External LUKS HDD
Posted: 20 May 2020, 17:37
Hi all,
I have an external disk encrypted with LUKS that got corrupted, I think it's a filesystem problem but I'm not sure. Unfortunately the header backup was lost and I can't figure out how the problem occurred. I've read other posts from this forum that said to add a new partition of LUKS, but I don't know if this is the correct procedure in my case, so I opened a new topic.
I tried to run some tests with Testdisk. Here are the logs of what I did:
Some screenshots:
What are the next steps I should take? Is there any hope of fixing?
I have an external disk encrypted with LUKS that got corrupted, I think it's a filesystem problem but I'm not sure. Unfortunately the header backup was lost and I can't figure out how the problem occurred. I've read other posts from this forum that said to add a new partition of LUKS, but I don't know if this is the correct procedure in my case, so I opened a new topic.
I tried to run some tests with Testdisk. Here are the logs of what I did:
Code: Select all
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.19.0-9-amd64 (#1 SMP Debian 4.19.118-2 (2020-04-29)) x86_64
Compiler: GCC 8.2
ext2fs lib: 1.44.5, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.1
/dev/sda: LBA, LBA48 support
/dev/sda: size 1953525168 sectors
/dev/sda: user 1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Samsung M3 Portable, FW:1402
Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB - Samsung M3 Portable
Partition table type: Intel
Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or EXFAT boot
1 * HPFS - NTFS 0 1 2 243200 254 63 3907024001
1 * HPFS - NTFS 0 1 2 243200 254 63 3907024001
ntfs_mst_post_read_fixup_warn: magic: 0xfb979bd7 size: 1024 usa_ofs: 44808 usa_count: 53332: Invalid argument
Record 0 has no FILE magic (0xfb979bd7)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xfb979bd7 size: 1024 usa_ofs: 44808 usa_count: 53332: Invalid argument
Record 0 has no FILE magic (0xfb979bd7)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xfb979bd7 size: 1024 usa_ofs: 44808 usa_count: 53332: Invalid argument
Record 0 has no FILE magic (0xfb979bd7)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xfb979bd7 size: 1024 usa_ofs: 44808 usa_count: 53332: Invalid argument
Record 0 has no FILE magic (0xfb979bd7)
Failed to load $MFT: Input/output error
Backup partition structure
partition_save
search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
recover_EXT2: s_block_group_nr=0/14355, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 470414080
recover_EXT2: part_size 3763312640
Linux 0 1 2 234255 97 18 3763312640
ext4 blocksize=4096 Large_file Sparse_SB, 1926 GB / 1794 GiB
NTFS at 243200/254/63
filesystem size 3907024001
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 2 243200 254 63 3907024001
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 243200/254/63
filesystem size 3907024001
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
HPFS - NTFS 243200 254 63 486401 253 61 3907024001
NTFS, blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=3907024064, size=3907024001, end=7814048064, disk end=3907029168)
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 4000 GB / 3726 GiB)
The following partition can't be recovered:
HPFS - NTFS 243200 254 63 486401 253 61 3907024001
NTFS, blocksize=4096, 2000 GB / 1863 GiB
Results
Linux 0 1 2 234255 97 18 3763312640
ext4 blocksize=4096 Large_file Sparse_SB, 1926 GB / 1794 GiB
HPFS - NTFS 0 1 2 243200 254 63 3907024001
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 3763312640 linear /dev/sdb 64" | dmsetup create test0
echo "0 3907024001 linear /dev/sdb 64" | dmsetup create test1
dir_partition inode=2
Linux 0 1 2 234255 97 18 3763312640
ext4 blocksize=4096 Large_file Sparse_SB, 1926 GB / 1794 GiB
ext2fs_dir_iterate failed with error 2133571402.
Directory /
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
Not an exFAT boot sector.
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
HPFS - NTFS 0 1 2 243200 254 63 3907024001
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
Can't open filesystem. Filesystem seems damaged.
interface_write()
1 P Linux 0 1 2 234255 97 18 3763312640
search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
recover_EXT2: s_block_group_nr=0/14355, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 470414080
recover_EXT2: part_size 3763312640
Linux 0 1 2 234255 97 18 3763312640
ext4 blocksize=4096 Large_file Sparse_SB, 1926 GB / 1794 GiB
Linux 0 1 2 0 66 2 4096
LUKS 1 (Data size unknown), 2097 KB / 2048 KiB
NTFS at 243200/254/63
filesystem size 3907024001
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 2 243200 254 63 3907024001
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 243200/254/63
filesystem size 3907024001
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
HPFS - NTFS 243200 254 63 486401 253 61 3907024001
NTFS, blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=3907024064, size=3907024001, end=7814048064, disk end=3907029168)
Search for partition aborted
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 4000 GB / 3726 GiB)
The following partition can't be recovered:
HPFS - NTFS 243200 254 63 486401 253 61 3907024001
NTFS, blocksize=4096, 2000 GB / 1863 GiB
Results
Linux 0 1 2 0 66 2 4096
LUKS 1 (Data size unknown), 2097 KB / 2048 KiB
Linux 0 1 2 234255 97 18 3763312640
ext4 blocksize=4096 Large_file Sparse_SB, 1926 GB / 1794 GiB
HPFS - NTFS 0 1 2 243200 254 63 3907024001
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 4096 linear /dev/sdb 64" | dmsetup create test0
echo "0 3763312640 linear /dev/sdb 64" | dmsetup create test1
echo "0 3907024001 linear /dev/sdb 64" | dmsetup create test2
dir_partition inode=2
Linux 0 1 2 234255 97 18 3763312640
ext4 blocksize=4096 Large_file Sparse_SB, 1926 GB / 1794 GiB
ext2fs_dir_iterate failed with error 2133571402.
Directory /
dir_partition inode=2
Linux 0 1 2 0 66 2 4096
LUKS 1 (Data size unknown), 2097 KB / 2048 KiB
ext2fs_dir_iterate failed with error 2133571402.
Directory /
interface_write()
1 P Linux 0 1 2 0 66 2 4096
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or EXFAT boot
1 * HPFS - NTFS 0 1 2 243200 254 63 3907024001
1 * HPFS - NTFS 0 1 2 243200 254 63 3907024001
search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
recover_EXT2: s_block_group_nr=0/14355, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 470414080
recover_EXT2: part_size 3763312640
Linux 0 1 2 234255 97 18 3763312640
ext4 blocksize=4096 Large_file Sparse_SB, 1926 GB / 1794 GiB
NTFS at 243200/254/63
filesystem size 3907024001
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 2 243200 254 63 3907024001
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 243200/254/63
filesystem size 3907024001
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
NTFS: Can't read MFT
HPFS - NTFS 243200 254 63 486401 253 61 3907024001
NTFS, blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=3907024064, size=3907024001, end=7814048064, disk end=3907029168)
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 4000 GB / 3726 GiB)
The following partition can't be recovered:
HPFS - NTFS 243200 254 63 486401 253 61 3907024001
NTFS, blocksize=4096, 2000 GB / 1863 GiB
Results
Linux 0 1 2 234255 97 18 3763312640
ext4 blocksize=4096 Large_file Sparse_SB, 1926 GB / 1794 GiB
HPFS - NTFS 0 1 2 243200 254 63 3907024001
NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 3763312640 linear /dev/sdb 64" | dmsetup create test0
echo "0 3907024001 linear /dev/sdb 64" | dmsetup create test1
dir_partition inode=2
Linux 0 1 2 234255 97 18 3763312640
ext4 blocksize=4096 Large_file Sparse_SB, 1926 GB / 1794 GiB
ext2fs_dir_iterate failed with error 2133571402.
Directory /
interface_write()
1 P Linux 0 1 2 234255 97 18 3763312640
What are the next steps I should take? Is there any hope of fixing?