From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from v1.tansi.org (mail.tansi.org [84.19.178.47]) by mail.server123.net (Postfix) with ESMTP for ; Sat, 2 Jul 2016 12:25:18 +0200 (CEST) Received: from gatewagner.dyndns.org (77-56-144-126.dclient.hispeed.ch [77.56.144.126]) by v1.tansi.org (Postfix) with ESMTPA id 323CA14005B for ; Sat, 2 Jul 2016 12:25:17 +0200 (CEST) Date: Sat, 2 Jul 2016 12:25:17 +0200 From: Arno Wagner Message-ID: <20160702102517.GA23072@tansi.org> References: <655760b1-5f92-e6f5-50c1-d46edef89cd9@braegelmann.net> <20160702102000.GA22828@tansi.org> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable In-Reply-To: <20160702102000.GA22828@tansi.org> Subject: Re: [dm-crypt] Incidentaly partitioned LUKS device - header lost? List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: dm-crypt@saout.de Ah, sorry, I am confused. The first question is whether you killed the RAID as well or whether you created the msdos partition table within /dev/md2. In the latter case we do not need the RAID info. Regards, Arno On Sat, Jul 02, 2016 at 12:20:00 CEST, Arno Wagner wrote: > Hi Bernd, >=20 > data-recovery for this is typically relatively easy or completely > impossible. To determine which it is, we need to find out what=20 > happened exactly. The only really irreplaceable values in the header > are the salts (see FAQ Item 6.12). These are not secret, but=20 > each is 256 bits of crypto-grade randomness and they cannot > be reconstructed or guessed. >=20 > The first question is what was overwritten by that partition=20 > sector. Traditionally, Linux software RAID has the RAID superblock > at the end, but unfortunately some people "improved" this, so > it can now be at the end, at the start and at 4kB from the start. >=20 > This is relevant becauese it influences the data offset, i.e. > the place where the LUKS header is put. >=20 > Hence we need the output of >=20 > mdadm --detail /dev/md2 >=20 > whichs dumps the RAID metadata. >=20 > Regards, > Arno >=20 >=20 > On Sat, Jul 02, 2016 at 08:33:09 CEST, Bernd Br=E4gelmann wrote: > > Hi there, > >=20 > > i think i destroyed my luks data. > >=20 > > I accidentally created a msdos partition table on the luks device. I > > think the device was not partitioned. The device is a raid5 mdadm at > > /dev/md2. > >=20 > > Now i cannot luksOpen the device anymore. > >=20 > > I already try to hexdump|grep for the LUKS header but until now i > > haven't found it. In the Luks-FAQ 6.1 the problem is described as a > > common user error and it is very common that the partitioning has > > destroyed the LUKS header. > >=20 > > My question is: Is my data destroyed beyond recovery? It would really > > help me to cope with this. Is it possible to "manually" fix a partially > > destroyed LUKS header? Are there other ways to recover the data? I would > > gladly pay for a recovery solution. > >=20 > > Regards, > >=20 > > Bernd > >=20 > > --=20 > > Bernd Br=E4gelmann - FA f=FCr Radiologie > > Robert-Koch-Stra=DFe 42 28277 Bremen > > www.berndbraegelmann.de +4915141457796 > > _______________________________________________ > > dm-crypt mailing list > > dm-crypt@saout.de > > http://www.saout.de/mailman/listinfo/dm-crypt >=20 > --=20 > Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno@wagner.name > GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 97= 18 > ---- > A good decision is based on knowledge and not on numbers. -- Plato >=20 > If it's in the news, don't worry about it. The very definition of=20 > "news" is "something that hardly ever happens." -- Bruce Schneier > _______________________________________________ > dm-crypt mailing list > dm-crypt@saout.de > http://www.saout.de/mailman/listinfo/dm-crypt --=20 Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno@wagner.name GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- A good decision is based on knowledge and not on numbers. -- Plato If it's in the news, don't worry about it. The very definition of=20 "news" is "something that hardly ever happens." -- Bruce Schneier