Recovering LUKS partition and Truecrypt partition.

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
User avatar
Radomir
Posts: 4
Joined: 02 Oct 2018, 19:58

Recovering LUKS partition and Truecrypt partition.

#1 Post by Radomir »

Hello everybody! Today is a good day, and all because I found this forum :) .

I will try to state my story and the essence of the problem as briefly as possible so that in the future this topic will help people solve their difficulties. I am from Russia and I use google translator, so if something is unclear ask, and I will clarify. Good? Then I will continue:

Last week I installed bad Windows updates, after that the system broke down and stopped loading, Windows was encrypted by Truecrypt, then I had to permanently decrypt the partition. Everything went well, removed the encryption from Windows, recovered the information. Then I started formatting the 1st partition of the disk and lost the MBR partition table ... At this moment I copied information from one disk to another, I opened GPATED and saw that the entire hard drive was displayed as one unit - unallocated partition ... then my computer hung and the mouse did not move on the screen, and I had to reboot. After began "Dancing with a tambourine" ...

:arrow: Installed systems before failure:
  • Windows - encrypted by TRUECRYPT
    Ubuntu - encrypted by LUKS
:arrow: A sample list of partitions before a breakdown:
dev / sda - 500 GB / 465 GiB - CHS 60801 255 63:

dev / sda1 - 100g - Windows 10 (already decrypted partition)
dev / sda2 - 200g - Truecrypt cryptocontainer
dev / sda3 - 165g - LUKS cryptocontainer, and inside it:
- dev / sda 4 LVM section
- dev / sda 5 SWAP
- dev / sda 6 ROOT

The / boot partition is located on a removable USB flash drive - / dev / sdb1.
:arrow: Then I ran TESTDISK several times in two modes:

:idea: 1. INTEL PARTITION / DEEPSEARCH
I conducted a search in INTEL several times: the first time I did not write logs, but I recorded a partition table. Then I came back spent again DEEPSEARCH and recorded the log.

Code: Select all


Tue Oct  2 21:00:52 2018
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.10.0-38-generic (#42~16.04.1-Ubuntu SMP Tue Oct 10 16:32:20 UTC 2017) x86_64
Compiler: GCC 5.3
ext2fs lib: 1.42.13, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.0
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       976773168 sectors
/dev/sda: user_max   976773168 sectors
/dev/sda: native_max 976773168 sectors
/dev/sda: dco        976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000LPCX-00VHAT0, S/N:WD-WXV1A97NKFTV, FW:01.01A01
Disk /dev/sdb - 30 GB / 28 GiB - CHS 29327 64 32, sector size=512 - SanDisk Ultra USB 3.0, FW:1.00
Disk /dev/sdd - 31 GB / 28 GiB - CHS 29568 64 32, sector size=512, FW:PMAP

Partition table type (auto): Intel
Disk /dev/sda - 500 GB / 465 GiB - WDC WD5000LPCX-00VHAT0
Partition table type: Intel

Analyse Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
check_part_i386 failed for partition type 07
check_part_i386 failed for partition type 83
check_part_i386 failed for partition type 07
Current partition structure:
 1 * HPFS - NTFS              0  32 33 13498  15 21  216844288
Invalid NTFS or EXFAT boot
 2 P HPFS - NTFS          13498  47 54 28067  89 54  234053632
 2 P HPFS - NTFS          13498  47 54 28067  89 54  234053632
No ext2, JFS, Reiser, cramfs or XFS marker
 3 P Linux                28067  89 55 49082 198 19  337612807
 3 P Linux                28067  89 55 49082 198 19  337612807
Invalid NTFS or EXFAT boot
 4 P HPFS - NTFS          49082 198 20 60801  47 46  188256249
 4 P HPFS - NTFS          49082 198 20 60801  47 46  188256249

search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size           216844288
sectors_per_cluster       8
mft_lcn                   10941717
mftmirr_lcn               13552767
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 13498  15 21  216844288
     NTFS, blocksize=4096, 111 GB / 103 GiB
BAD_RS LBA=216848384 2048
check_part_i386 failed for partition type 07
     HPFS - NTFS          13498  47 54 28067  89 54  234053632

Results
   * HPFS - NTFS              0  32 33 13498  15 21  216844288
     NTFS, blocksize=4096, 111 GB / 103 GiB
   P HPFS - NTFS          13498  47 54 28067  89 54  234053632

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 216844288 linear /dev/sda 2048" | dmsetup create test0
echo "0 234053632 linear /dev/sda 216848384" | dmsetup create test1

interface_write()
 1 * HPFS - NTFS              0  32 33 13498  15 21  216844288
 2 P HPFS - NTFS          13498  47 54 28067  89 54  234053632

search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size           216844288
sectors_per_cluster       8
mft_lcn                   10941717
mftmirr_lcn               13552767
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 13498  15 21  216844288
     NTFS, blocksize=4096, 111 GB / 103 GiB
NTFS at 13498/15/21
filesystem size           216844288
sectors_per_cluster       8
mft_lcn                   10941717
mftmirr_lcn               13552767
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 13498  15 21  216844288
     NTFS found using backup sector, blocksize=4096, 111 GB / 103 GiB
BAD_RS LBA=216848384 2048
check_part_i386 failed for partition type 07
     HPFS - NTFS          13498  47 54 28067  89 54  234053632
NTFS at 60801/47/46
filesystem size           188256249
sectors_per_cluster       8
mft_lcn                   2
mftmirr_lcn               39
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS          49082 198 20 60801  47 46  188256249
     NTFS found using backup sector, blocksize=4096, 96 GB / 89 GiB

Results
   * HPFS - NTFS              0  32 33 13498  15 21  216844288
     NTFS, blocksize=4096, 111 GB / 103 GiB
   P HPFS - NTFS          13498  47 54 28067  89 54  234053632
   P HPFS - NTFS          49082 198 20 60801  47 46  188256249
     NTFS found using backup sector, blocksize=4096, 96 GB / 89 GiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 216844288 linear /dev/sda 2048" | dmsetup create test0
echo "0 234053632 linear /dev/sda 216848384" | dmsetup create test1
echo "0 188256249 linear /dev/sda 788514823" | dmsetup create test2

interface_write()
 1 * HPFS - NTFS              0  32 33 13498  15 21  216844288
 2 P HPFS - NTFS          13498  47 54 28067  89 54  234053632
 3 P HPFS - NTFS          49082 198 20 60801  47 46  188256249
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
New options :
 Dump : No
 Align partition: Yes
 Expert mode : No

Analyse Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
check_part_i386 failed for partition type 07
check_part_i386 failed for partition type 83
check_part_i386 failed for partition type 07
Current partition structure:
 1 * HPFS - NTFS              0  32 33 13498  15 21  216844288
Invalid NTFS or EXFAT boot
 2 P HPFS - NTFS          13498  47 54 28067  89 54  234053632
 2 P HPFS - NTFS          13498  47 54 28067  89 54  234053632
No ext2, JFS, Reiser, cramfs or XFS marker
 3 P Linux                28067  89 55 49082 198 19  337612807
 3 P Linux                28067  89 55 49082 198 19  337612807
Invalid NTFS or EXFAT boot
 4 P HPFS - NTFS          49082 198 20 60801  47 46  188256249
 4 P HPFS - NTFS          49082 198 20 60801  47 46  188256249
:idea: 2. NONE PARTITION MEDIA / DEEPSEARCH
Here I recorded logs and found at least some information about the LUKS partition.

Code: Select all


Wed Oct  3 01:34:31 2018
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.10.0-38-generic (#42~16.04.1-Ubuntu SMP Tue Oct 10 16:32:20 UTC 2017) x86_64
Compiler: GCC 5.3
ext2fs lib: 1.42.13, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.0
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       976773168 sectors
/dev/sda: user_max   976773168 sectors
/dev/sda: native_max 976773168 sectors
/dev/sda: dco        976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000LPCX-00VHAT0, S/N:WD-WXV1A97NKFTV, FW:01.01A01
Disk /dev/sdb - 30 GB / 28 GiB - CHS 29327 64 32, sector size=512 - SanDisk Ultra USB 3.0, FW:1.00
Disk /dev/sde - 31 GB / 28 GiB - CHS 29568 64 32, sector size=512, FW:PMAP

Partition table type (auto): Intel
Disk /dev/sda - 500 GB / 465 GiB - WDC WD5000LPCX-00VHAT0
Partition table type: None

Analyse Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Current partition structure:
   P Unknown                  0   0  1 60801  80 63  976773168

search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size           216844288
sectors_per_cluster       8
mft_lcn                   10941717
mftmirr_lcn               13552767
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=111024275456, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size           216844288
sectors_per_cluster       8
mft_lcn                   10941717
mftmirr_lcn               13552767
clusters_per_mft_record   -10
clusters_per_index_record 1
     NTFS                     0  32 33 13498  15 21  216844288
     NTFS, blocksize=4096, 111 GB / 103 GiB
Search for partition aborted

Results
   P NTFS                     0  32 33 13498  15 21  216844288
     NTFS, blocksize=4096, 111 GB / 103 GiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 216844288 linear /dev/sda 2048" | dmsetup create test0

interface_write()
   P NTFS                     0  32 33 13498  15 21  216844288
 
Write isn't available because the partition table type "None" has been selected.

search_part()
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
NTFS at 0/32/33
filesystem size           216844288
sectors_per_cluster       8
mft_lcn                   10941717
mftmirr_lcn               13552767
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1048576, part_size=111024275456, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 0/32/33
filesystem size           216844288
sectors_per_cluster       8
mft_lcn                   10941717
mftmirr_lcn               13552767
clusters_per_mft_record   -10
clusters_per_index_record 1
     NTFS                     0  32 33 13498  15 21  216844288
     NTFS, blocksize=4096, 111 GB / 103 GiB

LVM magic value at 188/226/37
NTFS at 1039/16/18
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  1038 173 19  1039  16 18       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 1039/16/18
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  1039  16 18  1039 114 17       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
NTFS at 1039/114/44
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  1039  16 45  1039 114 44       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 1039/114/44
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  1039 114 44  1039 212 43       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
NTFS at 1039/212/62
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  1039 114 63  1039 212 62       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 1039/212/62
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  1039 212 62  1040  55 61       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
NTFS at 1040/56/25
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  1039 213 26  1040  56 25       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 1040/56/25
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  1040  56 25  1040 154 24       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
NTFS at 1245/156/24
filesystem size           216844288
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               13552767
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=10245517312, part_size=111024275456, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 1245/156/24
filesystem size           216844288
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               13552767
clusters_per_mft_record   -10
clusters_per_index_record 1
     NTFS                  1245 156 24 14743 139 12  216844288
     NTFS, blocksize=4096, 111 GB / 103 GiB

HFS magic value at 1513/109/15
part_size 301989890
     HFS                   1513 109 15 20311 109 34  301989890 [ÿÿÿâD$]
     HFS blocksize=16777216, 154 GB / 144 GiB

HFS magic value at 1513/109/17
FAT12 at 1622/194/37
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 1622/194/37
     FAT12                 1622 194 37  1622 240 18       2880 [EFISECTOR]
     FAT12, blocksize=512, 1474 KB / 1440 KiB

HFS magic value at 1850/147/6
part_size 1987906052
     HFS                   1850 147  6 125592   1 25 1987906052 [ ]
     HFS blocksize=16777216, 1017 GB / 947 GiB
This partition ends after the disk limits. (start=29729516, size=1987906052, end=2017635567, disk end=976773168)

HFS magic value at 1850/147/8
FAT12 at 2047/131/5
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 2047/131/5
     FAT12                 2047 131  5  2047 176 49       2880 [EFISECTOR]
     FAT12, blocksize=512, 1474 KB / 1440 KiB
NTFS at 2055/15/57
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  2054 172 58  2055  15 57       6174
     NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB
NTFS at 2055/15/57
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
     NTFS                  2055  15 57  2055 113 56       6174 [Boot]
     NTFS, blocksize=512, 3161 KB / 3087 KiB
FAT32 at 2064/242/27
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-8222
FAT2 : 8223-16413
start_rootdir : 16414 root cluster : 2
Data : 16414-67108829
sectors : 67108860
cluster_size : 64
no_of_cluster : 1048319 (2 - 1048320)
fat_length 8191 calculated 8191
FAT differs, FAT sectors=0-16/8191
set_FAT_info: name from BS used

FAT32 at 2064/242/27
     FAT32                 2064 242 27  6242  72 26   67108860 [NO NAME]
     FAT32, blocksize=32768, 34 GB / 31 GiB
FAT32 at 2064/242/29
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT1 : 32-8222
FAT2 : 8223-16413
start_rootdir : 16414 root cluster : 2
Data : 16414-67108829
sectors : 67108860
cluster_size : 64
no_of_cluster : 1048319 (2 - 1048320)
fat_length 8191 calculated 8191
FAT differs, FAT sectors=0-16/8191
set_FAT_info: name from BS used

FAT32 at 2064/242/29
     FAT32                 2064 242 29  6242  72 28   67108860 [NO NAME]
     FAT32, blocksize=32768, 34 GB / 31 GiB

recover_EXT2: s_block_group_nr=0/2, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 65536
recover_EXT2: part_size 524288
     ext3                  2675 130 32  2708  37 33     524288
     ext3 blocksize=4096 Large_file Sparse_SB Recover, 268 MB / 256 MiB

recover_EXT2: s_block_group_nr=0/40, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
     ext3                  2675 132 34  3328  58 10   10485760
     ext3 blocksize=4096 Large_file Sparse_SB Recover, 5368 MB / 5120 MiB

recover_EXT2: s_block_group_nr=0/40, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
     ext3                  2678 130 61  3331  56 37   10485760
     ext3 blocksize=4096 Large_file Sparse_SB Recover, 5368 MB / 5120 MiB

recover_EXT2: s_block_group_nr=0/40, s_mnt_count=1/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
     ext3                  2678 132 55  3331  58 31   10485760
     ext3 blocksize=4096 Large_file Sparse_SB Recover, 5368 MB / 5120 MiB

HFS magic value at 3574/90/9
part_size 742392066
     HFS                   3574  90  9 49786  31 11  742392066
     HFS blocksize=16777216, 380 GB / 354 GiB

HFS magic value at 3574/90/11

HFS magic value at 3574/94/48
part_size 742392066
     HFS                   3574  94 48 49786  35 50  742392066
     HFS blocksize=16777216, 380 GB / 354 GiB

HFS magic value at 3574/94/50

HFS magic value at 3574/96/31
part_size 742392066
     HFS                   3574  96 31 49786  37 33  742392066
     HFS blocksize=16777216, 380 GB / 354 GiB

HFS magic value at 3574/96/33

HFS magic value at 3574/101/1
part_size 742392066
     HFS                   3574 101  1 49786  42  3  742392066
     HFS blocksize=16777216, 380 GB / 354 GiB

HFS magic value at 3574/101/3

HFS magic value at 3574/102/33
part_size 742392066
     HFS                   3574 102 33 49786  43 35  742392066
     HFS blocksize=16777216, 380 GB / 354 GiB

HFS magic value at 3574/102/35

recover_EXT2: s_block_group_nr=0/2, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 65536
recover_EXT2: part_size 524288
     ext3                  3600  68 61  3632 230 62     524288
     ext3 blocksize=4096 Large_file Sparse_SB, 268 MB / 256 MiB

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/2, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 65536
recover_EXT2: part_size 524288
     ext3                  3583 251  3  3616 158  4     524288
     ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 268 MB / 256 MiB

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/2, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 65536
recover_EXT2: part_size 524288
     ext3                  3583 251  5  3616 158  6     524288
     ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 268 MB / 256 MiB

recover_EXT2: s_block_group_nr=0/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
     ext3                  3600  81 10  4253   6 49   10485760
     ext3 blocksize=4096 Large_file Sparse_SB, 5368 MB / 5120 MiB

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
     ext3                  3584 142 21  4237  67 60   10485760
     ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
     ext3                  3584 142 23  4237  67 62   10485760
     ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
     ext3                  3551 241 25  4204 167  1   10485760
     ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
     ext3                  3551 241 27  4204 167  3   10485760
     ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB

block_group_nr 5

recover_EXT2: "e2fsck -b 163840 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=5/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
     ext3                  3519  85 29  4172  11  5   10485760
     ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB

block_group_nr 5

recover_EXT2: "e2fsck -b 163840 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=5/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
     ext3                  3519  85 31  4172  11  7   10485760
     ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB

block_group_nr 7

recover_EXT2: "e2fsck -b 229376 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=7/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
     ext3                  3486 184 33  4139 110  9   10485760
     ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB

block_group_nr 7

recover_EXT2: "e2fsck -b 229376 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=7/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
     ext3                  3486 184 35  4139 110 11   10485760
     ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB

block_group_nr 9

recover_EXT2: "e2fsck -b 294912 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=9/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
     ext3                  3454  28 37  4106 209 13   10485760
     ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB

block_group_nr 9

recover_EXT2: "e2fsck -b 294912 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=9/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
     ext3                  3454  28 39  4106 209 15   10485760
     ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB

block_group_nr 25

recover_EXT2: "e2fsck -b 819200 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=25/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
     ext3                  3193  41 55  3845 222 31   10485760
     ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB

block_group_nr 25

recover_EXT2: "e2fsck -b 819200 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=25/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
     ext3                  3193  41 57  3845 222 33   10485760
     ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB

block_group_nr 27

recover_EXT2: "e2fsck -b 884736 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=27/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
     ext3                  3160 140 59  3813  66 35   10485760
     ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB

block_group_nr 27

recover_EXT2: "e2fsck -b 884736 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=27/40, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 1310720
recover_EXT2: part_size 10485760
     ext3                  3160 140 61  3813  66 37   10485760
     ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 5368 MB / 5120 MiB

recover_EXT2: s_block_group_nr=0/0, s_mnt_count=0/20, s_blocks_per_group=4352, s_inodes_per_group=16
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 4347
recover_EXT2: part_size 8694
     ext2                  5851 136 14  5852  19 13       8694
     ext2 blocksize=1024, 4451 KB / 4347 KiB

recover_EXT2: s_block_group_nr=0/4, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 131072
recover_EXT2: part_size 1048576
     ext3                  5852  21 18  5917  90 21    1048576
     ext3 blocksize=4096 Large_file Sparse_SB, 536 MB / 512 MiB

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/4, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 131072
recover_EXT2: part_size 1048576
     ext3                  5850 218 23  5916  32 26    1048576
     ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 536 MB / 512 MiB

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/4, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 131072
recover_EXT2: part_size 1048576
     ext3                  5850 218 25  5916  32 28    1048576
     ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 536 MB / 512 MiB

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/4, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 131072
recover_EXT2: part_size 1048576
     ext3                  5834  54  3  5899 123  6    1048576
     ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 536 MB / 512 MiB

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/4, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 131072
recover_EXT2: part_size 1048576
     ext3                  5834  54  5  5899 123  8    1048576
     ext3 blocksize=4096 Large_file Sparse_SB Backup_SB, 536 MB / 512 MiB
NTFS at 13498/15/21
filesystem size           216844288
sectors_per_cluster       8
mft_lcn                   10941717
mftmirr_lcn               13552767
clusters_per_mft_record   -10
clusters_per_index_record 1
     NTFS                     0  32 33 13498  15 21  216844288
     NTFS found using backup sector, blocksize=4096, 111 GB / 103 GiB
NTFS at 13498/15/21
filesystem size           216844288
sectors_per_cluster       8
mft_lcn                   10941717
mftmirr_lcn               13552767
clusters_per_mft_record   -10
clusters_per_index_record 1
     NTFS                 13498  15 21 26995 253  9  216844288
     NTFS, blocksize=4096, 111 GB / 103 GiB

     Linux LUKS           39786   5 12 39786  70 12       4096
     LUKS 1 (Data size unknown), 2097 KB / 2048 KiB
NTFS at 49940/24/53
filesystem size           220547072
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               13784191
clusters_per_mft_record   -10
clusters_per_index_record 1
     NTFS                 36211 172 43 49940  24 53  220547072
     NTFS found using backup sector, blocksize=4096, 112 GB / 105 GiB
NTFS at 49940/24/53
filesystem size           220547072
sectors_per_cluster       8
mft_lcn                   4
mftmirr_lcn               13784191
clusters_per_mft_record   -10
clusters_per_index_record 1
     NTFS                 49940  24 53 63668 131 63  220547072
     NTFS, blocksize=4096, 112 GB / 105 GiB
This partition ends after the disk limits. (start=802287664, size=220547072, end=1022834735, disk end=976773168)

SYSV4 Marker at 54010/239/62

recover_sysv4
     SysV 4               54010 239 62 423971263 237 54 6810230669312 [ÉŸE0†]
     SysV4, 3486 TB / 3171 TiB
This partition ends after the disk limits. (start=867685768, size=6810230669312, end=6811098355079, disk end=976773168)
NTFS at 60801/47/39
filesystem size           188256249
sectors_per_cluster       8
mft_lcn                   2
mftmirr_lcn               39
clusters_per_mft_record   -10
clusters_per_index_record 1
     NTFS                 49082 198 13 60801  47 39  188256249
     NTFS found using backup sector, blocksize=4096, 96 GB / 89 GiB
NTFS at 60801/47/39
filesystem size           188256249
sectors_per_cluster       8
mft_lcn                   2
mftmirr_lcn               39
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     NTFS                 60801  47 39 72519 152  2  188256249
     NTFS, blocksize=4096, 96 GB / 89 GiB
This partition ends after the disk limits. (start=976771064, size=188256249, end=1165027312, disk end=976773168)
NTFS at 60801/47/46
filesystem size           188256249
sectors_per_cluster       8
mft_lcn                   2
mftmirr_lcn               39
clusters_per_mft_record   -10
clusters_per_index_record 1
     NTFS                 49082 198 20 60801  47 46  188256249
     NTFS found using backup sector, blocksize=4096, 96 GB / 89 GiB
NTFS at 60801/47/46
filesystem size           188256249
sectors_per_cluster       8
mft_lcn                   2
mftmirr_lcn               39
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     NTFS                 60801  47 46 72519 152  9  188256249
     NTFS, blocksize=4096, 96 GB / 89 GiB
This partition ends after the disk limits. (start=976771071, size=188256249, end=1165027319, disk end=976773168)
NTFS at 1039/16/18
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
NTFS at 1039/114/44
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
NTFS at 1039/212/62
heads/cylinder 16 (NTFS) != 255 (HD)
sect/track 2 (NTFS) != 63 (HD)
filesystem size           6174
sectors_per_cluster       1
mft_lcn                   2058
mftmirr_lcn               5162
clusters_per_mft_record   2
clusters_per_index_record 8
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (500 GB / 465 GiB) seems too small! (< 3487 TB / 3171 TiB)
The following partitions can't be recovered:
     HFS                   1850 147  6 125592   1 25 1987906052 [ ]
     HFS blocksize=16777216, 1017 GB / 947 GiB
     NTFS                 49940  24 53 63668 131 63  220547072
     NTFS, blocksize=4096, 112 GB / 105 GiB
     SysV 4               54010 239 62 423971263 237 54 6810230669312 [ÉŸE0†]
     SysV4, 3486 TB / 3171 TiB
     NTFS                 60801  47 39 725

Notes and questions:



:?: 1. I tried to find the LUKS header with the help of GREP, that's what happened:

~ $ sudo grep -a -b -P --only-matching 'LUKS \ xba \ xbe' / dev / sda
grep: memory exhausted

What search should I run to find the correct information?

:?: 2. In the logs I found the lines, apparently this is the heading LUKS? How do I get it and what to do?

Linux LUKS 39786 5 12 39786 70 12 4096
LUKS 1 (Data size unknown), 2097 KB / 2048 KiB

:?: 3. In the logs, I did not find information about the TRUECRYPT section. Its size was 200g before the crash. How to find it?

Thanks!

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovering LUKS partition and Truecrypt partition.

#2 Post by cgrenier »

TestDisk can find the beginning of the LUKS partition but it can't find its size.
Usually the trick is to manually add (key 'a') a LUKS partition beginning where TestDisk has found the LUKS header and ending before the next partition or the end of the disk.

Use TestCrypt http://testcrypt.sourceforge.net/ to find a lost truecrypt partition.

User avatar
Radomir
Posts: 4
Joined: 02 Oct 2018, 19:58

Re: Recovering LUKS partition and Truecrypt partition.

#3 Post by Radomir »

cgrenier, thanks for your reply.

Please tell me, when I press "a" - the menu opens:

[cylinder] [header] [sectors] - for the start and end of the partition.

I remember exactly that my LUKS partition was the last of all partitions! so... I need to write data only about the beginning. Right?

Here is the LUKS header information:
Linux LUKS 39786 5 12 39786 70 12 4096
when I click "a" I write this:
[cylinder] - 39786
[header] - 5
[sectors] - 12
:arrow: I did so ... GPART already sees the LUKS partition. but the partition does not open.

:?: When I open by pressing "a", what should I enter correctly?

thx

User avatar
Radomir
Posts: 4
Joined: 02 Oct 2018, 19:58

Re: Recovering LUKS partition and Truecrypt partition.

#4 Post by Radomir »

Firework !!!! ))) I restored the partition! ))
I changed the settings: clicked the Expert mode, edited the end of the partition, and LUKS opened! HOORAY!! :D

User avatar
Radomir
Posts: 4
Joined: 02 Oct 2018, 19:58

Re: Recovering LUKS partition and Truecrypt partition.

#5 Post by Radomir »

I want to thank you so much! TESTDISK is the best data recovery software. I'm even surprised that this is possible ...

Thanks again. Good luck!

Locked