Re: [dm-crypt] Broken LUKS header

[Robert Nichols <rnicholsNOSPAM@comcast.net>]

On 09/03/2014 04:03 AM, Andreas Aßmann wrote:
> A few days ago, I tried to add a key file to all three volumes using 'cryptsetup
> luksAddKey'. The command succeeded for sda2 and sda3. Adding the key file to
> sdb1, however, failed with 'Invalid Key Slot 6, Invalid Key Slot 7'. It seems
> the LUKS header of sdb1 was corrupted in the process. Probing the header using
> 'cryptsetup luksDump' fails with the same error message.
>
> Fortunately, sdb1 was unlocked and mounted when this happened - I was still able
> to access data on this volume and from what I've seen, everything is still
> intact, so I created a complete backup right away using rsync. However, I would
> feel much better if I could repair the header to verify that the backup I made
> actually contains all data from sdb1.
>
> I also created a 1:1 backup of sdb1 using dd. On this backup, I tried
> 'keyslot_checker' and 'cryptsetup repair'. The first didn't work at all, the
> latter reported invalid offsets for key slots 6 and 7 and fixed them. However, I
> was unable to open the volume using my normal passphrase afterwards, so that
> didn't work out as expected.

Do you still have sdb1 unlocked? If so, you can recover the master key and
also make a backup image of the decrypted volume. Instructions for recovering
the master key are in section 6.10 of the Cryptsetup FAQ at
  <http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions>

To save an image of the decrypted volume just use dd to copy the
/dev/mapper/xxx device to a file somewhere.

-- 
Bob Nichols     "NOSPAM" is really part of my email address.
                 Do NOT delete it.