Help a newbie recover encrypted partitions from USB stick after accidental format.

[pavlidis]

Hello everyone. I have a dual boot laptop with Windows 10 and Manjaro Linux. On Manjaro Linux I used the GNOME Disks tool to encrypt a Sandisk 128 gb USB stick. I accidentally formatted this USB stick on Windows 10 (while trying to clean the keyboard).

I installed TestDisk on Manjaro and tried PhotoRec first as most of the files I want to recover are pictures. I specified the recovery path on my home/desktop and not on the USB stick. It didn't work. I only recovered a "report.xml" file a ".luks" file and a ".swf" file.

I tried TestDisk next which is kinda overwhelming. I am not very tech savvy and English is not my main language. The steps I did were:

1. Run

Code: Select all

sudo teskdisk[/code ] from terminal and gave my password.
2. Selected [code]create

and pressed enter.
3. Selected the SanDisk usb stick and pressed proceed.
4. Selected

Code: Select all

Intel Partition

as hinted and then enter.
5. Selected

Code: Select all

Analyse

and hit enter.
6. Selected

Code: Select all

Quick Search

and hit enter. I waited for a few mins for the utility to analyze the cylinders as shown in the above picture: [/img].
7. When the process was done it found a Primary bootable Linux partition. I presssed enter to continue. [/img].
8. I did a deeper search and waited. [/img].
9. When the deeper search ended I was presented with 2 deleted partitions. A Linux one which I am guessing its the partition containing the encryption(password) and a HPFS - NTFS partition which I assume contains the actual pictures. [/img].

How do I proceed from here guys? I am kinda stuck as I dont understand what to do next.

Sorry for the long post and thanks in advance for your help.

[recuperation]

You have to decrypt your stick first. Recovery software including Testdisk and Photorec can only work on readible media.

[pavlidis]

How can I decrypt the USB stick? Its empty. It was formatted. I can open it without asking for a password or something.

[recuperation]

Do you have a LUKS header-backup?

Your header might have been destroyed by the format operation.

viewtopic.php?p=30640#p30640

[pavlidis]

Unfortunately I don't have a LUKS header-backup.

[recuperation]

What did you encrypt?
The whole stick or the partition on the stick (assuming there was not more than one partition)?

[pavlidis]

Its been years but I think I encrypted the whole USB stick.

[recuperation]

In this case recovery is impossible.

Please show the first sector of your USB-stick by copying it into a file named "mbr.bin" p.e..

Replace the content of the [] marked areas in the command below, you might have to use the sudo command:

Code: Select all

(sudo) dd if=[path to your USB device] of=/home/[yourprofile]/mbr.bin bs=512 count=1

Post the command you used and try to upload this binary file here or link it from the forum.