* Re: [dm-crypt] My sequence of failure
2010-09-04 12:11 [dm-crypt] My sequence of failure machiner
@ 2010-09-04 12:24 ` Rick Moritz
2010-09-04 14:05 ` Heinz Diehl
2010-09-04 14:33 ` Arno Wagner
2 siblings, 0 replies; 6+ messages in thread
From: Rick Moritz @ 2010-09-04 12:24 UTC (permalink / raw)
To: dm-crypt
As you didn't do things to /dev/sdb1, but operated on the mapper device, just continue normally
with attempting recovery of the wiped file system.
Writing to the mapper device does not impact dm-crypt's operation in anyway (excepting bugs).
Just follow 'normal' procedure while working on the mapper-device (/mapper/backup) - all may not be lost - especially if
testdisk still kinds-of finds stuff. Don't touch /dev/sdb1!
Otoh, I am not sure how recoverable an e3-fs is.
Good luck!
And: Don't drink and be root ;)
On Sat, 4 Sep 2010 08:11:29 -0400 machiner <machiner@gmail.com> wrote:
>
> Hello,
>
> I reinstalled Debian a few weeks ago (dselect). Last night I plugged my backup drive
> in that I may resume normal backup procedures. In a fit of stupid, I probably lost
> my backup data forever. Here is what I did.
>
> Upon plugging the USB drive in I was greeted with a small dialog box that informed
> me that /dev/sdb1 was encrypted and that I needed to input the password. I did.
>
> Then...
>
> 1 - # cryptsetup luksOpen /dev/sdb1 backup
> 2 - # mkfs.ext3 /dev/mapper/backup
> 3 - # mount /dev/mapper/backup /mnt/backup
>
> Of course when I went to look upon my existing backups the drive was empty. Of
> course I overwrote the file system. I did a number of things wrong....Large
> quantities of alcohol were involved.
>
> I tried testdisk with varying failures. Stuff was seen, ish, but it ended there. P
> to list files aborted testdisk. Ran it looking for Intel partitions and also for
> 'none'.
>
> I see 3 instances of the drive when I run testdisk with no arguments.
>
>
> Disk /dev/sdb - 320 GB / 298 GiB - WDC WD32 00BEVT-60ZCT0
> Disk /dev/mapper/backup - 320 GB / 298 GiB
> Disk /dev/dm-0 - 320 GB / 298 GiB
>
>
> I looked around the mailing list and saw things like headers and salts and figured I
> was doomed. But I'm here anyway asking if there's anything I can do to attempt to
> retrieve my existing backups.
>
> Thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [dm-crypt] My sequence of failure
2010-09-04 12:11 [dm-crypt] My sequence of failure machiner
2010-09-04 12:24 ` Rick Moritz
@ 2010-09-04 14:05 ` Heinz Diehl
2010-09-04 22:50 ` Roscoe
2010-09-04 14:33 ` Arno Wagner
2 siblings, 1 reply; 6+ messages in thread
From: Heinz Diehl @ 2010-09-04 14:05 UTC (permalink / raw)
To: dm-crypt
On 04.09.2010, machiner wrote:
> 1 - # cryptsetup luksOpen /dev/sdb1 backup
> 2 - # mkfs.ext3 /dev/mapper/backup
> 3 - # mount /dev/mapper/backup /mnt/backup
If the underlying filesystem before the ext3 format was ext2/ext3,
you maybe have a chance to "unformat" your partition, there are some tools
out there in the net. I never used one by myself, so your mileage may vary.
However, if your original fs was btrfs or xfs, you're hosed, and your data are
gone, forever.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [dm-crypt] My sequence of failure
2010-09-04 14:05 ` Heinz Diehl
@ 2010-09-04 22:50 ` Roscoe
2010-09-05 9:46 ` Heinz Diehl
0 siblings, 1 reply; 6+ messages in thread
From: Roscoe @ 2010-09-04 22:50 UTC (permalink / raw)
To: dm-crypt
On Sun, Sep 5, 2010 at 12:05 AM, Heinz Diehl <htd@fancy-poultry.org> wrote:
> However, if your original fs was btrfs or xfs, you're hosed, and your data are
> gone, forever.
That's overly pessimistic, nearly all of his data is still there.
Retrieving important ASCII he had on there shouldn't be too hard, and
for other things I quite liked photorec
(http://www.cgsecurity.org/wiki/PhotoRec).
At any rate good thing for backups! ;)
-- Roscoe
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [dm-crypt] My sequence of failure
2010-09-04 22:50 ` Roscoe
@ 2010-09-05 9:46 ` Heinz Diehl
0 siblings, 0 replies; 6+ messages in thread
From: Heinz Diehl @ 2010-09-05 9:46 UTC (permalink / raw)
To: dm-crypt
On 05.09.2010, Roscoe wrote:
> Retrieving important ASCII he had on there shouldn't be too hard, and
> for other things I quite liked photorec
> (http://www.cgsecurity.org/wiki/PhotoRec).
That's interesting, I'll do some testing.
However, a lot of tools claim e.g. that they can recover deleted files on
XFS (yes, I know that he has reformatted his partition, and not deleted
any files), which is not possible, the source (at least the XFS
implementation in Linux) tells that non allocated blocks are
always zeroed out. In short: I'm a little bit sceptical :-)
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [dm-crypt] My sequence of failure
2010-09-04 12:11 [dm-crypt] My sequence of failure machiner
2010-09-04 12:24 ` Rick Moritz
2010-09-04 14:05 ` Heinz Diehl
@ 2010-09-04 14:33 ` Arno Wagner
2 siblings, 0 replies; 6+ messages in thread
From: Arno Wagner @ 2010-09-04 14:33 UTC (permalink / raw)
To: dm-crypt
On Sat, Sep 04, 2010 at 08:11:29AM -0400, machiner wrote:
>
> Hello,
>
> I reinstalled Debian a few weeks ago (dselect). Last night I plugged my
> backup drive in that I may resume normal backup procedures. In a fit of
> stupid, I probably lost my backup data forever. Here is what I did.
>
> Upon plugging the USB drive in I was greeted with a small dialog box that
> informed me that /dev/sdb1 was encrypted and that I needed to input the
> password. I did.
>
> Then...
>
> 1 - # cryptsetup luksOpen /dev/sdb1 backup
> 2 - # mkfs.ext3 /dev/mapper/backup
Goes on the encrypted device, not the raw device. This
means what you did is akin to mkfs.ext3 an unencrypted
device. All data will be left, however all superblocks
will begone.
I do not know how much revoery you can do from the inodes.
In any case:
- Only mount /dev/mapper/backup as "ro"
- Make a sector-image as backup of /dev/mapper.backup
(or if concerned about security /dev/sdb1)
Then go looking for tools that help revocer an mkfs.ext3'er
filesystem.
I suspect, chances are not too good. In case you have data
that fits into a single cluser (4kB typically), you can search
for that manually in the block-device, it should still be there.
> 3 - # mount /dev/mapper/backup /mnt/backup
>
> Of course when I went to look upon my existing backups the drive was empty. Of
> course I overwrote the file system. I did a number of things wrong....Large
> quantities of alcohol were involved.
Actually the only thing you did wrong was the mkfs.
> I tried testdisk with varying failures. Stuff was seen, ish, but it ended
> there. P to list files aborted testdisk. Ran it looking for Intel
> partitions and also for 'none'.
>
> I see 3 instances of the drive when I run testdisk with no arguments.
>
>
> Disk /dev/sdb - 320 GB / 298 GiB - WDC WD32 00BEVT-60ZCT0
> Disk /dev/mapper/backup - 320 GB / 298 GiB
> Disk /dev/dm-0 - 320 GB / 298 GiB
>
>
> I looked around the mailing list and saw things like headers and salts and
> figured I was doomed. But I'm here anyway asking if there's anything I
> can do to attempt to retrieve my existing backups.
Your header is intact. For that to be damaged you would need
to mkfs the raw device, i.e. sdb1 or the base device, i.e. /dev/sdb.
Arno
--
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name
GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans
If it's in the news, don't worry about it. The very definition of
"news" is "something that hardly ever happens." -- Bruce Schneier
^ permalink raw reply [flat|nested] 6+ messages in thread