[dm-crypt] LUKS keyslot invalid - Please help!

[dm-crypt] LUKS keyslot invalid - Please help!

[Ywellc]

Hi,

I recently accessed a LUKS partition from a Windows operating system (on a different disk).  I was able to mount it using my passphrase.  After turning off the computer, I tried to boot into Ubuntu and received a "evms activate is not available message."  I booted into a live CD and tried to mount to the drive.  I received an error message from gParted saying the partition table did not match the signature.  I ran fsck and it "fixed" the problem.

I then tried to boot again, and load Ubuntu.  This time, evms activate message did not show up.  It brought me to passphrase screen and I entered my passphrase.  This time I received "unknown file system or bad password options" message."

I booted again into live CD (GRML) I try to unlock the container with:

cryptsetup luksOpen /dev/sda5

I receive an error message stating that LUKS Keyslot 4, 6, and 7 is invalid.  I ran the command again with the debug option:

Invalid keyslot size 8388608 (offset 1032, stripes 0) in keyslot 4 (beyond data offset 2056) and similar for 6 and 7.

blkid -p shows "/dev/sdb5 UUID="57ei...." TYPE="crypto-LUKS."

Is there any way for me to open this container now, or is it FUBAR?

I realize this is my fault, and I was actually trying to access the container to backup everything.  I have my whole life on there, school work everything.  Any help you could provide would be greatly appreciated.  I would be willing to shell out the few bitcoins I have to make it worth your while. 

Thanks,
Nick

Re: [dm-crypt] LUKS keyslot invalid - Please help!

[Milan Broz]

On 18.7.2013 19:33, Ywellc wrote:
> I receive an error message stating that LUKS Keyslot 4, 6, and 7 is invalid.  I ran the command again with the debug option:
>
> Invalid keyslot size 8388608 (offset 1032, stripes 0) in keyslot 4 (beyond data offset 2056) and similar for 6 and 7.

So it means that LUKS header is corrupted. If it is really only keyslot 4,6,7
(and you are using keyslot 0, which is most common) maybe you can fix it.

1) _Backup_ header area (dd first 4MB of disk to some safe place)

2) try to run "cryptsetup repair" on device
(Please use crypsetup 1.6.1 - download some boot/live cd with distro which use it,
e.g. recent Fedora.)

If this fails, you need to run keyslot checker (if real used keyslot
is corrupted as well and you have no header backup, no chance...)
(I am sure someone on list here will help you to do this.)

For more info see section 4.1 (and references) in FAQ
http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions#6._Backup_and_Data_Recovery

Milan

Re: [dm-crypt] LUKS keyslot invalid - Please help!

[Arno Wagner]

Hi Nick,

On Thu, Jul 18, 2013 at 10:33:29AM -0700, Ywellc wrote:
> Hi,
> 
> I recently accessed a LUKS partition from a Windows operating system (on a
> different disk).  I was able to mount it using my passphrase.  After
> turning off the computer, I tried to boot into Ubuntu and received a "evms
> activate is not available message." 

I have no idea what that means.

> I booted into a live CD and tried to
> mount to the drive.  I received an error message from gParted saying the
> partition table did not match the signature.  I ran fsck and it "fixed"
> the problem.

That "recovery attempt" is likely what did the damage.

> I then tried to boot again, and load Ubuntu.  This time, evms activate
> message did not show up.  It brought me to passphrase screen and I entered
> my passphrase.  This time I received "unknown file system or bad password
> options" message."
> 
> I booted again into live CD (GRML) I try to unlock the container with:
> 
> cryptsetup luksOpen /dev/sda5
> 
> I receive an error message stating that LUKS Keyslot 4, 6, and 7 is
> invalid.  I ran the command again with the debug option:
> 
> Invalid keyslot size 8388608 (offset 1032, stripes 0) in keyslot 4 (beyond
> data offset 2056) and similar for 6 and 7.

Ok, some damage to the keyslot descriptors. The critical things may
still be fine. 

> blkid -p shows "/dev/sdb5 UUID="57ei...." TYPE="crypto-LUKS."
> 
> Is there any way for me to open this container now, or is it FUBAR?

Unclear at this time. I think the chances for a full recovery are
reasonable.

Please make a manual header backup (copy the first 
3 MB of the LUKS device) and keep that safe. It will protect you
against any additional damage from experimentation. If the data
is important, make a full binary backup of /dev/sda5, or better two
before _any_ more "recovery attempts". In fact, make a third binary 
copy of the whole drive onto a same-size or larger drive and only work
on that. (Binary copies are best made with dd_rescue.) Make very sure 
you are copying in the right direction. In fact, bying a forensic
write-blocker may be a sensible investment if you are unsure.

> I realize this is my fault, and I was actually trying to access the
> container to backup everything.  I have my whole life on there, school
> work everything.  Any help you could provide would be greatly appreciated. 
> I would be willing to shell out the few bitcoins I have to make it worth
> your while.

No need for that. 

Next step when you have the backups and the copy to work on is to
download the current cryptsetup, compile and install it. Then
run the keyslot-checker in misc/keyslot_checker/. There is
a good chance it will fail, but it should report on the
first keyslot before that, and that is the critical one if
you have just one pasphrase.

If that works, you can try to explicitely specify the key-slot to
cryptsetup, along the lines of 
  
  cryptsetup luksOpen --key-slot 0 /dev/sda5

That may or may not work. If not, then the keyslot info has
to be repaired using a disk-editor. (Lets deal with that if
it becomes necessary.) These are just start and offset info 
and should be defaults. 

And when you find the time, read the FAQ item 1.2  and
everything in FAQ Section 6.

If you are sure your passprase is good, you can also send me the 
first 3 MB of your LUKS partition and I can take a look. May
take a few days until I find the time though.

Arno

> Thanks,
> Nick
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
There are two ways of constructing a software design: One way is to make it
so simple that there are obviously no deficiencies, and the other way is to
make it so complicated that there are no obvious deficiencies. The first
method is far more difficult.  --Tony Hoare