Deleted Luks Partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
joaquin23x
Posts: 1
Joined: 15 Feb 2021, 21:13

Deleted Luks Partition

#1 Post by joaquin23x »

I accidentally deleted a luks partition a know that it's partition number three and that I haven't changed the partition size.... just reformat it but not changing the size

this is fdisk info

Code: Select all

Disco /dev/sda: 931,53 GiB, 1000204886016 bytes, 1953525168 sectores
Disk model: WDC WD10EURX-63U
Unidades: sectores de 1 * 512 = 512 bytes
Tamaño de sector (lógico/físico): 512 bytes / 4096 bytes
Tamaño de E/S (mínimo/óptimo): 4096 bytes / 4096 bytes
Tipo de etiqueta de disco: gpt
Identificador del disco: F6F7CF19-9C4E-480B-B59E-09D5A5AFD970

Dispositivo   Comienzo      Final   Sectores Tamaño Tipo
/dev/sda1         2048     288767     286720   140M Sistema EFI
/dev/sda2       288768  169306111  169017344  80,6G Sistema de ficheros de Linux
/dev/sda3    172054528  516890623  344836096 164,4G Raíz de Solaris
/dev/sda4    516890624  518987775    2097152     1G Sistema de ficheros de Linux
/dev/sda5   1572618240 1784594431  211976192 101,1G Sistema de ficheros de Linux
/dev/sda6   1950902272 1953523711    2621440   1,3G Sistema de ficheros de Linux
/dev/sda7   1784594432 1950902271  166307840  79,3G Datos básicos de Microsoft
/dev/sda8    519362560 1572618239 1053255680 502,2G Datos básicos de Microsoft
/dev/sda9    169306112  172054527    2748416   1,3G Sistema de ficheros de Linux

Las entradas de la tabla de particiones no están en el orden del disco.
I don't know why it says Solaris but it's really a bcache partition.
How could I approach this? why fdisk there's is no LUKS partition type.
should I backup all my remaining partitions or there's a safe way to changing the partition type without damaging the rest of the disk.

this is what testdisks shows I suppose some of those deleted must be my partition

Code: Select all

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
     Partition               Start        End    Size in sectors
>D EFI System                  2048     288767     286720 [EFI System Partition] [NO NAME]
 D MS Data                    94833     381552     286720 [NO NAME]
 D Linux filesys. data       288782  169306109  169017328
 D Linux filesys. data       288784  169306111  169017328
 P Linux filesys. data    169306112  172054527    2748416
 P Linux filesys. data    516890624  518987775    2097152
 P Linux filesys. data    519362560 1572618239 1053255680
 P Linux filesys. data   1572618240 1784594431  211976192
 P Linux LVM             1784594448 1950902271  166307824
 P Linux filesys. data   1950902272 1953523711    2621440

now with a deep search there's some partitions that look possible candidates those starting with 344

Code: Select all

Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
     Partition               Start        End    Size in sectors
 D Linux filesys. data    170354704  173103119    2748416
 D Linux filesys. data    170354832  173103247    2748416
 D Linux filesys. data    170354904  173103319    2748416
 D Linux filesys. data    170355080  173103495    2748416
 D Linux filesys. data    170392392  173140807    2748416
 D Linux filesys. data    172054542  516890621  344836080
 D Linux filesys. data    172054544  516890623  344836080
I read in some old posts that I should delete the offending partition and recreate adding the partition manually inputing the start and end sector, the partition should be MS data and Luks... is this how should I proceed?
Im not sure which partition I should delete though.

thanks.
recuperation
Posts: 3026
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Deleted Luks Partition

#2 Post by recuperation »

Do you have a backup of the LUKS header?
Without a working header you can't decrypt your content.
As you formatted your partition you most likely erased the header.

Do you remember the size of your LUKS partition?
Comparing the size of the LUKS partition with the length of partitions indicated in Testdisk would be helpful to select the right one.
Locked