PhotoRec and Encrypted Disks

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Ryon
Posts: 10
Joined: 29 Dec 2013, 04:16

PhotoRec and Encrypted Disks

#1 Post by Ryon »

I have an encrypted Ubuntu filesystem that I partially reformatted FAT three years ago by accident. I can mount the disk and read part of the data, but unfortunately not the data that I am looking for. TestDisk was not able to repair the filesystem, and PhotoRec didn't find my data.

My question is on an encrypted Luks volume, is TestDisk viewing the unencrypted data, or is it only searching the raw encrypted sectors? Would file system damage affect such a data recovery?

Ryon
Posts: 10
Joined: 29 Dec 2013, 04:16

Re: PhotoRec and Encrypted Disks

#2 Post by Ryon »

Several months later, and I still need this information:

My filesystem is mounting only up to a point where it was damaged, a few megs into a several-gigabyte system. Since it is LUKS encrypted, can PhotoRec even "see" the files to be recovered?

Is there any hope of extending the point at which the filesystem can be read? TestDisk was apparently not able to do this alone.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: PhotoRec and Encrypted Disks

#3 Post by cgrenier »

If you can unlock the encrypted volume, "cryptsetup luksOpen device name", when you run photorec, select /dev/mapper/name.

Ryon
Posts: 10
Joined: 29 Dec 2013, 04:16

Re: PhotoRec and Encrypted Disks

#4 Post by Ryon »

cgrenier wrote:If you can unlock the encrypted volume, "cryptsetup luksOpen device name", when you run photorec, select /dev/mapper/name.
Thanks for the response!

I can unlock the encrypted volume, but only the first few thousand k show in the mapper. The encrypted volume is about 650 gig.

Code: Select all

Select a media (use Arrow keys, then press Enter):
 Disk /dev/sda - 750 GB / 698 GiB (RO) - ST3750640AS
 Disk /dev/sdb - 500 GB / 465 GiB (RO) - ST3500630A
 Disk /dev/sdc - 2000 GB / 1863 GiB (RO) - Seagate Desktop
 Disk /dev/mapper/fedora-home - 439 GB / 409 GiB (RO)
 Disk /dev/mapper/fedora-root - 53 GB / 50 GiB (RO)
 Disk /dev/mapper/fedora-swap - 6190 MB / 5904 MiB (RO)
 Disk /dev/mapper/luks-821190f5-8d48-485e-8b20-d5becb49c40e - 499 GB / 465 GiB (RO)
>Disk /dev/mapper/luksnevada - 7140 KB / 6973 KiB (RO)  < --- this one ---
 Disk /dev/dm-0 - 499 GB / 465 GiB (RO)
 Disk /dev/dm-1 - 53 GB / 50 GiB (RO)
 Disk /dev/dm-2 - 6190 MB / 5904 MiB (RO)
 Disk /dev/dm-3 - 439 GB / 409 GiB (RO)
 Disk /dev/dm-4 - 7140 KB / 6973 KiB (RO)


>[Proceed ]  [  Quit  ]

Code: Select all

Disk /dev/mapper/luksnevada - 7140 KB / 6973 KiB (RO)

     Partition                  Start        End    Size in sectors
      Unknown                  0   0  1 13945   0  1      13946 [Whole disk]
>   P Linux LVM2               0   0  1 13945   0  1      13946
Background: This is an older Ubuntu encrypted volume. One day I went to reformat a USB drive with UNetbootin, which defaulted to my system drive and . . . well, I stopped it as quickly as I could.

Earlier, when I mounted this disk on an openSUSE system, it would mount and recognize a few k of files. I am now running Fedora and can't get the desktop to accept the LUKS password at all, other than thru the console and cryptsetup as above.

PhotoRec recovers nothing. Is there any hope of repair or recovery?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: PhotoRec and Encrypted Disks

#5 Post by cgrenier »

Can you check the size of the LUKS partition ? Is it also only 8 MB ?

Ryon
Posts: 10
Joined: 29 Dec 2013, 04:16

Re: PhotoRec and Encrypted Disks

#6 Post by Ryon »

cgrenier wrote:Can you check the size of the LUKS partition ? Is it also only 8 MB ?
Parted Magic reports the disk as:
/dev/sda1 7.81 mb crypt-luks
unallocated 698.39 GB

My present system says:
sda1 7.8 mb crypto_LUKS
sda2 1kb unknown
sda5 243.1 ext2

I hope this is the information that you need. This disk is very worth the trouble IF there is a possibility of recovering the data. But if there's no hope, I'd like to know.

Thank you very much for your help!

Ryon
Posts: 10
Joined: 29 Dec 2013, 04:16

Re: PhotoRec and Encrypted Disks

#7 Post by Ryon »

Bump?

This was a 700gig+ partition. The above shows what I know about it now.

Locked