[SOLVED] Recover of a deleted LUKS partition

malta · 2024-01-23 01:17:45

I'm testing a recover of a deleted LUKS partition for learning purposes. so far, I was able to backup and restore the LUKS header with success following the arch wiki: https://wiki.archlinux.org/title/dm-cry … nd_restore. but after the decryption process, gnome-disk is claiming an unknown partition instead of the original ext4. so how do I restore the ext4 partition?

edit: before restoring the LUKS header, its necessary to do a quick format of the partition, because it seems LUKS cant be restored upon an unallocated disk space. so I formatted it to ext4 and then applied the LUKS header restore command. now it worked.

Last edited by malta (2024-01-23 07:10:51)

frostschutz · 2024-01-23 02:36:33

If you got the correct LUKS header, the correct partition offset and size, so data actually matches up with the header you have, and there's actually ext4 inside... it should work.

If it doesn't then one of the puzzle pieces is not in the right place. So one of wrong header, wrong partition offset or size, wrong data, or actually not ext4 (could be LVM inside LUKS or whatever).

How did you delete the LUKS partition? Elaborate your process (exact commands, outputs) or we can all just guess...

malta · 2024-01-23 02:59:32

frostschutz wrote:

How did you delete the LUKS partition? Elaborate your process (exact commands, outputs) or we can all just guess...

I just hit the red "minus" button in gnome-disk to quick formart it. after that, I used the cryptsetup luksHeaderRestore command and then entered the password, it successfuly decrypted it, but the partition inside LUKS is unknown.

frostschutz · 2024-01-23 08:05:40

nowadays even "quick format" deletes all data / entire partition, if it's SSD (or loop device, or virtual drive, etc.) that supports TRIM or discard

malta · 2024-01-23 08:55:35

frostschutz wrote:

nowadays even "quick format" deletes all data / entire partition, if it's SSD (or loop device, or virtual drive, etc.) that supports TRIM or discard

I dont think thats true. quick format doesn't erase the files. also I managed to recover the LUKS partition and the files were intact.

Arch Linux

#1 2024-01-23 01:17:45

[SOLVED] Recover of a deleted LUKS partition

#2 2024-01-23 02:36:33

Re: [SOLVED] Recover of a deleted LUKS partition

#3 2024-01-23 02:59:32

Re: [SOLVED] Recover of a deleted LUKS partition

#4 2024-01-23 08:05:40

Re: [SOLVED] Recover of a deleted LUKS partition

#5 2024-01-23 08:55:35

Re: [SOLVED] Recover of a deleted LUKS partition

Board footer