I have an encrypted Ubuntu filesystem that I partially reformatted FAT three years ago by accident. I can mount the disk and read part of the data, but unfortunately not the data that I am looking for. TestDisk was not able to repair the filesystem, and PhotoRec didn't find my data.
My question is on an encrypted Luks volume, is TestDisk viewing the unencrypted data, or is it only searching the raw encrypted sectors? Would file system damage affect such a data recovery?
PhotoRec and Encrypted Disks
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Re: PhotoRec and Encrypted Disks
Several months later, and I still need this information:
My filesystem is mounting only up to a point where it was damaged, a few megs into a several-gigabyte system. Since it is LUKS encrypted, can PhotoRec even "see" the files to be recovered?
Is there any hope of extending the point at which the filesystem can be read? TestDisk was apparently not able to do this alone.
My filesystem is mounting only up to a point where it was damaged, a few megs into a several-gigabyte system. Since it is LUKS encrypted, can PhotoRec even "see" the files to be recovered?
Is there any hope of extending the point at which the filesystem can be read? TestDisk was apparently not able to do this alone.
- cgrenier
- Site Admin
- Posts: 5416
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: PhotoRec and Encrypted Disks
If you can unlock the encrypted volume, "cryptsetup luksOpen device name", when you run photorec, select /dev/mapper/name.
Re: PhotoRec and Encrypted Disks
Thanks for the response!cgrenier wrote:If you can unlock the encrypted volume, "cryptsetup luksOpen device name", when you run photorec, select /dev/mapper/name.
I can unlock the encrypted volume, but only the first few thousand k show in the mapper. The encrypted volume is about 650 gig.
Code: Select all
Select a media (use Arrow keys, then press Enter):
Disk /dev/sda - 750 GB / 698 GiB (RO) - ST3750640AS
Disk /dev/sdb - 500 GB / 465 GiB (RO) - ST3500630A
Disk /dev/sdc - 2000 GB / 1863 GiB (RO) - Seagate Desktop
Disk /dev/mapper/fedora-home - 439 GB / 409 GiB (RO)
Disk /dev/mapper/fedora-root - 53 GB / 50 GiB (RO)
Disk /dev/mapper/fedora-swap - 6190 MB / 5904 MiB (RO)
Disk /dev/mapper/luks-821190f5-8d48-485e-8b20-d5becb49c40e - 499 GB / 465 GiB (RO)
>Disk /dev/mapper/luksnevada - 7140 KB / 6973 KiB (RO) < --- this one ---
Disk /dev/dm-0 - 499 GB / 465 GiB (RO)
Disk /dev/dm-1 - 53 GB / 50 GiB (RO)
Disk /dev/dm-2 - 6190 MB / 5904 MiB (RO)
Disk /dev/dm-3 - 439 GB / 409 GiB (RO)
Disk /dev/dm-4 - 7140 KB / 6973 KiB (RO)
>[Proceed ] [ Quit ]
Code: Select all
Disk /dev/mapper/luksnevada - 7140 KB / 6973 KiB (RO)
Partition Start End Size in sectors
Unknown 0 0 1 13945 0 1 13946 [Whole disk]
> P Linux LVM2 0 0 1 13945 0 1 13946
Earlier, when I mounted this disk on an openSUSE system, it would mount and recognize a few k of files. I am now running Fedora and can't get the desktop to accept the LUKS password at all, other than thru the console and cryptsetup as above.
PhotoRec recovers nothing. Is there any hope of repair or recovery?
- cgrenier
- Site Admin
- Posts: 5416
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: PhotoRec and Encrypted Disks
Can you check the size of the LUKS partition ? Is it also only 8 MB ?
Re: PhotoRec and Encrypted Disks
Parted Magic reports the disk as:cgrenier wrote:Can you check the size of the LUKS partition ? Is it also only 8 MB ?
/dev/sda1 7.81 mb crypt-luks
unallocated 698.39 GB
My present system says:
sda1 7.8 mb crypto_LUKS
sda2 1kb unknown
sda5 243.1 ext2
I hope this is the information that you need. This disk is very worth the trouble IF there is a possibility of recovering the data. But if there's no hope, I'd like to know.
Thank you very much for your help!
Re: PhotoRec and Encrypted Disks
Bump?
This was a 700gig+ partition. The above shows what I know about it now.
This was a 700gig+ partition. The above shows what I know about it now.