Re: [dm-crypt] Yet another header reconstruction question

From: Arno Wagner <arno@wagner.name>
To: dm-crypt@saout.de
Subject: Re: [dm-crypt] Yet another header reconstruction question
Date: Mon, 15 Feb 2016 18:04:24 +0100	[thread overview]
Message-ID: <20160215170424.GA24905@tansi.org> (raw)
In-Reply-To: <trinity-e52dbafb-3e18-4ce6-b24b-ce19f6fe1d1f-1455552455046@3capp-webde-bs40>

Please re-send as non-HTML. Thanks.

Arno

On Mon, Feb 15, 2016 at 17:07:35 CET, Florian Dotzer wrote:
> <html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>Dear Readers of the List .</div>
> 
> <div>&nbsp;</div>
> 
> <div>I had a encrypted RAID 5on my QNAP Device&nbsp; in /dev/md0.</div>
> 
> <div>&nbsp;</div>
> 
> <div>It worked without any problems for about 6 years . But space went low and desaster began.</div>
> 
> <div>After adding a disk , mdadm had overwritten the header (block device /dev/md0 ) like this :</div>
> 
> <div>&nbsp;</div>
> 
> <div><span style="font-family: courier new , courier , monospace;">6d 64 61 64 6d 3a 20 61 64 64 65 64 20 2f 64 65&nbsp; mdadm: added /de</span></div>
> 
> <div><span style="font-family: courier new , courier , monospace;">76 2f 73 64 63 33 0a 00 00 00 00 00 00 00 00 00&nbsp; v/sdc3.......... </span></div>
> 
> <div><span style="font-family: courier new , courier , monospace;">00 00 00 00 00 00 00 00 <strong>63 62 63 2d 70 6c 61 69</strong>&nbsp; ........cbc-plai </span></div>
> 
> <div><span style="font-family: courier new , courier , monospace;"><strong>6e </strong>00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&nbsp; n............... </span></div>
> 
> <div><span style="font-family: courier new , courier , monospace;">00 00 00 00 00 00 00 00 <strong>73 68 61 31</strong> 00 00 00 00&nbsp; ........sha1.... </span></div>
> 
> <div><span style="font-family: courier new , courier , monospace;">00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&nbsp; ................ </span></div>
> 
> <div><span style="font-family: courier new , courier , monospace;">00 00 00 00 00 00 00 00 00 00 <strong>08 08</strong> 00 00 00 <strong>20</strong>&nbsp; ............... </span></div>
> 
> <div><span style="font-family: courier new , courier , monospace;">bc 31 80 6d da a4 f0 5c ed 9f 24 96 fc 1b 72 6a </span></div>
> 
> <div>&nbsp;</div>
> 
> <div>According to the documentation on-disk-format ,</div>
> 
> <div>magic (LUKS 0xba 0x be )&nbsp; , version and cipher name seem to be overwritten.</div>
> 
> <div>&nbsp;</div>
> 
> <div>I&#39;d like to know the possible versions ( 00 01 ? ) and cipher names&nbsp;</div>
> 
> <div>(aes ?) in order to be able to reconstruct the header (fingers crossed )</div>
> 
> <div>&nbsp;</div>
> 
> <div>user support from vendor QNAP tried an hour claiming &#39;fs super block could not be found&#39;</div>
> 
> <div>and finally redirected me to &#39;commercial &#36;&#36;&#36;upport&#39; .&nbsp;</div>
> 
> <div>&nbsp;</div>
> 
> <div>QNAP advertised my Box with &#39;Disks can be AES-encrypted with 256 bit &quot; so</div>
> 
> <div>I suspect its something related with aes .</div>
> 
> <div>&nbsp;</div>
> 
> <div>(And no , I had no header backup, Ahhh !)</div>
> 
> <div>&nbsp;</div>
> 
> <div>Any helpful reply is welcome . And yes , I will make backups in the future . ;-))</div>
> 
> <div>&nbsp;</div>
> 
> <div>Greetings , Florian</div></div></body></html>

> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier