I messed up my LUKS partition

beardstack · 3 November 2020 15:20

I believe that I accidentally corrupted my LUKS drive by using TestDisk. It contains very important documents and I’d really appreciate some help to try and recover it.

Sun Nov  1 13:20:04 2020
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.7.19-2-MANJARO (#1 SMP PREEMPT Fri Aug 28 20:22:12 UTC 2020) x86_64
Compiler: GCC 10.1
ext2fs lib: 1.45.6, ntfs lib: libntfs-3g, reiserfs lib: 0.3.0.5, ewf lib: none, curses lib: ncurses 6.2
User is not root!
Hard disk list
Disk /dev/sr0 - 1493 MB / 1424 MiB - 729392 sectors (RO), sector size=2048 - PLDS DVD-RW DH16ACSH, S/N:S0A68694ZVJ6YD01FZ4D, FW:JL3B


TestDisk exited normally.
Using locale 'LC_CTYPE=en_CA.utf8;LC_NUMERIC=en_CA.UTF-8;LC_TIME=en_CA.UTF-8;LC_COLLATE=en_CA.utf8;LC_MONETARY=en_CA.UTF-8;LC_MESSAGES=en_CA.utf8;LC_PAPER=en_CA.UTF-8;LC_NAME=en_CA.UTF-8;LC_ADDRESS=en_CA.UTF-8;LC_TELEPHONE=en_CA.UTF-8;LC_MEASUREMENT=en_CA.UTF-8;LC_IDENTIFICATION=en_CA.UTF-8'.


Sun Nov  1 13:20:15 2020
Command line: TestDisk /debug

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.7.19-2-MANJARO (#1 SMP PREEMPT Fri Aug 28 20:22:12 UTC 2020) x86_64
Compiler: GCC 10.1
ext2fs lib: 1.45.6, ntfs lib: libntfs-3g, reiserfs lib: 0.3.0.5, ewf lib: none, curses lib: ncurses 6.2
/dev/sda: LBA, HPA, LBA48 support
/dev/sda: size       234441648 sectors
/dev/sda: user_max   234441648 sectors
/dev/sda: native_max 234441648 sectors
/dev/sdb: LBA, HPA, LBA48 support
/dev/sdb: size       468862128 sectors
/dev/sdb: user_max   468862128 sectors
/dev/sdb: native_max 468862128 sectors
/dev/sdc: LBA, HPA, LBA48 support
/dev/sdc: size       468862128 sectors
/dev/sdc: user_max   468862128 sectors
/dev/sdc: native_max 468862128 sectors
/dev/sdd: LBA, HPA, LBA48, DCO support
/dev/sdd: size       1953525168 sectors
/dev/sdd: user_max   1953525168 sectors
/dev/sdd: native_max 1953525168 sectors
/dev/sdd: dco        1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
/dev/sr0 is not an ATA disk
Warning: can't get size for Disk /dev/loop13 - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - FM-25S2S-120GBP1, S/N:GS08104511080004, FW:3.1
Disk /dev/sdb - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - INTEL SSDSC2BW240H6, S/N:CVTR610507E1240CGN, FW:RG21
Disk /dev/sdc - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - INTEL SSDSC2BW240H6, S/N:CVTR610602YM240CGN, FW:RG21
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000NM0011, S/N:Z1N0FSCT, FW:PA03
Disk /dev/sdg - 128 GB / 119 GiB - CHS 15583 255 63, sector size=512 - Generic- SD/MMC, FW:1.00
Disk /dev/sr0 - 1493 MB / 1424 MiB - 729392 sectors (RO), sector size=2048 - PLDS DVD-RW DH16ACSH, S/N:S0A68694ZVJ6YD01FZ4D, FW:JL3B
Disk /dev/loop0 - 58 MB / 55 MiB - 113296 sectors (RO), sector size=512
Disk /dev/loop1 - 58 MB / 55 MiB - 113384 sectors (RO), sector size=512
Disk /dev/loop10 - 237 MB / 226 MiB - 464216 sectors (RO), sector size=512
Disk /dev/loop11 - 32 MB / 30 MiB - 63344 sectors (RO), sector size=512
Disk /dev/loop12 - 215 MB / 205 MiB - 421576 sectors (RO), sector size=512
Disk /dev/loop2 - 169 MB / 161 MiB - 330576 sectors (RO), sector size=512
Disk /dev/loop3 - 170 MB / 162 MiB - 333552 sectors (RO), sector size=512
Disk /dev/loop4 - 57 MB / 54 MiB - 112264 sectors (RO), sector size=512
Disk /dev/loop5 - 215 MB / 205 MiB - 421584 sectors (RO), sector size=512
Disk /dev/loop6 - 77 MB / 73 MiB - 151496 sectors (RO), sector size=512
Disk /dev/loop7 - 65 MB / 62 MiB - 127160 sectors (RO), sector size=512
Disk /dev/loop8 - 32 MB / 30 MiB - 63360 sectors (RO), sector size=512
Disk /dev/loop9 - 242 MB / 231 MiB - 473880 sectors (RO), sector size=512

Partition table type (auto): Intel
Disk /dev/sdb - 240 GB / 223 GiB - INTEL SSDSC2BW240H6
Partition table type: Intel

Analyse Disk /dev/sdb - 240 GB / 223 GiB - CHS 29185 255 63
Geometry from i386 MBR: head=255 sector=2
BAD_RS LBA=2048 64512
Current partition structure:
 1 P Linux                    0  32 33 29185  61 60  468858880

Bad relative sector.
No partition is bootable

search_part()
Disk /dev/sdb - 240 GB / 223 GiB - CHS 29185 255 63

recover_btrfs: part_size 468858880
     Linux                    0  32 33 29185  61 60  468858880
     btrfs blocksize=4096 Backup superblock, 240 GB / 223 GiB

Results
   * Linux                    0  32 33 29185  61 60  468858880
     btrfs blocksize=4096 Backup superblock, 240 GB / 223 GiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 468858880 linear /dev/sdb 2048" | dmsetup create test0

interface_write()
 1 * Linux                    0  32 33 29185  61 60  468858880

search_part()
Disk /dev/sdb - 240 GB / 223 GiB - CHS 29185 255 63

recover_btrfs: part_size 468858880
     Linux                    0  32 33 29185  61 60  468858880
     btrfs blocksize=4096 Backup superblock, 240 GB / 223 GiB

Results
   * Linux                    0  32 33 29185  61 60  468858880
     btrfs blocksize=4096 Backup superblock, 240 GB / 223 GiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 468858880 linear /dev/sdb 2048" | dmsetup create test0

interface_write()
 1 * Linux                    0  32 33 29185  61 60  468858880

interface_write()
 1 * Linux                    0  32 33 29185  61 60  468858880
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.
Partition table type (auto): Intel
Disk /dev/sdd - 1000 GB / 931 GiB - ST1000NM0011
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type E8: no test
 1 P Sys=E8                   0  32 33 121601  57 56 1953521664

Analyse Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 1 type E8: no test
Current partition structure:
 1 P Sys=E8                   0  32 33 121601  57 56 1953521664
No partition is bootable

search_part()
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63

     Linux                    0  32 33     0  97 33       4096
     LUKS 1 (Data size unknown), 2097 KB / 2048 KiB

Results
   * Linux                    0  32 33     0  97 33       4096
     LUKS 1 (Data size unknown), 2097 KB / 2048 KiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 4096 linear /dev/sdd 2048" | dmsetup create test0

interface_write()
 1 * Linux                    0  32 33     0  97 33       4096
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.
Partition table type (auto): Intel
Disk /dev/sdb - 240 GB / 223 GiB - INTEL SSDSC2BW240H6
Partition table type: Intel

Analyse Disk /dev/sdb - 240 GB / 223 GiB - CHS 29185 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
 1 * Linux                    0  32 33 29185  61 60  468858880

search_part()
Disk /dev/sdb - 240 GB / 223 GiB - CHS 29185 255 63

recover_btrfs: part_size 468858880
     Linux                    0  32 33 29185  61 60  468858880
     btrfs blocksize=4096 Backup superblock, 240 GB / 223 GiB

Results
   * Linux                    0  32 33 29185  61 60  468858880
     btrfs blocksize=4096 Backup superblock, 240 GB / 223 GiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 468858880 linear /dev/sdb 2048" | dmsetup create test0

interface_write()
 1 * Linux                    0  32 33 29185  61 60  468858880
Couldn't open reiser filesystem

   * Linux                    0  32 33 29185  61 60  468858880
     btrfs blocksize=4096 Backup superblock, 240 GB / 223 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
 1 * Linux                    0  32 33 29185  61 60  468858880
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.


Sun Nov  1 17:55:20 2020
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.7.19-2-MANJARO (#1 SMP PREEMPT Fri Aug 28 20:22:12 UTC 2020) x86_64
Compiler: GCC 10.1
ext2fs lib: 1.45.6, ntfs lib: libntfs-3g, reiserfs lib: 0.3.0.5, ewf lib: none, curses lib: ncurses 6.2
User is not root!
Hard disk list
Disk /dev/sr0 - 1493 MB / 1424 MiB - 729392 sectors (RO), sector size=2048 - PLDS DVD-RW DH16ACSH, S/N:S0A68694ZVJ6YD01FZ4D, FW:JL3B


TestDisk exited normally.
Using locale 'LC_CTYPE=en_CA.utf8;LC_NUMERIC=en_CA.UTF-8;LC_TIME=en_CA.UTF-8;LC_COLLATE=en_CA.utf8;LC_MONETARY=en_CA.UTF-8;LC_MESSAGES=en_CA.utf8;LC_PAPER=en_CA.UTF-8;LC_NAME=en_CA.UTF-8;LC_ADDRESS=en_CA.UTF-8;LC_TELEPHONE=en_CA.UTF-8;LC_MEASUREMENT=en_CA.UTF-8;LC_IDENTIFICATION=en_CA.UTF-8'.


Sun Nov  1 17:55:35 2020
Command line: TestDisk /debug

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 5.7.19-2-MANJARO (#1 SMP PREEMPT Fri Aug 28 20:22:12 UTC 2020) x86_64
Compiler: GCC 10.1
ext2fs lib: 1.45.6, ntfs lib: libntfs-3g, reiserfs lib: 0.3.0.5, ewf lib: none, curses lib: ncurses 6.2
/dev/sda: LBA, HPA, LBA48 support
/dev/sda: size       234441648 sectors
/dev/sda: user_max   234441648 sectors
/dev/sda: native_max 234441648 sectors
/dev/sdb: LBA, HPA, LBA48 support
/dev/sdb: size       468862128 sectors
/dev/sdb: user_max   468862128 sectors
/dev/sdb: native_max 468862128 sectors
/dev/sdc: LBA, HPA, LBA48 support
/dev/sdc: size       468862128 sectors
/dev/sdc: user_max   468862128 sectors
/dev/sdc: native_max 468862128 sectors
/dev/sdd: LBA, HPA, LBA48, DCO support
/dev/sdd: size       1953525168 sectors
/dev/sdd: user_max   1953525168 sectors
/dev/sdd: native_max 1953525168 sectors
/dev/sdd: dco        1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
/dev/sr0 is not an ATA disk
Warning: can't get size for Disk /dev/loop13 - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - FM-25S2S-120GBP1, S/N:GS08104511080004, FW:3.1
Disk /dev/sdb - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - INTEL SSDSC2BW240H6, S/N:CVTR610507E1240CGN, FW:RG21
Disk /dev/sdc - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - INTEL SSDSC2BW240H6, S/N:CVTR610602YM240CGN, FW:RG21
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000NM0011, S/N:Z1N0FSCT, FW:PA03
Disk /dev/sdg - 128 GB / 119 GiB - CHS 15583 255 63, sector size=512 - Generic- SD/MMC, FW:1.00
Disk /dev/sr0 - 1493 MB / 1424 MiB - 729392 sectors (RO), sector size=2048 - PLDS DVD-RW DH16ACSH, S/N:S0A68694ZVJ6YD01FZ4D, FW:JL3B
Disk /dev/loop0 - 58 MB / 55 MiB - 113296 sectors (RO), sector size=512
Disk /dev/loop1 - 58 MB / 55 MiB - 113384 sectors (RO), sector size=512
Disk /dev/loop10 - 77 MB / 73 MiB - 151496 sectors (RO), sector size=512
Disk /dev/loop11 - 237 MB / 226 MiB - 464216 sectors (RO), sector size=512
Disk /dev/loop12 - 242 MB / 231 MiB - 473880 sectors (RO), sector size=512
Disk /dev/loop2 - 169 MB / 161 MiB - 330576 sectors (RO), sector size=512
Disk /dev/loop3 - 57 MB / 54 MiB - 112264 sectors (RO), sector size=512
Disk /dev/loop4 - 170 MB / 162 MiB - 333552 sectors (RO), sector size=512
Disk /dev/loop5 - 215 MB / 205 MiB - 421584 sectors (RO), sector size=512
Disk /dev/loop6 - 65 MB / 62 MiB - 127160 sectors (RO), sector size=512
Disk /dev/loop7 - 215 MB / 205 MiB - 421576 sectors (RO), sector size=512
Disk /dev/loop8 - 32 MB / 30 MiB - 63360 sectors (RO), sector size=512
Disk /dev/loop9 - 32 MB / 30 MiB - 63344 sectors (RO), sector size=512

Partition table type (auto): Intel
Disk /dev/sdd - 1000 GB / 931 GiB - ST1000NM0011
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=98 sector=33
 1 * Linux                    0  32 33     0  97 33       4096
     LUKS 1, 2097 KB / 2048 KiB
search_superblock
Couldn't open reiser filesystem

 1 * Linux                    0  32 33     0  97 33       4096
     LUKS 1, 2097 KB / 2048 KiB
Can't open filesystem. Filesystem seems damaged.
Change partition type:
 1 * Linux                    0  32 33     0  97 33       4096
     LUKS 1, 2097 KB / 2048 KiB

Analyse Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=98 sector=33
Current partition structure:
 1 * Linux                    0  32 33     0  97 33       4096

search_part()
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63

     Linux                    0  32 33     0  97 33       4096
     LUKS 1 (Data size unknown), 2097 KB / 2048 KiB

Results
   * Linux                    0  32 33     0  97 33       4096
     LUKS 1 (Data size unknown), 2097 KB / 2048 KiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 4096 linear /dev/sdd 2048" | dmsetup create test0
Couldn't open reiser filesystem

   * Linux                    0  32 33     0  97 33       4096
     LUKS 1 (Data size unknown), 2097 KB / 2048 KiB
Can't open filesystem. Filesystem seems damaged.
Can't open backup.log file: No such file or directory
interface_load

interface_write()
 1 * Linux                    0  32 33     0  97 33       4096

search_part()
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63

     Linux                    0  32 33     0  97 33       4096
     LUKS 1 (Data size unknown), 2097 KB / 2048 KiB

Results
   * Linux                    0  32 33     0  97 33       4096
     LUKS 1 (Data size unknown), 2097 KB / 2048 KiB

Hint for advanced users: dmsetup may be used if you prefer to avoid rewriting the partition table for the moment:
echo "0 4096 linear /dev/sdd 2048" | dmsetup create test0
Couldn't open reiser filesystem

   * Linux                    0  32 33     0  97 33       4096
     LUKS 1 (Data size unknown), 2097 KB / 2048 KiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
 1 * Linux                    0  32 33     0  97 33       4096
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=98 sector=33
 1 * Linux                    0  32 33     0  97 33       4096
     LUKS 1, 2097 KB / 2048 KiB
Couldn't open reiser filesystem

 1 * Linux                    0  32 33     0  97 33       4096
     LUKS 1, 2097 KB / 2048 KiB
Can't open filesystem. Filesystem seems damaged.

TestDisk exited normally.

megavolt · 3 November 2020 16:03

Hello @beardstack

So lets summerize it:

You run testdisk on:

and

And /dev/sdb is normal btrfs filesystem

beardstack:

Disk /dev/sdb - 240 GB / 223 GiB - CHS 29185 255 63

recover_btrfs: part_size 468858880
     Linux                    0  32 33 29185  61 60  468858880
     btrfs blocksize=4096 Backup superblock, 240 GB / 223 GiB

Results
   * Linux                    0  32 33 29185  61 60  468858880
     btrfs blocksize=4096 Backup superblock, 240 GB / 223 GiB

but /dev/sdd is with LUKS encrypted.

beardstack:

Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63

     Linux                    0  32 33     0  97 33       4096
     LUKS 1 (Data size unknown), 2097 KB / 2048 KiB

Results
   * Linux                    0  32 33     0  97 33       4096
     LUKS 1 (Data size unknown), 2097 KB / 2048 KiB

Testdisk thinks that the LUKS partition is a reiserfs and that it is damaged and it just simulates the writes:

beardstack:

Couldn't open reiser filesystem

   * Linux                    0  32 33     0  97 33       4096
     LUKS 1 (Data size unknown), 2097 KB / 2048 KiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
 1 * Linux                    0  32 33     0  97 33       4096
simulate write!

How does your partition table look now?

sudo parted -l

beardstack · 3 November 2020 16:19

Correct. What happened is that I had a script that prevented the system from loading the partitions. I didnt realize it and assumed that it was a physical problem with the drives. I therefore ran testdisk and did a few things which you can see in the log. Now the partition appears to be 2.2MB or something.

Model: ATA FM-25S2S-120GBP1 (scsi)
Disk /dev/sda: 120GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags:

Number Start End Size Type File system Flags
1 1049kB 120GB 120GB primary ext4

Model: ATA INTEL SSDSC2BW24 (scsi)
Disk /dev/sdb: 240GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags:

Number Start End Size Type File system Flags
1 1049kB 240GB 240GB primary btrfs boot

Model: ATA INTEL SSDSC2BW24 (scsi)
Disk /dev/sdc: 240GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags:

Number Start End Size Type File system Flags
1 1049kB 240GB 240GB primary btrfs

Model: ATA ST1000NM0011 (scsi)
Disk /dev/sdd: 1000GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags:

Number Start End Size Type File system Flags
1 1049kB 3146kB 2097kB primary boot

megavolt · 3 November 2020 16:32

And i assume that you have no backup dump of the partition table right?

I researched a bit. Testdisk can’t recognize the size for a LUKS partition. There it is needed to set it yourself. Here is a hint of a more competent person: Recovering LUKS partition and Truecrypt partition. - cgsecurity.org

But anyway. I would recommend to make a backup with dd and try this on an image and not on the physical drive.