[dm-crypt] My sequence of failure

[dm-crypt] My sequence of failure

[machiner]

[-- Attachment #1: Type: text/plain, Size: 1344 bytes --]


Hello,

I reinstalled Debian a few weeks ago (dselect).  Last night I plugged my backup drive
in that I may resume normal backup procedures.  In a fit of stupid, I probably lost
my backup data forever.  Here is what I did.

Upon plugging the USB drive in I was greeted with a small dialog box that informed
me that /dev/sdb1 was encrypted and that I needed to input the password.  I did.

Then...

1 - # cryptsetup luksOpen /dev/sdb1 backup
2 - # mkfs.ext3 /dev/mapper/backup
3 - # mount /dev/mapper/backup /mnt/backup

Of course when I went to look upon my existing backups the drive was empty.  Of
course I overwrote the file system.  I did a number of things wrong....Large
quantities of alcohol were involved.

I tried testdisk with varying failures.  Stuff was seen, ish, but it ended there. P
to list files aborted testdisk.  Ran it looking for Intel partitions and also for
'none'.

I see 3 instances of the drive when I run testdisk with no arguments.


Disk /dev/sdb - 320 GB / 298 GiB - WDC WD32 00BEVT-60ZCT0
Disk /dev/mapper/backup - 320 GB / 298 GiB
Disk /dev/dm-0 - 320 GB / 298 GiB


I looked around the mailing list and saw things like headers and salts and figured I
was doomed.  But I'm here anyway asking if there's anything I can do to attempt to
retrieve my existing backups.

Thanks.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [dm-crypt] My sequence of failure

[Rick Moritz]

As you didn't do things to /dev/sdb1, but operated on the mapper device, just continue normally
with attempting recovery of the wiped file system.
Writing to the mapper device does not impact dm-crypt's operation in anyway (excepting bugs).
Just follow 'normal' procedure while working on the mapper-device (/mapper/backup) - all may not be lost - especially if
testdisk still kinds-of finds stuff. Don't touch /dev/sdb1!
Otoh, I am not sure how recoverable an e3-fs is.
Good luck!
And: Don't drink and be root ;)

On Sat, 4 Sep 2010 08:11:29 -0400 machiner <machiner@gmail.com> wrote:

> 
> Hello,
> 
> I reinstalled Debian a few weeks ago (dselect).  Last night I plugged my backup drive
> in that I may resume normal backup procedures.  In a fit of stupid, I probably lost
> my backup data forever.  Here is what I did.
> 
> Upon plugging the USB drive in I was greeted with a small dialog box that informed
> me that /dev/sdb1 was encrypted and that I needed to input the password.  I did.
> 
> Then...
> 
> 1 - # cryptsetup luksOpen /dev/sdb1 backup
> 2 - # mkfs.ext3 /dev/mapper/backup
> 3 - # mount /dev/mapper/backup /mnt/backup
> 
> Of course when I went to look upon my existing backups the drive was empty.  Of
> course I overwrote the file system.  I did a number of things wrong....Large
> quantities of alcohol were involved.
> 
> I tried testdisk with varying failures.  Stuff was seen, ish, but it ended there. P
> to list files aborted testdisk.  Ran it looking for Intel partitions and also for
> 'none'.
> 
> I see 3 instances of the drive when I run testdisk with no arguments.
> 
> 
> Disk /dev/sdb - 320 GB / 298 GiB - WDC WD32 00BEVT-60ZCT0
> Disk /dev/mapper/backup - 320 GB / 298 GiB
> Disk /dev/dm-0 - 320 GB / 298 GiB
> 
> 
> I looked around the mailing list and saw things like headers and salts and figured I
> was doomed.  But I'm here anyway asking if there's anything I can do to attempt to
> retrieve my existing backups.
> 
> Thanks.

Re: [dm-crypt] My sequence of failure

[Heinz Diehl]

On 04.09.2010, machiner wrote: 

> 1 - # cryptsetup luksOpen /dev/sdb1 backup
> 2 - # mkfs.ext3 /dev/mapper/backup
> 3 - # mount /dev/mapper/backup /mnt/backup

If the underlying filesystem before the ext3 format was ext2/ext3,
you maybe have a chance to "unformat" your partition, there are some tools
out there in the net. I never used one by myself, so your mileage may vary.

However, if your original fs was btrfs or xfs, you're hosed, and your data are
gone, forever.

Re: [dm-crypt] My sequence of failure

[Arno Wagner]

On Sat, Sep 04, 2010 at 08:11:29AM -0400, machiner wrote:
> 
> Hello,
> 
> I reinstalled Debian a few weeks ago (dselect).  Last night I plugged my
> backup drive in that I may resume normal backup procedures.  In a fit of
> stupid, I probably lost my backup data forever.  Here is what I did.
> 
> Upon plugging the USB drive in I was greeted with a small dialog box that
> informed me that /dev/sdb1 was encrypted and that I needed to input the
> password.  I did.
> 
> Then...
> 
> 1 - # cryptsetup luksOpen /dev/sdb1 backup
> 2 - # mkfs.ext3 /dev/mapper/backup

Goes on the encrypted device, not the raw device. This
means what you did is akin to mkfs.ext3 an unencrypted 
device. All data will be left, however all superblocks 
will begone.

I do not know how much revoery you can do from the inodes.
In any case:
 - Only mount /dev/mapper/backup as "ro"
 - Make a sector-image as backup of /dev/mapper.backup
   (or if concerned about security /dev/sdb1)

Then go looking for tools that help revocer an mkfs.ext3'er
filesystem. 
 
I suspect, chances are not too good. In case you have data
that fits into a single cluser (4kB typically), you can search
for that manually in the block-device, it should still be there.

> 3 - # mount /dev/mapper/backup /mnt/backup
> 
> Of course when I went to look upon my existing backups the drive was empty.  Of
> course I overwrote the file system.  I did a number of things wrong....Large
> quantities of alcohol were involved.

Actually the only thing you did wrong was the mkfs.

> I tried testdisk with varying failures.  Stuff was seen, ish, but it ended
> there. P to list files aborted testdisk.  Ran it looking for Intel
> partitions and also for 'none'.
> 
> I see 3 instances of the drive when I run testdisk with no arguments.
> 
> 
> Disk /dev/sdb - 320 GB / 298 GiB - WDC WD32 00BEVT-60ZCT0
> Disk /dev/mapper/backup - 320 GB / 298 GiB
> Disk /dev/dm-0 - 320 GB / 298 GiB
> 
> 
> I looked around the mailing list and saw things like headers and salts and
> figured I was doomed.  But I'm here anyway asking if there's anything I
> can do to attempt to retrieve my existing backups.

Your header is intact. For that to be damaged you would need
to mkfs the raw device, i.e. sdb1 or the base device, i.e. /dev/sdb. 

Arno
-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier 

Re: [dm-crypt] My sequence of failure

[Roscoe]

On Sun, Sep 5, 2010 at 12:05 AM, Heinz Diehl <htd@fancy-poultry.org> wrote:
> However, if your original fs was btrfs or xfs, you're hosed, and your data are
> gone, forever.

That's overly pessimistic, nearly all of his data is still there.

Retrieving important ASCII he had on there shouldn't be too hard, and
for other things I quite liked photorec
(http://www.cgsecurity.org/wiki/PhotoRec).

At any rate good thing for backups! ;)

-- Roscoe

Re: [dm-crypt] My sequence of failure

[Heinz Diehl]

On 05.09.2010, Roscoe wrote: 

> Retrieving important ASCII he had on there shouldn't be too hard, and
> for other things I quite liked photorec
> (http://www.cgsecurity.org/wiki/PhotoRec).

That's interesting, I'll do some testing.

However, a lot of tools claim e.g. that they can recover deleted files on
XFS (yes, I know that he has reformatted his partition, and not deleted
any files), which is not possible, the source (at least the XFS
implementation in Linux) tells that non allocated blocks are 
always zeroed out. In short: I'm a little bit sceptical :-)