Recovering a LUKS partition (retitled)

ajrl · 2014-12-18 04:16:18

I have a removable hard drive (sdd below) that got interrupted during a file transfer. Now Arch doesn't recognize its partition table. It should show a single encrypted ext4 partition. I tried connecting the device to another Arch system but got the same results.

lsblk:

NAME           MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINT
sda              8:0    0 596.2G  0 disk  
├─sda1           8:1    0     1M  0 part  
├─sda2           8:2    0   200M  0 part  /boot
└─sda3           8:3    0   596G  0 part  
  └─lvm        254:0    0   596G  0 crypt 
    ├─vg1-swap 254:1    0     1G  0 lvm   
    ├─vg1-root 254:2    0    20G  0 lvm   /
    └─vg1-home 254:3    0   575G  0 lvm   /home
sdc              8:32   0   3.7T  0 disk  
sdd              8:48   0 298.1G  0 disk  
sr0             11:0    1  1024M  0 rom

dmesg:

[85255.469038] usb 1-1.1: new high-speed USB device number 32 using ehci-pci
[85255.554305] usb-storage 1-1.1:1.0: USB Mass Storage device detected
[85255.554481] usb-storage 1-1.1:1.0: Quirks match for vid 1058 pid 0704: 8000
[85255.554548] scsi host37: usb-storage 1-1.1:1.0
[85256.557244] scsi 37:0:0:0: Direct-Access     WD       3200BMV External 1.75 PQ: 0 ANSI: 4
[85256.558623] sd 37:0:0:0: [sdd] 625142448 512-byte logical blocks: (320 GB/298 GiB)
[85256.559466] sd 37:0:0:0: [sdd] Write Protect is off
[85256.559475] sd 37:0:0:0: [sdd] Mode Sense: 23 00 00 00
[85256.561308] sd 37:0:0:0: [sdd] No Caching mode page found
[85256.561322] sd 37:0:0:0: [sdd] Assuming drive cache: write through
[85256.607662]  sdd: unknown partition table
[85256.610134] sd 37:0:0:0: [sdd] Attached SCSI disk
[85261.690527] usb 1-1.1: USB disconnect, device number 32
[85271.869630] usb 1-1.1: new high-speed USB device number 33 using ehci-pci
[85271.954813] usb-storage 1-1.1:1.0: USB Mass Storage device detected
[85271.955165] usb-storage 1-1.1:1.0: Quirks match for vid 1058 pid 0704: 8000
[85271.955221] scsi host38: usb-storage 1-1.1:1.0

I really need to recover the data on this drive. Ideas?

Last edited by ajrl (2014-12-19 19:58:47)

davidm · 2014-12-18 20:52:36

https://wiki.archlinux.org/index.php/File_recovery

I'm not sure but testdisk might be of some help.

Head_on_a_Stick · 2014-12-18 20:59:41

Try running:

# gdisk /dev/sdd

If it is a GPT disk, there will be a backup copy of the partition table at the "end" of the disk that can be used to reconstruct the original.

If it isn't, you could try creating a new partition table of the same format as the old one -- this is essentially what gdisk does when converting MBR disks to GPT, so it might allow you to access the filesystem...

ajrl · 2014-12-18 22:07:23

gdisk /dev/sdd:

GPT fdisk (gdisk) version 0.8.10

Caution: invalid main GPT header, but valid backup; regenerating main header
from backup!

Caution! After loading partitions, the CRC doesn't check out!
Warning! Main partition table CRC mismatch! Loaded backup partition table
instead of main partition table!

Warning! One or more CRCs don't match. You should repair the disk!

Partition table scan:
  MBR: not present
  BSD: not present
  APM: not present
  GPT: damaged

Found invalid MBR and corrupt GPT. What do you want to do? (Using the
GPT MAY permit recovery of GPT data.)
 1 - Use current GPT
 2 - Create blank GPT

Your answer:

I'm trying to follow this guide to figure out what to do. I backed up the first GB of the hard drive in case I mess something up. If anyone knows what the best option is, let me know.

ajrl · 2014-12-19 20:09:03

I tried to find posts with the same problem as mine, but I'm still paranoid about damaging the LUKS header (assuming that it's not already damaged). The partition I'm trying to recover is encrypted with dm-crypt/LUKS. What can I do with gdisk or testdisk that won't potentially mess with the header? The disk in question is sdd, and it should contain a single encrypted partition on a GPT that spans the entire disk (from 2048 to the end). Can I safely create a new partition table?

lsblk:

NAME           MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINT
sda              8:0    0 596.2G  0 disk  
├─sda1           8:1    0     1M  0 part  
├─sda2           8:2    0   200M  0 part  /boot
└─sda3           8:3    0   596G  0 part  
  └─lvm        254:0    0   596G  0 crypt 
    ├─vg1-swap 254:1    0     1G  0 lvm   
    ├─vg1-root 254:2    0    20G  0 lvm   /
    └─vg1-home 254:3    0   575G  0 lvm   /home
sdc              8:32   0   3.7T  0 disk  
sdd              8:48   0 298.1G  0 disk  
sr0             11:0    1  1024M  0 rom

Arch Linux

#1 2014-12-18 04:16:18

Recovering a LUKS partition (retitled)

#2 2014-12-18 20:52:36

Re: Recovering a LUKS partition (retitled)

#3 2014-12-18 20:59:41

Re: Recovering a LUKS partition (retitled)

#4 2014-12-18 22:07:23

Re: Recovering a LUKS partition (retitled)

#5 2014-12-19 20:09:03

Re: Recovering a LUKS partition (retitled)

Board footer