You are not logged in.

Pages: 1

#1 2022-05-26 01:40:57

yakoyakoyokuyoku
Member
Registered: 2022-05-26
Posts: 3

[SOLVED] Corrupted LVM on LUKS with mkswap

Hi, while trying to resize some partitions to make proper space for a swap I've accidentally run mkswap on my LVM LUKS partition (/dev/sda2) instead of the intended target (/dev/sda3). At the moment I'm writing from another device and I have no idea on how to recover the partition. Any kind help is appreciated.

Last edited by yakoyakoyokuyoku (2022-05-26 16:37:07)

Offline

#2 2022-05-26 03:09:39

jonno2002
Member
Registered: 2016-11-21
Posts: 876

Re: [SOLVED] Corrupted LVM on LUKS with mkswap

testdisk is what your after:
https://wiki.archlinux.org/title/File_r … d_PhotoRec
https://www.cgsecurity.org/wiki/TestDisk

Offline

#3 2022-05-26 08:37:51

frostschutz
Member
Registered: 2013-11-15
Posts: 1,648

Re: [SOLVED] Corrupted LVM on LUKS with mkswap

Most likely, it is not recoverable at all. (Or maybe it is, see next post)

LUKS setup:

# truncate -s 100M foobar.img
# losetup --find --show foobar.img 
/dev/loop0
# cryptsetup luksFormat /dev/loop0

WARNING!
========
This will overwrite data on /dev/loop0 irrevocably.

Are you sure? (Type 'yes' in capital letters): YES
Enter passphrase for /dev/shm/foobar.img: 
Verify passphrase: 
# cp /dev/loop0 luks.img

SWAP setup:

# mkswap /dev/loop0
mkswap: /dev/loop0: warning: wiping old crypto_LUKS signature.
mkswap: /dev/loop0: warning: wiping old crypto_LUKS signature.
Setting up swapspace version 1, size = 100 MiB (104853504 bytes)
no label, UUID=2ff2928c-3591-4d0a-8973-96fd615508b0
# cp /dev/loop0 swap.img

The damage:

# diff -u <(hexdump -v -C luks.img) <(hexdump -v -C swap.img)
--- /dev/fd/63	2022-05-26 10:14:25.754011488 +0200
+++ /dev/fd/62	2022-05-26 10:14:25.754011488 +0200
@@ -1,16 +1,16 @@
-00000000  4c 55 4b 53 ba be 00 02  00 00 00 00 00 00 40 00  |LUKS..........@.|
-00000010  00 00 00 00 00 00 00 03  00 00 00 00 00 00 00 00  |................|
+00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
-00000040  00 00 00 00 00 00 00 00  73 68 61 32 35 36 00 00  |........sha256..|
+00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
-00000060  00 00 00 00 00 00 00 00  5a 90 19 1b 56 37 5b fc  |........Z...V7[.|
-00000070  26 ba 0d c2 d8 ea b1 71  18 ff 86 89 56 e8 02 dd  |&......q....V...|
-00000080  db 44 36 f4 4a aa 90 a6  f6 ac f7 cb 34 f8 fd 18  |.D6.J.......4...|
-00000090  f2 a5 02 2e e5 19 86 d6  29 7e 54 ae e0 f8 f5 93  |........)~T.....|
-000000a0  e0 a3 9f 97 52 cf d7 48  66 36 31 65 33 36 38 35  |....R..Hf61e3685|
-000000b0  2d 36 39 38 33 2d 34 66  37 36 2d 38 62 65 65 2d  |-6983-4f76-8bee-|
-000000c0  33 34 38 63 62 30 35 30  34 65 30 61 00 00 00 00  |348cb0504e0a....|
+00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
@@ -26,8 +26,8 @@
 00000190  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 000001a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 000001b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
-000001c0  25 9f 46 26 e4 b7 c7 a7  5e b6 49 89 13 51 cd 8c  |%.F&....^.I..Q..|
-000001d0  4e 35 12 17 e2 2e 54 50  39 fe fa e6 91 18 cd 20  |N5....TP9...... |
+000001c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+000001d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 000001e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 000001f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 00000200  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
@@ -62,8 +62,8 @@
 000003d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 000003e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 000003f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
-00000400  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
-00000410  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000400  01 00 00 00 ff 63 00 00  00 00 00 00 2f f2 92 8c  |.....c....../...|
+00000410  35 91 4d 0a 89 73 96 fd  61 55 08 b0 00 00 00 00  |5.M..s..aU......|
 00000420  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 00000430  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 00000440  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
@@ -253,7 +253,7 @@
 00000fc0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 00000fd0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 00000fe0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
-00000ff0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000ff0  00 00 00 00 00 00 53 57  41 50 53 50 41 43 45 32  |......SWAPSPACE2|
 00001000  7b 22 6b 65 79 73 6c 6f  74 73 22 3a 7b 22 30 22  |{"keyslots":{"0"|
 00001010  3a 7b 22 74 79 70 65 22  3a 22 6c 75 6b 73 32 22  |:{"type":"luks2"|
 00001020  2c 22 6b 65 79 5f 73 69  7a 65 22 3a 36 34 2c 22  |,"key_size":64,"|
@@ -1022,7 +1022,7 @@
 00003fd0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 00003fe0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 00003ff0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
-00004000  53 4b 55 4c ba be 00 02  00 00 00 00 00 00 40 00  |SKUL..........@.|
+00004000  00 00 00 00 00 00 00 02  00 00 00 00 00 00 40 00  |..............@.|
 00004010  00 00 00 00 00 00 00 03  00 00 00 00 00 00 00 00  |................|
 00004020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 00004030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

And that's the best case where the swap was never activated, never used. Otherwise the damage will be much more significant.

Last edited by frostschutz (2022-05-26 09:02:46)

Offline

#4 2022-05-26 09:00:12

frostschutz
Member
Registered: 2013-11-15
Posts: 1,648

Re: [SOLVED] Corrupted LVM on LUKS with mkswap

Oh, hang on.

For LUKS1, it's game over, but LUKS2 has a secondary header at offset 0x4000.

But in this case 'cryptsetup repair' does not work because mkswap wiped it, this part:

@@ -1022,7 +1022,7 @@
 00003fd0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 00003fe0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 00003ff0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
-00004000  53 4b 55 4c ba be 00 02  00 00 00 00 00 00 40 00  |SKUL..........@.|
+00004000  00 00 00 00 00 00 00 02  00 00 00 00 00 00 40 00  |..............@.|
 00004010  00 00 00 00 00 00 00 03  00 00 00 00 00 00 00 00  |................|
 00004020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 00004030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

But that's just insignificant change (removed SKUL 0xba 0xbe).

Recovery:

# printf "SKUL\xba\xbe\x00\x02" | dd bs=1 count=8 seek=$((0x4000)) of=/dev/loop0

Repair:

# cryptsetup repair /dev/loop0
WARNING: Device /dev/loop0 already contains a 'swap' superblock signature.

WARNING!
========
Really try to repair LUKS device header?

Are you sure? (Type 'yes' in capital letters): YES
# cryptsetup luksDump /dev/loop0
LUKS header information
Version:       	2
Epoch:         	3
Metadata area: 	16384 [bytes]
Keyslots area: 	16744448 [bytes]
UUID:          	f61e3685-6983-4f76-8bee-348cb0504e0a
Label:         	(no label)
Subsystem:     	(no subsystem)
Flags:       	(no flags)

Data segments:
  0: crypt
	offset: 16777216 [bytes]
	length: (whole device)
	cipher: aes-xts-plain64
	sector: 512 [bytes]

Keyslots:
  0: luks2
	Key:        512 bits
	Priority:   normal
	Cipher:     aes-xts-plain64
	Cipher key: 512 bits
	PBKDF:      argon2id
	Time cost:  12
	Memory:     1048576
	Threads:    4
	Salt:       c9 a1 ce 56 13 01 60 6f a2 b9 82 75 b8 1c 99 9a 
	            c0 42 c8 3b 1a 2c ce 32 88 cd b5 f1 8a 7f e6 45 
	AF stripes: 4000
	AF hash:    sha256
	Area offset:32768 [bytes]
	Area length:258048 [bytes]
	Digest ID:  0
Tokens:
Digests:
  0: pbkdf2
	Hash:       sha256
	Iterations: 387786
	Salt:       10 20 a6 9f 5e a2 44 d5 3c ff 57 98 75 7b 31 98 
	            ca ec ab da 45 a6 19 ed 13 1b fd be 7e be e5 a1 
	Digest:     d1 ad 70 4e 11 b4 ec d5 a9 f0 96 96 7c 79 83 ec 
	            04 b2 6c 1c 2f 78 25 e7 11 40 c8 1d 1f 67 3e 85

If you wish to perform this experiment you should perform it on a copy, not the actual device itself. The offset 0x4000 may be wrong in some cases. You can check with hexdump first if any parts of a LUKS2 header (JSON area) still survived.

Last edited by frostschutz (2022-05-26 09:14:28)

Offline

#5 2022-05-26 12:17:05

yakoyakoyokuyoku
Member
Registered: 2022-05-26
Posts: 3

Re: [SOLVED] Corrupted LVM on LUKS with mkswap

frostschutz wrote:

Oh, hang on.

For LUKS1, it's game over, but LUKS2 has a secondary header at offset 0x4000.

But in this case 'cryptsetup repair' does not work because mkswap wiped it, this part:

@@ -1022,7 +1022,7 @@
 00003fd0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 00003fe0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 00003ff0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
-00004000  53 4b 55 4c ba be 00 02  00 00 00 00 00 00 40 00  |SKUL..........@.|
+00004000  00 00 00 00 00 00 00 02  00 00 00 00 00 00 40 00  |..............@.|
 00004010  00 00 00 00 00 00 00 03  00 00 00 00 00 00 00 00  |................|
 00004020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 00004030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
frostschutz wrote:

If you wish to perform this experiment you should perform it on a copy, not the actual device itself. The offset 0x4000 may be wrong in some cases. You can check with hexdump first if any parts of a LUKS2 header (JSON area) still survived.

While I wiped the LVM volume header (not the LUKS partition directly) I can see a part that says "sha256sum" at 0x4040 (if that's in your hexdump I'd like to hear) and a valid JSON of LUKS2 (the version I'm using) that luckily survived at 0x5000. With this I think I can perform a repair. Although before I pull the trigger I'll need to perform some kind of a dryrun after printfing the LUKS signature. If all of this sounds good then I'm gonna mark this as [SOLVED] after fixing LUKS.

Offline

#6 2022-05-26 16:35:43

yakoyakoyokuyoku
Member
Registered: 2022-05-26
Posts: 3

Re: [SOLVED] Corrupted LVM on LUKS with mkswap

frostschutz wrote:

Recovery:

# printf "SKUL\xba\xbe\x00\x02" | dd bs=1 count=8 seek=$((0x4000)) of=/dev/loop0

Repair:

# cryptsetup repair /dev/loop0
WARNING: Device /dev/loop0 already contains a 'swap' superblock signature.

WARNING!
========
Really try to repair LUKS device header?

Are you sure? (Type 'yes' in capital letters): YES

I could repair both a loop device testing setup and my LVM on LUKS successfully (and it wasn't LUKS on LVM as I've originally thought cool). Booted up and I'm writing from my main machine without loosing seemingly anything. So many, many thanks frostschutz and a virtual beer for you. With that said I'm closing this as solved.

Offline

Pages: 1

Board footer

Powered by FluxBB