Re: [dm-crypt] Fwd: Recover a LUKS partition

[Uwe Menges <uwe.menges@web.de>]

On 05/27/2010 02:46 PM, fred smith wrote:
> I am desperate to try to recover this disk - it has important stuff on
> it. Any suggestions or pointers?

A good start would be to get some things straight. In your first email
you eg. left open if /dev/sdc1 or /dev/sdc2 is the partition supposed to
be encrypted. A bit of history would probably also help (initial
partition layout, what you did that it's different now, etc.).

> I know the passphrase, but is there any way of recover the first part
> of the partition? I have attached the drive via an external interface
> and 'gparted' shows:
> 
> /dev/sdb1  fat32  200MiB      first sector 40          last sector 409689
> /dev/sdb2  hfs+   931.19GiB  first sector 409640

Does not look good to me, because (sdb2 first sector) < (sdb1 last sector).

You could scan the disk for LUKS header (eg. here "hexdump -C /dev/sda2
| less" shows that the first bytes are "LUKS" (4c 55 4b 53)).

"testdisk" may also help. Good practice is to always work on a copy of
the disk to recover, not the original.

If you have lost the LUKS header, recovery is impossible, because that's
exactly what crypto stuff is for. Reconsider your backup strategy.

Yours, Uwe