Re: [dm-crypt] Incidentaly partitioned LUKS device - header lost?

From: Arno Wagner <arno@wagner.name>
To: dm-crypt@saout.de
Subject: Re: [dm-crypt] Incidentaly partitioned LUKS device - header lost?
Date: Sat, 2 Jul 2016 12:20:00 +0200	[thread overview]
Message-ID: <20160702102000.GA22828@tansi.org> (raw)
In-Reply-To: <655760b1-5f92-e6f5-50c1-d46edef89cd9@braegelmann.net>

Hi Bernd,

data-recovery for this is typically relatively easy or completely
impossible. To determine which it is, we need to find out what 
happened exactly. The only really irreplaceable values in the header
are the salts (see FAQ Item 6.12). These are not secret, but 
each is 256 bits of crypto-grade randomness and they cannot
be reconstructed or guessed.

The first question is what was overwritten by that partition 
sector. Traditionally, Linux software RAID has the RAID superblock
at the end, but unfortunately some people "improved" this, so
it can now be at the end, at the start and at 4kB from the start.

This is relevant becauese it influences the data offset, i.e.
the place where the LUKS header is put.

Hence we need the output of

  mdadm --detail /dev/md2

whichs dumps the RAID metadata.

Regards,
Arno

On Sat, Jul 02, 2016 at 08:33:09 CEST, Bernd Brägelmann wrote:
> Hi there,
> 
> i think i destroyed my luks data.
> 
> I accidentally created a msdos partition table on the luks device. I
> think the device was not partitioned. The device is a raid5 mdadm at
> /dev/md2.
> 
> Now i cannot luksOpen the device anymore.
> 
> I already try to hexdump|grep for the LUKS header but until now i
> haven't found it. In the Luks-FAQ 6.1 the problem is described as a
> common user error and it is very common that the partitioning has
> destroyed the LUKS header.
> 
> My question is: Is my data destroyed beyond recovery? It would really
> help me to cope with this. Is it possible to "manually" fix a partially
> destroyed LUKS header? Are there other ways to recover the data? I would
> gladly pay for a recovery solution.
> 
> Regards,
> 
> Bernd
> 
> -- 
> Bernd Brägelmann  -  FA für Radiologie
> Robert-Koch-Straße 42     28277 Bremen
> www.berndbraegelmann.de +4915141457796
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier