Overwritten GPT partition table (+LUKS)


I have accidentally (selected the wrong device) overwritten my GPT table of my external disk with fdisk by just creating a new GPT table (type ‘g’, then ‘w’).
Furthermore, the disk was initialized with LUKS (this was ~a year ago) by Dolphin (a file manager in KDE).

I need to restore the old partition layout. I ran testdisk and restored the 2 MB large LUKS header volume. I can unlock the volume with the right passphrase, but there a errors that it is not readable.

Testdisk is still running, showing the following (21%):
The numbers can be read as follows: start sector, end sector, sector count.

Linux filesys. data         2048       6143       4096
Unknown                 29093319  935651696  906558378
Unknown                617578270  617578269          0 <here is some gibberish>

After a previous testdisk run, there were two more Unknown partitions, but since testdisk looks at bit-level, this can be the result of reading the actual encrypted data (since only the GPT header was overwritten, no data).

The official document specification of LUKS (page 2, Overview) says there is only one partition, but I don’t know if the LUKS header is a seperate partition.

Can I just create a large partition with the rest of the 2 TB and the data will be back there? Or extend the first partition with the rest of the remaining space? I am unsure about the LUKS partition layout.

Thank you in advance!

EDIT: LUKS was initialized with the KDE partition manager, not Dolphin.

I figured it out:
Indeed LUKS only creates one partition (in my case 2 TB), the LUKS headers are also on this partition, at the beginning. I enlarged the 4096 sectors partition with cfdisk, which was originally found by testdisk, with the rest of the available sectors. I unlocked it with my passphrase and it worked like a charme!

1 Like

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.