mardi 6 janvier 2015

Recovering a LUKS partition


I have a drive with 2 partitions



  • 1st is plain ext4

  • 2nd is encrypted LUKS.


The partition table has been overwritten. I've found the beginning of the second partition, which I need to recover, thusly:



# hexdump -s 400000m -C /dev/sdc | grep LUKS
61d3dec850 79 c8 81 6d e5 4c 55 4b 53 40 49 aa 29 df de d7 |y..m.LUKS@I.)...|


Also:



# losetup -o 0x61d3dec850 -r -f /dev/sdc
# losetup -a
/dev/loop0: [0005]:477209 (/dev/sdc), offset 420166420560


So far, this problem pops up:



# cryptsetup luksOpen /dev/loop0 luksrecover
Device /dev/loop0 is not a valid LUKS device.


Is it wrong offset? Should I seek for the magic number 0xEF53 identifying ext4 as adviced here ?


It's a 1TB drive so please, I need an advice that does not force a scan of the entire drive all over again (e.g. testdisk which seems have no option to start at a specified offset to save time on scanning).


P.S. This question seems to be closely related but does not match.



Aucun commentaire:

Enregistrer un commentaire