Re: [dm-crypt] My sequence of failure

[Arno Wagner <arno@wagner.name>]

On Sat, Sep 04, 2010 at 08:11:29AM -0400, machiner wrote:
> 
> Hello,
> 
> I reinstalled Debian a few weeks ago (dselect).  Last night I plugged my
> backup drive in that I may resume normal backup procedures.  In a fit of
> stupid, I probably lost my backup data forever.  Here is what I did.
> 
> Upon plugging the USB drive in I was greeted with a small dialog box that
> informed me that /dev/sdb1 was encrypted and that I needed to input the
> password.  I did.
> 
> Then...
> 
> 1 - # cryptsetup luksOpen /dev/sdb1 backup
> 2 - # mkfs.ext3 /dev/mapper/backup

Goes on the encrypted device, not the raw device. This
means what you did is akin to mkfs.ext3 an unencrypted 
device. All data will be left, however all superblocks 
will begone.

I do not know how much revoery you can do from the inodes.
In any case:
 - Only mount /dev/mapper/backup as "ro"
 - Make a sector-image as backup of /dev/mapper.backup
   (or if concerned about security /dev/sdb1)

Then go looking for tools that help revocer an mkfs.ext3'er
filesystem. 
 
I suspect, chances are not too good. In case you have data
that fits into a single cluser (4kB typically), you can search
for that manually in the block-device, it should still be there.

> 3 - # mount /dev/mapper/backup /mnt/backup
> 
> Of course when I went to look upon my existing backups the drive was empty.  Of
> course I overwrote the file system.  I did a number of things wrong....Large
> quantities of alcohol were involved.

Actually the only thing you did wrong was the mkfs.

> I tried testdisk with varying failures.  Stuff was seen, ish, but it ended
> there. P to list files aborted testdisk.  Ran it looking for Intel
> partitions and also for 'none'.
> 
> I see 3 instances of the drive when I run testdisk with no arguments.
> 
> 
> Disk /dev/sdb - 320 GB / 298 GiB - WDC WD32 00BEVT-60ZCT0
> Disk /dev/mapper/backup - 320 GB / 298 GiB
> Disk /dev/dm-0 - 320 GB / 298 GiB
> 
> 
> I looked around the mailing list and saw things like headers and salts and
> figured I was doomed.  But I'm here anyway asking if there's anything I
> can do to attempt to retrieve my existing backups.

Your header is intact. For that to be damaged you would need
to mkfs the raw device, i.e. sdb1 or the base device, i.e. /dev/sdb. 

Arno
-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier