Damaged LUKS encrypted HHD - need help recovering
1
vote
1
answer
125
views
I have a 2 TB Western Digital MyBook I encrypted with LUKS over a year ago. A few months ago, I decided to be reckless and accidentally formatted the disk in Windows when trying to create a boot-able USB disk with different software. The drive was totally reformatted. But then, I put a GPT partition header (GUID partition table) on it with no data.
I use Linux Mint 22.1 as my default OS.
Long story short - the drive and partition are gone with a new GPT partition installed.
This means the
'disks'
app still shows the drive as /dev/sdc
(which it is) but that it is "Unallocated Space"
.
To say that the data on this drive is important is an understatement.
I’ve looked through the following articles to try and address this issue, but to no avail:
- https://unix.stackexchange.com/questions/706070/restore-a-luks-partition-that-was-overwritten-by-pvcreate/706071#706071
- https://unix.stackexchange.com/questions/741404/overwritten-luks-with-a-partition-table/741850#741850
When performing hexdump -C /dev/sdc | grep LUKS
, for over an hour, I see the following:
4774f600 eb 02 92 95 54 d3 f2 e3 ca d1 4c 55 4b 53 e0 16 |....T.....LUKS..|
98ea5380 d7 01 bf 4c 55 4b 53 8c f2 24 43 72 9f 4a 63 94 |...LUKS..$Cr.Jc.|
c7b54730 7c f3 4c 4c 55 4b 53 71 4c 47 40 69 96 53 57 12 ||.LLUKSqLG@i.SW.|
2963da820 04 75 9e 51 4c 55 4b 53 fe 1c 76 f6 30 ad c5 c1 |.u.QLUKS..v.0...|
495e522c0 aa e1 e4 ac 21 6c 29 4c 55 4b 53 b0 e9 98 63 b5 |....!l)LUKS...c.|
508fbcd90 ec 2e 2b 4e 59 1f 4c 55 4b 53 b7 27 18 1b 60 62 |..+NY.LUKS.'..`b|
59dde6680 d2 4c 55 4b 53 57 5f d3 f8 40 ce 4f d6 3e b0 83 |.LUKSW_..@.O.>..|
7d4a7f640 70 9d 24 a6 05 d5 bd 4c 55 4b 53 67 c6 74 56 62 |p.$....LUKSg.tVb|
7f38a7520 ee 9d e8 1e 13 19 b2 28 55 e9 d8 4c 55 4b 53 1b |.......(U..LUKS.|
81bac7400 fc 10 90 53 a2 9e 78 d9 37 8c db b4 4c 55 4b 53 |...S..x.7...LUKS|
8ff10e9f0 4c 55 4b 53 9d a5 a7 67 a6 3d 5a e4 62 8b 20 39 |LUKS...g.=Z.b. 9|
a51b31010 f0 4c 55 4b 53 d9 d7 e7 df 6e 03 53 9c 54 8a ef |.LUKS....n.S.T..|
ca9ecb700 1e 53 df f2 4c 55 4b 53 b7 bf 24 86 89 00 49 06 |.S..LUKS..$...I.|
ceb247eb0 47 4c 55 4b 53 c6 1c 95 d8 41 86 19 d0 e9 74 c9 |GLUKS....A....t.|
e6521bb10 45 ff ec cd 68 a5 58 bf b1 4c 55 4b 53 5b 14 51 |E...h.X..LUKS[.Q|
ead66c2e0 d0 6b 8d a0 c3 cf 4c 55 4b 53 1b 14 86 01 a2 c2 |.k....LUKS......|
I created an image of the disk (image.dd).
When following frostschutz' procedure for "cryptsetup repair, Part Two — Full Header Recovery"
(https://unix.stackexchange.com/questions/741404/overwritten-luks-with-a-partition-table/741850#741850)
Step 1: Result of metadata recovery: stdbuf -oL strings -n 64 -t d image.dd | grep '"keyslots":'
20480 {"keyslots":{"0":{"type":"luks2","key_size":64,"af":{"type":"luks1","stripes":4000,"hash":"sha256"},"area":{"type":"raw","offset":"32768","size":"258048","encryption":"aes-xts-plain64","key_size":64},"kdf":{"type":"argon2id","time":12,"memory":1048576,"cpus":4,"salt":"5JN08SD5Z1cryqRFiQvn+JensssvRMuayF2jHXKjGDY="}}},"tokens":{},"segments":{"0":{"type":"crypt","offset":"16777216","size":"dynamic","iv_tweak":"0","encryption":"aes-xts-plain64","sector_size":512}},"digests":{"0":{"type":"pbkdf2","keyslots":["0"],"segments":["0"],"hash":"sha256","iterations":313944,"salt":"cHPpJJpF2ivqLjkyTTJmKmqVcVSaRqN0L0V+yx0La+E=","digest":"COHktekQxX/2Jfq4ro8hqDweVOmom5bGAPa23nzkEV0="}},"config":{"json_size":"12288","keyslots_size":"16744448"}}
Valid JSON string found at offset 20480....
After following the entire procedure to its end (working on the image.dd) it keeps saying "Device luks.recovery is not a valid LUKS device."
Is this pointless? If I can see LUKS keyslots, the offsets, etc, then am I just doing this wrong?
Thanks!
Asked by hauser100
(11 rep)
Apr 12, 2025, 07:12 PM
Last activity: Jul 9, 2025, 06:40 PM
Last activity: Jul 9, 2025, 06:40 PM