Sample Header Ad - 728x90

ddrescue recover LUKS1 partition - specific blocks

1 vote
0 answers
165 views
I need your help! I wanted to take hash from partition table in order to crack the old password/passphrase which somehow changed for LUKS1 partition. I wrongly used dd command. I forgot that backups exist for a reason, of course. I created empty txt file emptyFileHash.img and I overwrote the beginning of partition table with empty data by WRONG COMMAND ORDER WRONG COMMAND ------- dd if=emptyFileHash.img of=/dev/sda1 bs=512 count=4097 instead of dd if=/dev/sda1 of=emptyFileHash.img bs=512 count=4097 RESULTS FROM my memory (might be inaccurate) ------ 0+ records in 0+ records out 2097664 bytes (2.1 MB, 2.0 MiB) copied, 0.0674719 s, 31.1 MB/s QUESTION - ddrescue ------------ How to use **ddrescue** recovery option on that partition with specific blocks which I overwrote? What is the way to read back only this chunk of data in order to recover partition and not entire 500GB disk? DETAILS -------------- fdisk -l Disk /dev/sda: 465.8 GiB, 500107862016 bytes, 976773168 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 4096 bytes I/O size (minimum/optimal): 4096 bytes / 4096 bytes Disklabel type: gpt Disk identifier: ***NA*** Device Start End Sectors Size Type /dev/sda1 2048 976773119 976771072 465.8G unknown CURRENT HEX DATA ----------------- dd if=/dev/sda1 bs=512 count=10 |hexdump -C 10+0 records in 10+0 records out 5120 bytes (5.1 kB, 5.0 KiB) copied, 0.000738207 s, 6.9 MB/s 00000000 0a 0a 4b 53 ba be 00 01 61 65 73 00 00 00 00 00 |..KS....aes.....| 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000020 00 00 00 00 00 00 00 00 78 74 73 2d 70 6c 61 69 |........xts-plai| 00000030 6e 36 34 00 00 00 00 00 00 00 00 00 00 00 00 00 |n64.............| 00000040 00 00 00 00 00 00 00 00 73 68 61 32 35 36 00 00 |........sha256..| 00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000060 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 40 |...............@| 00000070 d4 83 26 cc ff b5 fd b2 84 7d 5d f9 d9 4d 14 32 |..&......}]..M.2| 00000080 df 47 0d c3 e5 48 3b 76 01 85 29 45 ca d9 85 fe |.G...H;v..)E....| 00000090 bc 51 d6 7c e0 5d c3 5d 2b 94 db fb b5 20 3b 0a |.Q.|.].]+.... ;.| 000000a0 39 e1 07 73 00 00 de 9b 61 38 66 63 35 31 64 33 |9..s....a8fc51d3| 000000b0 2d 33 63 37 64 2d 34 34 64 38 2d 61 38 30 65 2d |-3c7d-44d8-a80e-| 000000c0 61 38 33 63 64 31 61 35 37 62 62 33 00 00 00 00 |a83cd1a57bb3....| 000000d0 00 ac 71 f3 00 0d 17 e0 5f d6 d2 31 f1 5d e6 0b |..q....._..1.]..| 000000e0 4b 96 27 07 51 25 96 b1 94 62 61 aa d2 85 6e 99 |K.'.Q%...ba...n.| 000000f0 c6 d0 06 7c 54 8f 74 6f 00 00 00 08 00 00 0f a0 |...|T.to........| 00000100 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000120 00 00 00 00 00 00 00 00 00 00 02 00 00 00 0f a0 |................| 00000130 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000150 00 00 00 00 00 00 00 00 00 00 03 f8 00 00 0f a0 |................| 00000160 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000180 00 00 00 00 00 00 00 00 00 00 05 f0 00 00 0f a0 |................| 00000190 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001b0 00 00 00 00 00 00 00 00 00 00 07 e8 00 00 0f a0 |................| 000001c0 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001e0 00 00 00 00 00 00 00 00 00 00 09 e0 00 00 0f a0 |................| 000001f0 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000210 00 00 00 00 00 00 00 00 00 00 0b d8 00 00 0f a0 |................| 00000220 00 00 de ad 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000230 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000240 00 00 00 00 00 00 00 00 00 00 0d d0 00 00 0f a0 |................| 00000250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00001000 6e 58 3d bd 51 ab da e1 0e b4 5f e2 7d 6d 5e 9e |nX=.Q....._.}m^.| 00001010 03 53 37 e6 57 00 a8 34 5d 89 fb 6a 8e d4 2f 9f |.S7.W..4]..j../.| 00001020 66 73 61 99 c3 23 5f 02 c9 e0 f1 ab 31 44 83 a4 |fsa..#_.....1D..| 00001030 cf a0 3d 5a c8 80 8f 27 d9 cd 4d 1e 8e 99 7b 8c |..=Z...'..M...{.| 00001040 fc d7 75 c1 1d 91 18 5f ef ac 29 8b a1 a1 99 08 |..u...._..).....| 00001050 d8 d1 df 17 11 71 a6 24 71 43 e7 29 6d f0 da 36 |.....q.$qC.)m..6| 00001060 fb 02 c7 c9 67 46 b9 28 50 62 1c 93 81 2a 2d 68 |....gF.(Pb...*-h|
Asked by spartanART (11 rep)
Jun 24, 2022, 01:48 PM