From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.saout.de ([127.0.0.1]) by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SkvEYju2TnGV for ; Mon, 14 Nov 2011 20:09:01 +0100 (CET) Received: from catscrash.info (wittgens.org [91.143.80.241]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.saout.de (Postfix) with ESMTPS for ; Mon, 14 Nov 2011 20:09:01 +0100 (CET) Received: from localhost (catscrash.info [127.0.0.1]) by catscrash.info (Postfix) with ESMTP id 32665482C86F for ; Mon, 14 Nov 2011 20:03:30 +0100 (CET) Received: from catscrash.info ([127.0.0.1]) by localhost (catscrash.info [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m8Y2sWE9vooE for ; Mon, 14 Nov 2011 20:03:27 +0100 (CET) Received: from [192.168.123.10] (ip-109-90-5-105.unitymediagroup.de [109.90.5.105]) by catscrash.info (Postfix) with ESMTPSA id 4A1AD482C809 for ; Mon, 14 Nov 2011 20:03:27 +0100 (CET) Message-ID: <4EC165FE.3000302@nicolaivoget.de> Date: Mon, 14 Nov 2011 20:03:26 +0100 From: Nicolai Voget MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="------------060001080505040503050107" Subject: [dm-crypt] Corrupt LUKS-Header List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: dm-crypt@saout.de This is a multi-part message in MIME format. --------------060001080505040503050107 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Hi there, on my home server I've got a RAID 5 consisting of 3 hard drives that contains a dm-crypt partition with ext4. Today, one of the 3 drives passed out and afterwards I got some ext4-errors in dmesg. Unfortunately I'm not home right now, nor for the next 4 days, so I can't replace the harddrive, although I even think it's not necessary, because it was just the USB-controller that passed out. Nevertheless, I wanted to run some e2fsck on the partition to check whether there are some errors or what dmesg was talking about. Stupid me, I forgot that the partition was decrypted, so I ran the e2fsck directly on the md0-RAID. Of course I got some errors, but didn't really think about it, so e2fsck did some error correction, but eventually it seemed weird, so I interrupted it. (I've attached the output, e2fsck showed me, maybe it helps) Of course, the LUKS-device won't mount any more for the LUKS header seems to be overriden. Fortunately, the drive that passed out of the RAID earlier (sda) has been the first device of the raid, thus holding the first 64k (that is, until 0x10000) of LUKS-data (starting with "LUKS … aes …" and so on). Unfortunately, the modification by e2fsck went on to the second 64k of data, too. But by comparing the (original) data on sda with that on md0, I can say that anything from 192k upwards (0x30000) seems to be fine again. Is there any chance of getting the missing data back? As far as I know, there are some methods to get the data, that has been stored in a block, although it has already been overridden. By the fact that I have one of the drives unaltered, it should be possible, to judge which combinations of data for the other two drives can be possible, because the must xor to the data of the first drive, isn’t it? I would be extremely thankful if anyone could help me out on this. Regards, Nicolai --------------060001080505040503050107 Content-Type: text/plain; name="e2fsck-output" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="e2fsck-output" ZTJmc2NrIC9kZXYvbWQwCmUyZnNjayAxLjQxLjEyICgxNy1NYXktMjAxMCkKZTJmc2NrOiBT dXBlcmJsb2NrIGludmFsaWQsIHRyeWluZyBiYWNrdXAgYmxvY2tzLi4uClN1cGVyYmxvY2sg aGFzIGFuIGludmFsaWQgam91cm5hbCAoaW5vZGUgOCkuCkNsZWFyPHk+PyB5ZXMKCioqKiBl eHQzIGpvdXJuYWwgaGFzIGJlZW4gZGVsZXRlZCAtIGZpbGVzeXN0ZW0gaXMgbm93IGV4dDIg b25seSAqKioKCi9kZXYvbWQwIHdhcyBub3QgY2xlYW5seSB1bm1vdW50ZWQsIGNoZWNrIGZv cmNlZC4KUmVzaXplIGlub2RlIG5vdCB2YWxpZC4gIFJlY3JlYXRlPHk+PyB5ZXMKCmUyZnNj azogSWxsZWdhbCB0cmlwbHkgaW5kaXJlY3QgYmxvY2sgZm91bmQgd2hpbGUgcmVhZGluZyBi YWQgYmxvY2tzIGlub2RlClRoaXMgZG9lc24ndCBib2RlIHdlbGwsIGJ1dCB3ZSdsbCB0cnkg dG8gZ28gb24uLi4KUGFzcyAxOiBDaGVja2luZyBpbm9kZXMsIGJsb2NrcywgYW5kIHNpemVz CkJhZCBibG9jayBpbm9kZSBoYXMgaWxsZWdhbCBibG9jayhzKS4gIENsZWFyPHk+PyB5ZXMK CklsbGVnYWwgYmxvY2sgIzAgKDE5NDQ4NzgwNjQpIGluIGJhZCBibG9jayBpbm9kZS4gIENM RUFSRUQuCklsbGVnYWwgYmxvY2sgIzEgKDE1NzYwNTQ0NTkpIGluIGJhZCBibG9jayBpbm9k ZS4gIENMRUFSRUQuCklsbGVnYWwgYmxvY2sgIzIgKDI2MDM5NDY4MDEpIGluIGJhZCBibG9j ayBpbm9kZS4gIENMRUFSRUQuCklsbGVnYWwgYmxvY2sgIzMgKDM3MjExNDczNTMpIGluIGJh ZCBibG9jayBpbm9kZS4gIENMRUFSRUQuCklsbGVnYWwgYmxvY2sgIzQgKDg0MzQzNjkyNykg aW4gYmFkIGJsb2NrIGlub2RlLiAgQ0xFQVJFRC4KSWxsZWdhbCBibG9jayAjNSAoMjc4NTMw MDk4MSkgaW4gYmFkIGJsb2NrIGlub2RlLiAgQ0xFQVJFRC4KSWxsZWdhbCBibG9jayAjNiAo Mjc5MjAyOTQ4OSkgaW4gYmFkIGJsb2NrIGlub2RlLiAgQ0xFQVJFRC4KSWxsZWdhbCBibG9j ayAjNyAoMjIyMzM1ODYzNykgaW4gYmFkIGJsb2NrIGlub2RlLiAgQ0xFQVJFRC4KSWxsZWdh bCBibG9jayAjOCAoMTkwMzQ0NjgyNikgaW4gYmFkIGJsb2NrIGlub2RlLiAgQ0xFQVJFRC4K SWxsZWdhbCBibG9jayAjOSAoMjIyMDg2MTY3NSkgaW4gYmFkIGJsb2NrIGlub2RlLiAgQ0xF QVJFRC4KSWxsZWdhbCBibG9jayAjMTAgKDMzNDQwNzU3NTUpIGluIGJhZCBibG9jayBpbm9k ZS4gIENMRUFSRUQuCklsbGVnYWwgYmxvY2sgIzExICgzNzg0MzM3ODkxKSBpbiBiYWQgYmxv Y2sgaW5vZGUuICBDTEVBUkVELgpJbGxlZ2FsIGluZGlyZWN0IGJsb2NrICg0MDMwMjgzODIz KSBpbiBiYWQgYmxvY2sgaW5vZGUuICBDTEVBUkVELgpJbGxlZ2FsIGRvdWJsZSBpbmRpcmVj dCBibG9jayAoMzA1MDE5MjU0MikgaW4gYmFkIGJsb2NrIGlub2RlLiAgQ0xFQVJFRC4KSWxs ZWdhbCB0cmlwbGUgaW5kaXJlY3QgYmxvY2sgKDMyNzE2NDU3MTIpIGluIGJhZCBibG9jayBp bm9kZS4gIENMRUFSRUQuClJvb3QgaW5vZGUgaXMgbm90IGEgZGlyZWN0b3J5LiAgQ2xlYXI8 eT4/IHllcwoKSW5vZGUgMyBoYXMgRVhURU5UU19GTCBmbGFnIHNldCBvbiBmaWxlc3lzdGVt IHdpdGhvdXQgZXh0ZW50cyBzdXBwb3J0LgpDbGVhcjx5Pj8geWVzCgpSZXNlcnZlZCBpbm9k ZSA0ICg8VGhlIEFDTCBkYXRhIGlub2RlPikgaGFzIGludmFsaWQgbW9kZS4gIENsZWFyPHk+ PyB5ZXMKCklub2RlIDQgaGFzIGNvbXByZXNzaW9uIGZsYWcgc2V0IG9uIGZpbGVzeXN0ZW0g d2l0aG91dCBjb21wcmVzc2lvbiBzdXBwb3J0LiAgQ2xlYXI8eT4/IHllcwoKSW5vZGUgNCwg aV9zaXplIGlzIDExNDA5Njg0ODA1Mzg5NDcxNDkyLCBzaG91bGQgYmUgMC4gIEZpeDx5Pj8g eWVzCgpJbm9kZSA0LCBpX2Jsb2NrcyBpcyAyNTExMDQwMiwgc2hvdWxkIGJlIDAuICBGaXg8 eT4/IAoKUmVjcmVhdGUgam91cm5hbDx5Pj8gY2FuY2VsbGVkIQoKL2Rldi9tZDA6IGUyZnNj ayBjYW5jZWxlZC4KCi9kZXYvbWQwOiAqKioqKiBGSUxFIFNZU1RFTSBXQVMgTU9ESUZJRUQg KioqKioK --------------060001080505040503050107--