External LUKS HDD

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
PhilRose
Posts: 2
Joined: 20 May 2020, 16:39

External LUKS HDD

#1 Post by PhilRose »

Hi all,
I have an external disk encrypted with LUKS that got corrupted, I think it's a filesystem problem but I'm not sure. Unfortunately the header backup was lost and I can't figure out how the problem occurred. I've read other posts from this forum that said to add a new partition of LUKS, but I don't know if this is the correct procedure in my case, so I opened a new topic.
I tried to run some tests with Testdisk. Here are the logs of what I did:

Code: Select all

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.19.0-9-amd64 (#1 SMP Debian 4.19.118-2 (2020-04-29)) x86_64
Compiler: GCC 8.2
ext2fs lib: 1.44.5, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.1
/dev/sda: LBA, 	LBA48 support
/dev/sda: size   1953525168 sectors
/dev/sda: user   1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Samsung M3 Portable, FW:1402

Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB - Samsung M3 Portable
Partition table type: Intel

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or EXFAT boot
 1 * HPFS - NTFS              0   1  2 243200 254 63 3907024001
 1 * HPFS - NTFS              0   1  2 243200 254 63 3907024001
ntfs_mst_post_read_fixup_warn: magic: 0xfb979bd7  size: 1024   usa_ofs: 44808  usa_count: 53332: Invalid argument
Record 0 has no FILE magic (0xfb979bd7)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xfb979bd7  size: 1024   usa_ofs: 44808  usa_count: 53332: Invalid argument
Record 0 has no FILE magic (0xfb979bd7)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xfb979bd7  size: 1024   usa_ofs: 44808  usa_count: 53332: Invalid argument
Record 0 has no FILE magic (0xfb979bd7)
Failed to load $MFT: Input/output error
ntfs_mst_post_read_fixup_warn: magic: 0xfb979bd7  size: 1024   usa_ofs: 44808  usa_count: 53332: Invalid argument
Record 0 has no FILE magic (0xfb979bd7)
Failed to load $MFT: Input/output error
Backup partition structure
partition_save

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63

recover_EXT2: s_block_group_nr=0/14355, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 470414080
recover_EXT2: part_size 3763312640
     Linux                    0   1  2 234255  97 18 3763312640
     ext4 blocksize=4096 Large_file Sparse_SB, 1926 GB / 1794 GiB
NTFS at 243200/254/63
filesystem size           3907024001
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  2 243200 254 63 3907024001
     NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 243200/254/63
filesystem size           3907024001
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     HPFS - NTFS          243200 254 63 486401 253 61 3907024001
     NTFS, blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=3907024064, size=3907024001, end=7814048064, disk end=3907029168)
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 4000 GB / 3726 GiB)
The following partition can't be recovered:
     HPFS - NTFS          243200 254 63 486401 253 61 3907024001
     NTFS, blocksize=4096, 2000 GB / 1863 GiB

Results
     Linux                    0   1  2 234255  97 18 3763312640
     ext4 blocksize=4096 Large_file Sparse_SB, 1926 GB / 1794 GiB
     HPFS - NTFS              0   1  2 243200 254 63 3907024001
     NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 3763312640 linear /dev/sdb 64" | dmsetup create test0
echo "0 3907024001 linear /dev/sdb 64" | dmsetup create test1


dir_partition inode=2
     Linux                    0   1  2 234255  97 18 3763312640
     ext4 blocksize=4096 Large_file Sparse_SB, 1926 GB / 1794 GiB
ext2fs_dir_iterate failed with error 2133571402.
Directory /
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
Not an exFAT boot sector.
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented

     HPFS - NTFS              0   1  2 243200 254 63 3907024001
     NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
 1 P Linux                    0   1  2 234255  97 18 3763312640

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63

recover_EXT2: s_block_group_nr=0/14355, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 470414080
recover_EXT2: part_size 3763312640
     Linux                    0   1  2 234255  97 18 3763312640
     ext4 blocksize=4096 Large_file Sparse_SB, 1926 GB / 1794 GiB

     Linux                    0   1  2     0  66  2       4096
     LUKS 1 (Data size unknown), 2097 KB / 2048 KiB
NTFS at 243200/254/63
filesystem size           3907024001
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  2 243200 254 63 3907024001
     NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 243200/254/63
filesystem size           3907024001
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     HPFS - NTFS          243200 254 63 486401 253 61 3907024001
     NTFS, blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=3907024064, size=3907024001, end=7814048064, disk end=3907029168)
Search for partition aborted
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 4000 GB / 3726 GiB)
The following partition can't be recovered:
     HPFS - NTFS          243200 254 63 486401 253 61 3907024001
     NTFS, blocksize=4096, 2000 GB / 1863 GiB

Results
     Linux                    0   1  2     0  66  2       4096
     LUKS 1 (Data size unknown), 2097 KB / 2048 KiB
     Linux                    0   1  2 234255  97 18 3763312640
     ext4 blocksize=4096 Large_file Sparse_SB, 1926 GB / 1794 GiB
     HPFS - NTFS              0   1  2 243200 254 63 3907024001
     NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 4096 linear /dev/sdb 64" | dmsetup create test0
echo "0 3763312640 linear /dev/sdb 64" | dmsetup create test1
echo "0 3907024001 linear /dev/sdb 64" | dmsetup create test2


dir_partition inode=2
     Linux                    0   1  2 234255  97 18 3763312640
     ext4 blocksize=4096 Large_file Sparse_SB, 1926 GB / 1794 GiB
ext2fs_dir_iterate failed with error 2133571402.
Directory /


dir_partition inode=2
     Linux                    0   1  2     0  66  2       4096
     LUKS 1 (Data size unknown), 2097 KB / 2048 KiB
ext2fs_dir_iterate failed with error 2133571402.
Directory /

interface_write()
 1 P Linux                    0   1  2     0  66  2       4096
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
Invalid NTFS or EXFAT boot
 1 * HPFS - NTFS              0   1  2 243200 254 63 3907024001
 1 * HPFS - NTFS              0   1  2 243200 254 63 3907024001

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63

recover_EXT2: s_block_group_nr=0/14355, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 470414080
recover_EXT2: part_size 3763312640
     Linux                    0   1  2 234255  97 18 3763312640
     ext4 blocksize=4096 Large_file Sparse_SB, 1926 GB / 1794 GiB
NTFS at 243200/254/63
filesystem size           3907024001
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0   1  2 243200 254 63 3907024001
     NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 243200/254/63
filesystem size           3907024001
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS: Can't read MFT
     HPFS - NTFS          243200 254 63 486401 253 61 3907024001
     NTFS, blocksize=4096, 2000 GB / 1863 GiB
This partition ends after the disk limits. (start=3907024064, size=3907024001, end=7814048064, disk end=3907029168)
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 4000 GB / 3726 GiB)
The following partition can't be recovered:
     HPFS - NTFS          243200 254 63 486401 253 61 3907024001
     NTFS, blocksize=4096, 2000 GB / 1863 GiB

Results
     Linux                    0   1  2 234255  97 18 3763312640
     ext4 blocksize=4096 Large_file Sparse_SB, 1926 GB / 1794 GiB
     HPFS - NTFS              0   1  2 243200 254 63 3907024001
     NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB

Hint for advanced users. dmsetup may be used if you prefer to avoid to rewrite the partition table for the moment:
echo "0 3763312640 linear /dev/sdb 64" | dmsetup create test0
echo "0 3907024001 linear /dev/sdb 64" | dmsetup create test1


dir_partition inode=2
     Linux                    0   1  2 234255  97 18 3763312640
     ext4 blocksize=4096 Large_file Sparse_SB, 1926 GB / 1794 GiB
ext2fs_dir_iterate failed with error 2133571402.
Directory /

interface_write()
 1 P Linux                    0   1  2 234255  97 18 3763312640
Some screenshots:

Image

Image

Image

What are the next steps I should take? Is there any hope of fixing?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: External LUKS HDD

#2 Post by cgrenier »

It's possible to fix the partition type.

Run TestDisk, after Quick Search, use 'a' to manually add
Linux 0 1 2 243200 254 63 3907024001
Set this partition as P(rimary), set the other partitions as D(eleted)
On next screen, choose Write, confirm, Quit

After a reboot, unlock the LUKS volume.
Do you get a /dev/loopX device or a new /dev/mapper/XXX ?

PhilRose
Posts: 2
Joined: 20 May 2020, 16:39

Re: External LUKS HDD

#3 Post by PhilRose »

thanks CGrenier for the answer,
unfortunately the volume still can't be unlocked, probably the header is corrupted.
After rebooting, the quick search looks like this:

Image

Image

Locked