PhotoRec and Encrypted Disks

[Ryon]

I have an encrypted Ubuntu filesystem that I partially reformatted FAT three years ago by accident. I can mount the disk and read part of the data, but unfortunately not the data that I am looking for. TestDisk was not able to repair the filesystem, and PhotoRec didn't find my data.

My question is on an encrypted Luks volume, is TestDisk viewing the unencrypted data, or is it only searching the raw encrypted sectors? Would file system damage affect such a data recovery?

[Ryon]

Several months later, and I still need this information:

My filesystem is mounting only up to a point where it was damaged, a few megs into a several-gigabyte system. Since it is LUKS encrypted, can PhotoRec even "see" the files to be recovered?

Is there any hope of extending the point at which the filesystem can be read? TestDisk was apparently not able to do this alone.

[cgrenier]

If you can unlock the encrypted volume, "cryptsetup luksOpen device name", when you run photorec, select /dev/mapper/name.

[Ryon]

If you can unlock the encrypted volume, "cryptsetup luksOpen device name", when you run photorec, select /dev/mapper/name.

Thanks for the response!

I can unlock the encrypted volume, but only the first few thousand k show in the mapper. The encrypted volume is about 650 gig.

Code: Select all

Select a media (use Arrow keys, then press Enter):
 Disk /dev/sda - 750 GB / 698 GiB (RO) - ST3750640AS
 Disk /dev/sdb - 500 GB / 465 GiB (RO) - ST3500630A
 Disk /dev/sdc - 2000 GB / 1863 GiB (RO) - Seagate Desktop
 Disk /dev/mapper/fedora-home - 439 GB / 409 GiB (RO)
 Disk /dev/mapper/fedora-root - 53 GB / 50 GiB (RO)
 Disk /dev/mapper/fedora-swap - 6190 MB / 5904 MiB (RO)
 Disk /dev/mapper/luks-821190f5-8d48-485e-8b20-d5becb49c40e - 499 GB / 465 GiB (RO)
>Disk /dev/mapper/luksnevada - 7140 KB / 6973 KiB (RO)  < --- this one ---
 Disk /dev/dm-0 - 499 GB / 465 GiB (RO)
 Disk /dev/dm-1 - 53 GB / 50 GiB (RO)
 Disk /dev/dm-2 - 6190 MB / 5904 MiB (RO)
 Disk /dev/dm-3 - 439 GB / 409 GiB (RO)
 Disk /dev/dm-4 - 7140 KB / 6973 KiB (RO)


>[Proceed ]  [  Quit  ]

Code: Select all

Disk /dev/mapper/luksnevada - 7140 KB / 6973 KiB (RO)

     Partition                  Start        End    Size in sectors
      Unknown                  0   0  1 13945   0  1      13946 [Whole disk]
>   P Linux LVM2               0   0  1 13945   0  1      13946

Background: This is an older Ubuntu encrypted volume. One day I went to reformat a USB drive with UNetbootin, which defaulted to my system drive and . . . well, I stopped it as quickly as I could.

Earlier, when I mounted this disk on an openSUSE system, it would mount and recognize a few k of files. I am now running Fedora and can't get the desktop to accept the LUKS password at all, other than thru the console and cryptsetup as above.

PhotoRec recovers nothing. Is there any hope of repair or recovery?

[cgrenier]

Can you check the size of the LUKS partition ? Is it also only 8 MB ?

[Ryon]

Can you check the size of the LUKS partition ? Is it also only 8 MB ?

Parted Magic reports the disk as:
/dev/sda1 7.81 mb crypt-luks
unallocated 698.39 GB

My present system says:
sda1 7.8 mb crypto_LUKS
sda2 1kb unknown
sda5 243.1 ext2

I hope this is the information that you need. This disk is very worth the trouble IF there is a possibility of recovering the data. But if there's no hope, I'd like to know.

Thank you very much for your help!

[Ryon]

Bump?

This was a 700gig+ partition. The above shows what I know about it now.