recover a pre-luks partition

[aged1000]

Hi there. I searched exhaustively for luks but didn't find anything that addresses my particular tale of woe.

I have a 3TB external USB3 drive which had a single NTFS partition (although I believe windows slips in a hidden partition before the first one). Quite inexcusably I applied the following command to the disk (obviously it was meant for a different disk): cryptsetup -c aes-cbc-essiv:sha256 -y -s 256 luksFormat /dev/sdb disk

If I run cryptsetup luksOpen /dev/sdb disk (at least I've remembered the password), /dev/mapper/disk gets exposed. No data has been written to this disk since the accidental 'luks-ing'. Would I therefore be correct in assuming that decrypted, as /dev/mapper/disk, my data from the NTFS partition should still be in tact?

I'm currently using TestDisk to analyse /dev/mapper/disk. It produces two options: the first seems far too small, perhaps it's the hidden windows partition. The second seems more on target but once the analysis is complete it disappears. If I do a deeper search it only searches within the partition I've described as too small.

The numbers for the "small" partition are:

73123106 73659845 536739 732562549
292,492,424 294,639,380‬ 2,146,956 2,930,250,196
278GB 280GB 2GB 2794GB

The first row are sector numbers and the total number is correct. The second row is me converting them into kilobytes (assuming 4k) so the third is GB. Again 2,794GB is the size of the disk but it seems to me that a span of 2GB is being indicated as recoverable. This was certainly not the size of the primary partition and I had appx 2.3TB on the disk

Any comments as to whether I'm doing this in the right way would be appreciated as well as about the data I've provided so far. I will also revert with the second set of numbers that appeared and disappeared if I can get them again.

By the way, just think of other approaches, could I somehow use kpartx to make /dev/mapper/disk mountable or is that just going to land me in a world of device mapper disorientation?

[cgrenier]

Umount and close your LUKS volume and next, use TestDisk on /dev/sdb to recover your NTFS partition.

[aged1000]

Thank you. It's begun creating the image file image.dd - presumably I will need to run testdisk on the image file when it's been copied and see what turns up. I'll revert if necessary. Thanks again.

[aged1000]

I seem to be going round in circles a little bit. I ran testdisk on /dev/sdb which created the file image.dd which was an identical size to /dev/sdb. I then ran testdisk on ./image.dd which started the image preparation process again, as if it was going to make an image of image.dd

I was also thinking: surely to get at the data (which as I've said, must still be there), it needs first to be visible by entering in the encryption password for the luks-dmcrypt layer. That reveals /dev/mapper/DISK which has not been touched since the creation of the original luks header and is the layer where the NTFS data should be found. So I run cryptsetup luksOpen /dev/sdb DISK to map to /dev/mapper/DISK. If I run testdisk on /dev/sdb with decrypting first, surely there is nothing to see as it presents itself to testdisk as a luks encrypted disk.

So back to basics. The NTFS disk had the following command performed on it: cryptsetup luksFormat /dev/sdb DISK and an initial password was entered. /dev/mapper/DISK appeared for the first time but I did not format it as one would if one was looking to create a usable encrypted disk. I just closed the mapper. If the NTFS data is on the /dev/mapper/DISK layer, how can I use testdisk to get at it? Presumably it terms of what has to be done, the NTFS data (aka partition from the previous FS) has to be found and a new GPT label needs writing. FYI, there is only one NTFS partition (all of which I need) and it's the size of the whole disk (2.7TB/3TIB). Assuming it's there as I think it is (if not I have a whole different problem), I just need a new GPT label and partition table right? How to do it though???

[aged1000]

Hi everyone, I think I've made some progress but would appreciate any further advice. The attached captures which are named in sequence are the steps I've taken. Obviously the final one is the concern. I went back to the advanced menu and tried undelete which did not work.

Do I have any further options in order to proceed?

Note this post won't accept the final two screen grabs so I'll insert them into the next.

step1

Capture.JPG (173.79 KiB) Viewed 1492 times

step2

Capture1.JPG (138.11 KiB) Viewed 1492 times

step3

Capture2.JPG (76.77 KiB) Viewed 1492 times

[aged1000]

Final two screen grabs:

Capture3.JPG (207.87 KiB) Viewed 1491 times

Capture4.JPG (85.93 KiB) Viewed 1491 times