[dm-crypt] Data recovery recomendations needed

[dm-crypt] Data recovery recomendations needed

[David Backer]

THIS IS NOT A USER ERROR OR LOST KEY POST.
I'm going to write this in long form since I want to convey the
maximium amount of information.
  I own a laptop, Gateway NV570P09u that has a western digital hard
drive, 750 Gib. It failed. In the event that your about to critisize me
for not making backups, I did. I used a spare hard drive which I
would plug into my desktop computer and copy the info onto,
unfortunatly my desktops motherboard had failed and I was having
trouble finding a replacement as the original model was out of stock
at least on all the popular websites; as where the many simmilar models,
leaving only quite inferior models (chipset and gpu wise), availible.
  I tried to trouble shoot online and everyone thought that it was the
PCB board. I bought another one and, after failing to get it to work I
sent the computer in for warrenty (the drive had failed before it was
6 months old). I got it back and I tried soldering the board like was
suggested by those whom I bought it from. Though I have soldered
before I have never soldered that small a device before and I failed
at it. I then tried to replace it with the known good PCB board from
the replacement drive but the damaged drive did not show up.
  I investigated sending it to a company specializing in data recovery
but, when I mentioned that I was using LUKS encrypted LVM (installed using
yast from opensuse 13.1,) they said that they could only recover files.
Now, I know the pass phrase (I'm not certain if I made one of the
letters capital or not but that's trivial,) so I don't see why the
data should be unrecoverable.
  I'm looking for recomendations on what I can do. The data that was
in the LUKS LVM was not very sensitive, I used encryption because I
did not want to have to worry if I lost the computer. Most of it is
recoverable, but very hard to find as I have been and still am
persuing information on various advanced linux and computer related
subjects and information gathering (not the out dated type), is a
difficult thing when you are persuing the more arcane topics, saving
and book marking as you go along.

Thanks, David

Re: [dm-crypt] Data recovery recomendations needed

[David Christensen]

On 04/20/2015 08:18 PM, David Backer wrote:
> THIS IS NOT A USER ERROR OR LOST KEY POST.
...

So:

1.  The laptop HDD (presumably 2.5" SATA) has suffered a hardware 
failure.  It had one or more partitions with LUKS containers, and one or 
more had LVM.

2.  You have a backup of the data on another HDD (presumably 3.5" SATA) 
in your desktop computer.

3.  Your desktop motherboard has suffered a hardware failure.


I'd suggest:

1.  One or more of:

     a.  Get another motherboard (CPU and/or RAM) for your desktop and 
get your desktop working again.

     b.  Build another desktop/ workstation/ server and move the backup 
HDD into it.

     c.  Get a USB external enclosure for your backup HDD.

2.  Get another hard drive for your laptop, do a fresh install of your 
favorite OS (or restore an image), and restore your data.


David

Re: [dm-crypt] Data recovery recomendations needed

[David Backer]

> So:
> 1. The laptop HDD (presumably 2.5" SATA) has suffered a hardware
> failure. It had one or more partitions with LUKS containers, and one or
> more had LVM.
Yes

> 2. You have a backup of the data on another HDD (presumably 3.5" SATA)
> in your desktop computer.
Yes, but 3 months old because I needed a motherboad, I've since gotten one.

> 3. Your desktop motherboard has suffered a hardware failure.
Yes

> I'd suggest:
>
> 1. One or more of:
>
>a. Get another motherboard (CPU and/or RAM) for your desktop and
>get your desktop working again.
Check

> b. Build another desktop/ workstation/ server and move the backup
> HDD into it.
Check

> c. Get a USB external enclosure for your backup HDD.
Why? I plug it into the internal plugs, it works fine.

My question was, How do I get data off the broken drive
if the data recovery people will not take it because it has
encryption?
Do you know of any that would?
Even if they just copied off the raw sectors, I could use
them to recover the data if I moved it to a new drive
provided that the LVM info and the LUKS headers are intact
right?

Thanks again, David

Re: [dm-crypt] Data recovery recomendations needed

[David Backer]

If it helps, I suspect that the failure was due, a least in part,
to heat. The drive has no fan near it and it is not very cool where
I live and I use it outside frequently.

Thanks, David

Re: [dm-crypt] Data recovery recomendations needed

[Sitaram Chamarty]

On 04/21/2015 10:08 AM, David Backer wrote:

> Even if they just copied off the raw sectors, I could use
> them to recover the data if I moved it to a new drive
> provided that the LVM info and the LUKS headers are intact
> right?

This may be very naive of me, but it seems to me you need to do it in 3
steps:

-   get the raw data off (maybe DIY using 'ddrescue' or some such
    program, or farm it out).

-   assuming the LUKS headers etc are ok, mount the rescued data as a
    "drive" (or figure out some way of applying the same decryption that
    dm-crypt's block-by-block enc/dec does).  Read off the raw blocks,
    this time unencrypted, and write them to another device.

-   use that device to recover the actual data.  This is where knowledge
    of the internals of your filesystem will be needed, and you will
    probably need to farm it out.  I'm assuming that's why those
    specialists exist.

Re: [dm-crypt] Data recovery recomendations needed

[Sven Eschenberg]

Hio David,

Well, if they can not see the files, they can hardly verify the disk and
data is readable (well they only can to a limited extent).

Anyway, I remember that i.e. Kroll Ontrack DID offer quite a variety of
options back in the days. They would either send the 'repaired' drive back
but without any guarantee on how long it might be working outside their
lab or they would offer a sector by sector copy of what the disk spits
out. There's no guarantee whatsoever that sectors are not corrupted
(obviously).

Regards

-Sven

On Tue, April 21, 2015 06:38, David Backer wrote:
> My question was, How do I get data off the broken drive
> if the data recovery people will not take it because it has
> encryption?
> Do you know of any that would?
> Even if they just copied off the raw sectors, I could use
> them to recover the data if I moved it to a new drive
> provided that the LVM info and the LUKS headers are intact
> right?
>
> Thanks again, David
>

Re: [dm-crypt] Data recovery recomendations needed

[David Christensen]

On 04/20/2015 09:38 PM, David Backer wrote:
> [backups are] 3 months old ...

So, all of your data on one HDD, a backup strategy of one HDD, and no 
backups taken for the past three months?  Ouch.  The guy in the mirror 
got you good (been there, done that).


You and others have already identified what is likely the only remaining 
technical solution -- pay a vendor with a the right knowledge, 
materials, tools, equipment, and skills to do whatever it takes to copy 
out the raw sectors and give them to you.  Your HDD manufacturer will be 
the best qualified to do this.  Then reassemble what's left of LUKS, 
LVM, ext4, etc. and hope you're lucky.  If you've got the time and 
money, go for it  If not, accept the decision you made three months ago.


Alternatively and/or in parallel, try to get your hands on other copies 
of the files that you've created over the past three months.  You 
probably delivered important files to other people; they may still have 
copies.  IMAP servers may still have copies.  Desktop Trash bins may 
still have copies.


In any case, once you've put your desktop (e.g. backup server) back 
together again, get two more backup drives, make copies of your backup, 
get a BluRay burner, burn the backup to optical.  Put one backup copy 
drive and the optical archive set off-site.  Going forward, implement 
daily backups, implement periodic backup copying, implement period 
archiving to optical, and implement off-site rotation and storage.


David

Re: [dm-crypt] Data recovery recomendations needed

[Arno Wagner]

On Tue, Apr 21, 2015 at 20:18:39 CEST, David Christensen wrote:
> On 04/20/2015 09:38 PM, David Backer wrote:
> >[backups are] 3 months old ...
> 
> So, all of your data on one HDD, a backup strategy of one HDD, and
> no backups taken for the past three months?  Ouch.  The guy in the
> mirror got you good (been there, done that).

Indeed. The usual agreement among sysadmins is that you
need 3 independent backups. You absolutely need 2, as 
during an update you may destroy one and only find out
your primary data is bad at the same time. The 3rd one
is to have one more than the absolute minimum.

Arno
-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier

Re: [dm-crypt] Data recovery recomendations needed

[Arno Wagner]

Data recovery people have the sector-checksums the disk does. 
For a (potentially very expensive) file-level recovery, you 
just provide the passprase to them, at least the competent ones
will be able to handle LUKS.

Arno

On Tue, Apr 21, 2015 at 11:34:56 CEST, Sven Eschenberg wrote:
> Hio David,
> 
> Well, if they can not see the files, they can hardly verify the disk and
> data is readable (well they only can to a limited extent).
> 
> Anyway, I remember that i.e. Kroll Ontrack DID offer quite a variety of
> options back in the days. They would either send the 'repaired' drive back
> but without any guarantee on how long it might be working outside their
> lab or they would offer a sector by sector copy of what the disk spits
> out. There's no guarantee whatsoever that sectors are not corrupted
> (obviously).
> 
> Regards
> 
> -Sven
> 
> On Tue, April 21, 2015 06:38, David Backer wrote:
> > My question was, How do I get data off the broken drive
> > if the data recovery people will not take it because it has
> > encryption?
> > Do you know of any that would?
> > Even if they just copied off the raw sectors, I could use
> > them to recover the data if I moved it to a new drive
> > provided that the LVM info and the LUKS headers are intact
> > right?
> >
> > Thanks again, David
> >
> 
> 
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier

Re: [dm-crypt] Data recovery recomendations needed

[Sven Eschenberg]

On Tue, April 21, 2015 20:49, Arno Wagner wrote:
> Data recovery people have the sector-checksums the disk does.

They have, and might give you a bad sector list (for a sector copy that
is). Then again, you never know WHAT failure occured - there is a slight
chance of recovering data with coherent checksums that is broken. Not all
failures have physical media damage or completely fried chips ;-).

> For a (potentially very expensive) file-level recovery, you
> just provide the passprase to them, at least the competent ones
> will be able to handle LUKS.

Indeed. File Recovery is usually VERY costly (at least to disk overhaul -
cheapest - and sector copy - medium cost). Usually they will pretty much
offer whatever you want. I.E.: They will take a look at the disk, check if
the LUKS header is intact (or send a recovered copy on demand for the
customer to check it) and will choose to proceed the way the customer
wants.

>
> Arno
>

Regards

-Sven


> On Tue, Apr 21, 2015 at 11:34:56 CEST, Sven Eschenberg wrote:
>> Hio David,
>>
>> Well, if they can not see the files, they can hardly verify the disk and
>> data is readable (well they only can to a limited extent).
>>
>> Anyway, I remember that i.e. Kroll Ontrack DID offer quite a variety of
>> options back in the days. They would either send the 'repaired' drive
>> back
>> but without any guarantee on how long it might be working outside their
>> lab or they would offer a sector by sector copy of what the disk spits
>> out. There's no guarantee whatsoever that sectors are not corrupted
>> (obviously).
>>
>> Regards
>>
>> -Sven
>>
>> On Tue, April 21, 2015 06:38, David Backer wrote:
>> > My question was, How do I get data off the broken drive
>> > if the data recovery people will not take it because it has
>> > encryption?
>> > Do you know of any that would?
>> > Even if they just copied off the raw sectors, I could use
>> > them to recover the data if I moved it to a new drive
>> > provided that the LVM info and the LUKS headers are intact
>> > right?
>> >
>> > Thanks again, David
>> >
>>
>>
>> _______________________________________________
>> dm-crypt mailing list
>> dm-crypt@saout.de
>> http://www.saout.de/mailman/listinfo/dm-crypt
>
> --
> Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
> GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D
> 9718
> ----
> A good decision is based on knowledge and not on numbers. -- Plato
>
> If it's in the news, don't worry about it.  The very definition of
> "news" is "something that hardly ever happens." -- Bruce Schneier
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt
>