Sample Header Ad - 728x90

Damaged LUKS encrypted HHD - need help recovering

1 vote
1 answer
125 views
I have a 2 TB Western Digital MyBook I encrypted with LUKS over a year ago. A few months ago, I decided to be reckless and accidentally formatted the disk in Windows when trying to create a boot-able USB disk with different software. The drive was totally reformatted. But then, I put a GPT partition header (GUID partition table) on it with no data. I use Linux Mint 22.1 as my default OS. Long story short - the drive and partition are gone with a new GPT partition installed. This means the 'disks' app still shows the drive as /dev/sdc (which it is) but that it is "Unallocated Space". To say that the data on this drive is important is an understatement. I’ve looked through the following articles to try and address this issue, but to no avail: - https://unix.stackexchange.com/questions/706070/restore-a-luks-partition-that-was-overwritten-by-pvcreate/706071#706071 - https://unix.stackexchange.com/questions/741404/overwritten-luks-with-a-partition-table/741850#741850 When performing hexdump -C /dev/sdc | grep LUKS, for over an hour, I see the following:
4774f600  eb 02 92 95 54 d3 f2 e3  ca d1 4c 55 4b 53 e0 16  |....T.....LUKS..|
98ea5380  d7 01 bf 4c 55 4b 53 8c  f2 24 43 72 9f 4a 63 94  |...LUKS..$Cr.Jc.|
c7b54730  7c f3 4c 4c 55 4b 53 71  4c 47 40 69 96 53 57 12  ||.LLUKSqLG@i.SW.|
2963da820  04 75 9e 51 4c 55 4b 53  fe 1c 76 f6 30 ad c5 c1  |.u.QLUKS..v.0...|
495e522c0  aa e1 e4 ac 21 6c 29 4c  55 4b 53 b0 e9 98 63 b5  |....!l)LUKS...c.|
508fbcd90  ec 2e 2b 4e 59 1f 4c 55  4b 53 b7 27 18 1b 60 62  |..+NY.LUKS.'..`b|
59dde6680  d2 4c 55 4b 53 57 5f d3  f8 40 ce 4f d6 3e b0 83  |.LUKSW_..@.O.>..|
7d4a7f640  70 9d 24 a6 05 d5 bd 4c  55 4b 53 67 c6 74 56 62  |p.$....LUKSg.tVb|
7f38a7520  ee 9d e8 1e 13 19 b2 28  55 e9 d8 4c 55 4b 53 1b  |.......(U..LUKS.|
81bac7400  fc 10 90 53 a2 9e 78 d9  37 8c db b4 4c 55 4b 53  |...S..x.7...LUKS|
8ff10e9f0  4c 55 4b 53 9d a5 a7 67  a6 3d 5a e4 62 8b 20 39  |LUKS...g.=Z.b. 9|
a51b31010  f0 4c 55 4b 53 d9 d7 e7  df 6e 03 53 9c 54 8a ef  |.LUKS....n.S.T..|
ca9ecb700  1e 53 df f2 4c 55 4b 53  b7 bf 24 86 89 00 49 06  |.S..LUKS..$...I.|
ceb247eb0  47 4c 55 4b 53 c6 1c 95  d8 41 86 19 d0 e9 74 c9  |GLUKS....A....t.|
e6521bb10  45 ff ec cd 68 a5 58 bf  b1 4c 55 4b 53 5b 14 51  |E...h.X..LUKS[.Q|
ead66c2e0  d0 6b 8d a0 c3 cf 4c 55  4b 53 1b 14 86 01 a2 c2  |.k....LUKS......|
I created an image of the disk (image.dd). When following frostschutz' procedure for "cryptsetup repair, Part Two — Full Header Recovery" (https://unix.stackexchange.com/questions/741404/overwritten-luks-with-a-partition-table/741850#741850) Step 1: Result of metadata recovery: stdbuf -oL strings -n 64 -t d image.dd | grep '"keyslots":' 20480 {"keyslots":{"0":{"type":"luks2","key_size":64,"af":{"type":"luks1","stripes":4000,"hash":"sha256"},"area":{"type":"raw","offset":"32768","size":"258048","encryption":"aes-xts-plain64","key_size":64},"kdf":{"type":"argon2id","time":12,"memory":1048576,"cpus":4,"salt":"5JN08SD5Z1cryqRFiQvn+JensssvRMuayF2jHXKjGDY="}}},"tokens":{},"segments":{"0":{"type":"crypt","offset":"16777216","size":"dynamic","iv_tweak":"0","encryption":"aes-xts-plain64","sector_size":512}},"digests":{"0":{"type":"pbkdf2","keyslots":["0"],"segments":["0"],"hash":"sha256","iterations":313944,"salt":"cHPpJJpF2ivqLjkyTTJmKmqVcVSaRqN0L0V+yx0La+E=","digest":"COHktekQxX/2Jfq4ro8hqDweVOmom5bGAPa23nzkEV0="}},"config":{"json_size":"12288","keyslots_size":"16744448"}} Valid JSON string found at offset 20480.... After following the entire procedure to its end (working on the image.dd) it keeps saying "Device luks.recovery is not a valid LUKS device." Is this pointless? If I can see LUKS keyslots, the offsets, etc, then am I just doing this wrong? Thanks!
Asked by hauser100 (11 rep)
Apr 12, 2025, 07:12 PM
Last activity: Jul 9, 2025, 06:40 PM