Re: [dm-crypt] recover old crypt partition

[Arno Wagner <arno@wagner.name>]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=unknown-8bit, Size: 2364 bytes --]

On Thu, Jan 06, 2011 at 10:08:42PM +0100, Jonas Meurer wrote:
> Hey,
> 
> On 06/01/2011 Arno Wagner wrote:
> > On Thu, Jan 06, 2011 at 04:33:52PM +0100, Jan Christoph Uhde wrote:
> > > > Is this plain dm-crypt?
> > >
> > > i used cryptsetup in debian sid
> > 
> > Yes, but did you create a LUKS partition or a plain dm-crypt one?
> > The default would have been dm-crypt. Hmm. That would mean the cipher 
> > is probably the old default of aes-cbc-plain. Can anybody confirm that
> > for Debian SID?
> 
> what do you mean with "the default". it highly depends on the method
> that was used to encrpyt the device. was it done during installation
> process (debian-installer), with the shipped luksformat script, with
> some graphical frontend (gnome-device-manager, gnome-disk-utility, ...)
> or by invoking cryptsetup directly (with which commandline arguments?).
> 
> the default cipher depends on the cryptsetup package version used when
> the decive was encrypted.

That is why I asked. And you are right, a commandline default
does not cut it, more information is needed. 

Well, at least whether it was LUKS or not is easily answered.
A look into a hexdump of the start of the device will show the
magic string "LUKS" right at the start. Options to get that:

-  hd /dev/<device> | head
-  hexdump /dev/<device> | head
-  hex /dev/<device> | head

and possibly a few others. Example from my LUKS test container
in a file:

R gatewagner:~/f/luks# hd luksfile | head
00000000  4c 55 4b 53 ba be 00 01  61 65 73 00 00 00 00 00  |LUKSº¾..aes.....|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  63 62 63 2d 65 73 73 69  |........cbc-essi|
00000030  76 3a 73 68 61 32 35 36  00 00 00 00 00 00 00 00  |v:sha256........|
00000040  00 00 00 00 00 00 00 00  73 68 61 31 00 00 00 00  |........sha1....|

If it looks completely random though, it is likely plain dm-crypt.

Arno
-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier