Re: [dm-crypt] Help request

[Arno Wagner <arno@wagner.name>]

On Tue, Jul 07, 2020 at 22:58:14 CEST, Michael Kjörling wrote:
> On 6 Jul 2020 03:36 +0000, from lacedaemonius1@protonmail.com (lacedaemonius):
[...]
> > I don't think it's a drive failure because it's only a few months
> > old and I haven't got any SMART warnings, so that leaves software.
> 
> Unfortunately, drives can fail without reporting failures in SMART
> data, and they can fail early. While the probability of either is
> _lower_, it is non-zero.

There are some numbers from IBM that say that drives fail about 50% 
of the time without a failed SMART status. These are old numbers,
not sure how much they apply these days.It alsois a good idea to 
mionitor SMART attributes directly and not only check for a failed 
status.

One thing to do is to run a long SMART selftest (basically a more
sophisticated variant of scanning the surface yourself). It does
read the whole surface to check for read errors:

 smartctl -t long <drive>

Depending on drive size, this can take a long time. It also makes
sense to look at the SMART attributes manually, a drive will
get a failed SMART status only when things are really bad.
But you often can see what is going on anyways.
This gives you the attributes:

 smartctl -a <drive>

Post the results here if you are unsure how to interpret them.

[...]

> The fact that the LUKS container was not closed _should_ not cause any
> issues after a reboot, because closing the container really just
> removes bookkeeping information and cryptographic keys from kernel
> memory; it doesn't affect on-disk data. 

In fact, LUKS data never gets written in normal operation. Hence
it is not actually "opened" as far as the on-disk status is concerned.

> > Is it worth making any attempt at trying to recover the drive and if
> > so is there any documentation that explains what to do? I don't have
> > a backup of the LUKS header, if that's the problem.
> 
> Do you have a recent backup of the data on the drive, or does the
> drive that is giving you problems hold the only copy? Is it data that
> you care a lot about, or can it be easily restored from other sources?
> (This basically boils down to: how important is it to rescue the data
> in-place?)

If this is broken hardware in the drive (and it looks like it), this 
will be something you likely cannot do yourself and it will be really 
expensive. It will also fail unless a valid keyslot gets recovered 
fully. It may be a broken controller or even some other hardware 
damage on the system you are trying to read the disk, so it may be 
worthwhile trying to read it somewhere else. 

The detailed SMART status should tell more though.

Regards,
Arno
-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier