Page 1 of 1
PhotoRec and Encrypted Disks
Posted: 15 Jan 2014, 02:02
by Ryon
I have an encrypted Ubuntu filesystem that I partially reformatted FAT three years ago by accident. I can mount the disk and read part of the data, but unfortunately not the data that I am looking for. TestDisk was not able to repair the filesystem, and PhotoRec didn't find my data.
My question is on an encrypted Luks volume, is TestDisk viewing the unencrypted data, or is it only searching the raw encrypted sectors? Would file system damage affect such a data recovery?
Re: PhotoRec and Encrypted Disks
Posted: 25 May 2014, 23:37
by Ryon
Several months later, and I still need this information:
My filesystem is mounting only up to a point where it was damaged, a few megs into a several-gigabyte system. Since it is LUKS encrypted, can PhotoRec even "see" the files to be recovered?
Is there any hope of extending the point at which the filesystem can be read? TestDisk was apparently not able to do this alone.
Re: PhotoRec and Encrypted Disks
Posted: 28 May 2014, 07:09
by cgrenier
If you can unlock the encrypted volume, "cryptsetup luksOpen device name", when you run photorec, select /dev/mapper/name.
Re: PhotoRec and Encrypted Disks
Posted: 29 May 2014, 02:45
by Ryon
cgrenier wrote:If you can unlock the encrypted volume, "cryptsetup luksOpen device name", when you run photorec, select /dev/mapper/name.
Thanks for the response!
I can unlock the encrypted volume, but only the first few thousand k show in the mapper. The encrypted volume is about 650 gig.
Code: Select all
Select a media (use Arrow keys, then press Enter):
Disk /dev/sda - 750 GB / 698 GiB (RO) - ST3750640AS
Disk /dev/sdb - 500 GB / 465 GiB (RO) - ST3500630A
Disk /dev/sdc - 2000 GB / 1863 GiB (RO) - Seagate Desktop
Disk /dev/mapper/fedora-home - 439 GB / 409 GiB (RO)
Disk /dev/mapper/fedora-root - 53 GB / 50 GiB (RO)
Disk /dev/mapper/fedora-swap - 6190 MB / 5904 MiB (RO)
Disk /dev/mapper/luks-821190f5-8d48-485e-8b20-d5becb49c40e - 499 GB / 465 GiB (RO)
>Disk /dev/mapper/luksnevada - 7140 KB / 6973 KiB (RO) < --- this one ---
Disk /dev/dm-0 - 499 GB / 465 GiB (RO)
Disk /dev/dm-1 - 53 GB / 50 GiB (RO)
Disk /dev/dm-2 - 6190 MB / 5904 MiB (RO)
Disk /dev/dm-3 - 439 GB / 409 GiB (RO)
Disk /dev/dm-4 - 7140 KB / 6973 KiB (RO)
>[Proceed ] [ Quit ]
Code: Select all
Disk /dev/mapper/luksnevada - 7140 KB / 6973 KiB (RO)
Partition Start End Size in sectors
Unknown 0 0 1 13945 0 1 13946 [Whole disk]
> P Linux LVM2 0 0 1 13945 0 1 13946
Background: This is an older Ubuntu encrypted volume. One day I went to reformat a USB drive with UNetbootin, which defaulted to my system drive and . . . well, I stopped it as quickly as I could.
Earlier, when I mounted this disk on an openSUSE system, it would mount and recognize a few k of files. I am now running Fedora and can't get the desktop to accept the LUKS password at all, other than thru the console and cryptsetup as above.
PhotoRec recovers nothing. Is there any hope of repair or recovery?
Re: PhotoRec and Encrypted Disks
Posted: 31 May 2014, 08:05
by cgrenier
Can you check the size of the LUKS partition ? Is it also only 8 MB ?
Re: PhotoRec and Encrypted Disks
Posted: 05 Jun 2014, 03:38
by Ryon
cgrenier wrote:Can you check the size of the LUKS partition ? Is it also only 8 MB ?
Parted Magic reports the disk as:
/dev/sda1 7.81 mb crypt-luks
unallocated 698.39 GB
My present system says:
sda1 7.8 mb crypto_LUKS
sda2 1kb unknown
sda5 243.1 ext2
I hope this is the information that you need. This disk is very worth the trouble IF there is a possibility of recovering the data. But if there's no hope, I'd like to know.
Thank you very much for your help!
Re: PhotoRec and Encrypted Disks
Posted: 05 Jul 2014, 16:31
by Ryon
Bump?
This was a 700gig+ partition. The above shows what I know about it now.