etc . . . etc . . .

hexdump -C -n 512 /dev/sda3 output

00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000200

A straight "hexdump -C /dev/sda3" just outputs tons of seemingly random data (I guess that would be the point of encryption." wink I didn't see anything that I could see as being helpful.


*edit*

I don't know why I would have done this, but I believe this may be similar to what I did.

Last edited by thewooster (2012-10-22 23:20:27)

Offline

#4 2012-10-23 20:07:02

robug
Member
Registered: 2010-11-17
Posts: 28

Re: Recover Data - Accidentally formatted Luks Partition

Did you tried any of these? https://wiki.archlinux.org/index.php/File_Recovery
Personally i like to use ddrescue, but you'll need extra space for recovered data (it should be able to contain the whole partition you want to recover).
On another note: I don't believe you lost your partition table - all other partitions seem unaffected (based on pics). That's a good start imho.

Deleting and recreating a partition could cause some trouble.

And be careful with writing data on that partition, you might overwrite something important that would cause decrypting to be impossible.

Did you do everything under X11 or can you actually provide something from bash history?

Godspeed.

Offline

#5 2012-10-23 20:50:49

alphaniner
Member
From: Ancapistan
Registered: 2010-07-12
Posts: 2,810

Re: Recover Data - Accidentally formatted Luks Partition

One thing I'm curious about is the order of LVM and encryption.  The hex dump shows LVM-related data, which suggests to me you were using 'luks over lvm' rather than 'lvm over luks'.  If the former is true, you need to start by locating an LVM pv rather than luks headers or whatever.


But whether the Constitution really be one thing, or another, this much is certain - that it has either authorized such a government as we have had, or has been powerless to prevent it. In either case, it is unfit to exist.
-Lysander Spooner

Offline

#6 2012-10-24 21:59:02

thewooster
Member
Registered: 2012-10-20
Posts: 57

Re: Recover Data - Accidentally formatted Luks Partition

I wish I could remember more, I don't think I have much in the way of a bash history that would be helpful.  I did some through command line and some through gparted.

However, I believe what I probably did was closer the the "luks on lvm" like you were saying.  Except, now that I think about it, I'm not certain I originally used LVM at all.  It is more likely that I did what you see on the second drive.  I think I created an extended partition, and followed the archwiki guide to create a "standard" partition with luks.  I guess I'm not completely sure if the filesystem itself is created first and then encrypted, or if the partition is encrypted and then the filesystem is encrypted?


So in as far as the original creation of the partition, I would have pretty closely followed the guide:

cryptsetup -c aes-xts-plain -y -s 512 luksFormat /dev/sda3

# cryptsetup luksOpen /dev/sda3 root

Enter any LUKS passphrase: <password>
key slot 0 unlocked.
Command successful.

. . . and then continued via this guide.

 Prepare hard drive for Arch Install Scripts

This assumes you want to install an encrypted system with the Arch Install Scripts, have created partitions for / (e.g. /dev/sdaX) and /boot (/dev/sdaY) at least, following the Installation Guide and deciding against using LVM. Prior to creating the partitions you have done a preparation of the disk for encryption according to your necessities (the necessary tools are on the installation-ISO).

First check, if the blockdevice mapper dm_mod is loaded with

# lsmod | grep mod 

If one wants to use the default LUKS-cipher algorithm, there is no need to specify one for the luksFormat. At the time of writing the default is set to an AES variant with 256 bit key-length. With that a dm-crypt/LUKS blockdevice for the crypted root can be created

# cryptsetup -y -v luksFormat /dev/sdaX

opened

# cryptsetup luksOpen /dev/sdaX cryptroot

formatted with your desired filesystem

# mkfs -t ext4 /dev/mapper/cryptroot

and mounted

# mount -t ext4 /dev/mapper/cryptroot /mnt

At this point, just before installing the base system, it might be useful to check the mapping works as intended:

# umount /mnt
# cryptsetup luksClose cryptroot

and mount it again to check.

If you created a separate /home partition, the steps have to be adapted and repeated for that. What you do have to setup is a non-encrypted /boot partition, which is needed for a crypted root. For a standard MBR/non-EFI /boot partition that may be achieved by formatting

# mkfs -t ext2 /dev/sdaY

creating a mount-point for installation

# mkdir /mnt/boot

and mounting it

# mount -t ext2 /dev/sdaY /mnt/boot

That is basically what is necessary at this point before installing the base system with the Arch Install Scripts. Take care to install the bootloader to /mnt/boot with the pacstrap script. Additional configuration steps must be followed before booting the installed system.
Configure initramfs

One important point is to add the hooks relevant for your particular install in the correct order to /etc/mkinitcpio.conf. The one you have to add when encrypting the root filesystem is encrypt. A recommended hook for LUKS encrypted blockdevices is shutdown to ensure controlled unmounting during system shutdown. Others needed, e.g. keymap, should be clear from other manual steps you follow during the installation and further details in the following. For detailed information about mkinitcpio and its configuration refer to Mkinitcpio.
Note: The encrypt hook is only needed if your root partition is a LUKS partition (or a LUKS partition that needs to be mounted before root). The encrypt hook is not needed for any other encrypted partitions (swap, for example). System initialization scripts (/etc/rc.sysinit and /etc/crypttab among others) take care of those.

You have to make sure that your HOOKS array looks something like this:

etc/mkinitcpio.conf

HOOKS="... encrypt ... filesystems ..."

It is important that the encrypt hook comes before the filesystems hook. If you store your key on an external USB device (e.g. a USB stick), you need to add the USB hook too:

HOOKS="... usb encrypt ... filesystems ..."

For safety, add usb before encrypt because the hooks are run in the order they appear. If you need support for foreign keymaps for your encryption password, you have to specify the hook keymap as well. I suggest putting this in /etc/mkinitcpio.conf immediately before encrypt.

If you have a USB keyboard, you will need the usbinput hook in /etc/mkinitcpio.conf. Without it, no USB keyboard will work in early userspace.

If your root partition is a LUKS partition, add the used filesystem to the MODULES section.

MODULES="... ext3 ext4 xfs ..."

After you are done don't forget:

mkinitcpio -p linux

So I would have ended up with an encrypted ext4 partition inside the extended partition, I believe.  I'm not quite sure why I ended up messing with lvm at all.  Though it does show up in my hexdump . . .  Either way I've been able to uncover nothing helpful so far with basic file forensics programs such as Testdisk (https://wiki.archlinux.org/index.php/File_Recovery).  Is there some way I can determine what my file system originally was, or is there something else I should do to try to restore it?  I'm sorry I'm giving such vague information, I probably should have posted this much sooner.  I'm getting the feeling my data may just be nuked XD.

Offline

#7 2012-10-25 01:51:57

alphaniner
Member
From: Ancapistan
Registered: 2010-07-12
Posts: 2,810

Re: Recover Data - Accidentally formatted Luks Partition

Years ago, before I started using Linux, I got a BSOD when playing a game on Windows.  The system wouldn't boot after that.  I lost my cool and did some stuff that was "un-undoable" to no avail.  After that failed, for whatever reason, I regained my cool and started doing things thoughtfully and deliberately.  It turned out the problem was just a bad SATA cable, and I was able to save most of my data with a recovery tool.  The recovery tool wouldn't have even been necessary if it weren't for the rash actions I took at the beginning.  And presumably, the stuff I couldn't save was lost due to those same rash actions.

Your situation is clearly much more complicated, and will not be solved by simply swapping a cable.  The point I'm trying to make is you need to stop assuming, guessing, etc. and focus on what you know.  From my perspective, the only thing that's 'known' is that hexdump output you posted.  It looks like you pasted the same information twice in that first code block, which had really had me scratching my head at first.  That said, the output contains the following information:

Volume Group Name: VolGroup00
Device: /dev/sda3
Creation date: Friday Sept. 14 16:20:00 2012
Host: bt

(Created at exactly 4:20 PM ... hmm... )

Now, it's possible that that LVM metadata or whatever it's called could have been around for a while and is irrelevant to the state the partition was in when you nuked it.  So the first question you have to answer is "Does that information sound right?

Actually, the first question you need to ask is "How badly do I want to retrieve this data?"  There's no guarantee this will be easy, much less end successfully.

Also, just in case I've fooled you into believing I really know what I'm talking about: I don't.  I'm just putting things together as I go along.  Also, I've really only stuck around because I find this kind of problem intriguing for some reason.  Otherwise, your uncertainty regarding... well, pretty much every aspect of the situation would have run me off before I'd finished reading the first post.  With that in mind, I would advise you to gather your thoughts and start a thread on a general Linux forum.  Be frank about what you know and don't know, but I would suggest not offering up anything that you're not certain of; more than anything else, it's likely to lead anyone who may try to help you down the wrong path.

Last edited by alphaniner (2012-10-25 01:56:06)


But whether the Constitution really be one thing, or another, this much is certain - that it has either authorized such a government as we have had, or has been powerless to prevent it. In either case, it is unfit to exist.
-Lysander Spooner

Offline

#8 2012-10-25 18:11:47

Strike0
Member
From: Germany
Registered: 2011-09-05
Posts: 1,489

Re: Recover Data - Accidentally formatted Luks Partition

You never seemed to complete the grep for a LUKS header on the partition like you started in your first post, but that one did not finish (and the grep command aborted).

 sudo hexdump -C /dev/sda3 |grep LUKS 

then look at the output blocks and the next block to determine whether there might be a LUKS header in place somewhere after the LVM header. There isn't one at the beginning of the partition (before LVM), thats what you have seen already unfortunately.

For the rest, I fully agree with alphaminer also as to how you should proceed - depending on how important that data is for you.
What you wrote in post #6 cannot really have happened, you must have setup the LVM before any cryptsetup. The Arch wiki bit you quote from was only added weeks after September 14 as well, so it's a wrong path. So one _might_ assume you had a LVM setup and inside setup encrypted partition(s) and then maybe changed something to the LVM (in Sept) that messed things? Pure guesswork.

Offline

#9 2012-10-30 18:31:14

thewooster
Member
Registered: 2012-10-20
Posts: 57

Re: Recover Data - Accidentally formatted Luks Partition

Ok, well thank you all for the time and effort you put into helping me.  I know I didn't give you much to go on.  I'll give it another try and keep looking.  I realize I gave a lot of general information, and unclear questions.  I'll keep all of the information you posted in mind and keep looking.  I'll probably try a more data-recovery specific forum or general linux forum as suggested.  I may end up cutting my losses and move on (would rather not, but I can live without the data).  Thanks again, so far I've been very impressed with the Arch community and documentation.  If I do end up figuring out what exactly the problem is/was and fixing it, I'll post that here.  Thanks again guys! smile

Offline

#10 2012-10-31 02:05:16

cfr
Member
From: Cymru
Registered: 2011-11-27
Posts: 7,167

Re: Recover Data - Accidentally formatted Luks Partition

Maybe I've missed this, but has anybody clarified that you are working on a COPY of the partition rather than the original partition? As I understand it, that's almost always the recommended course - if you make something worse, you can always recopy the original data and start over.


CLI Paste | How To Ask Questions

Arch Linux | x86_64 | GPT | EFI boot | refind | stub loader | systemd | LVM2 on LUKS
Lenovo x270 | Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz | Intel Wireless 8265/8275 | US keyboard w/ Euro | 512G NVMe INTEL SSDPEKKF512G7L

Offline

Board footer

Powered by FluxBB