Re: [dm-crypt] luks partition table altered by linux-swap

[Milan Broz <mbroz@redhat.com>]

Jonas Meurer wrote:
> On 28/09/2009 anton ivanov wrote:
> i don't know redhat cryptsetup management, but maybe a swap filesystem
> was created (mkswap) on the disk in question? in that case, the luks
> and/or raid headers might have been overwritten ...

IIRC mkswap in 5.3 do not overwrite first two sectors (so visible LUKS
header is intact) but it probably overwrites part of the first keyslot area.
(I think this changed in new version, there mkswap wipe first 4k.)

If this happens, you are out of luck - it will detect LUKS header but
keyslot is lost and unusable.

(Unfortunately other keyslots are unused, so you cannot use other passphrase.)

> Just curious maybe there is some cryptsetup ability to recover
> partition table on disk without luksFormat but using already stored
> metadata on the drive.

You must first decrypt the data, then you can search in them. Data offset
is known - see LUKS dump and payload offset (in sectors). But without
master key (iow without valid kesylot) you cannot decrypt it anyway.

Milan