[dm-crypt] LUKS encrypted hard disk crashed. Recovery question

[dm-crypt] LUKS encrypted hard disk crashed. Recovery question

[Saibal Kumar Adhya]

[-- Attachment #1: Type: text/plain, Size: 740 bytes --]

Dear experts,   I had a 500GB hard disk which was encrypted using the following specification.
type:    LUKS1cipher:  aes-xts-plain64keysize: 512 bitsdevice:  /dev/sda5offset:  4096 sectorssize:    999708672 sectorsmode:    read/write
Pass phrase is known.
Unfortunately, the hard disk crashed sometime back. It is a hardware fault. There was no backup.
A data recovery agency managed to recover 50% of the sectors. However it is unable to recover any data as the original disk was encrypted.
So now trying to figure out how to de-crypt and recover some of the data?
I'll be extremely grateful if you can provide some answer. Thanks in advance.
--Regards~Saibal
Saibal Kumar AdhyaDebian user and Linux enthusiast. 

 

[-- Attachment #2: Type: text/html, Size: 2901 bytes --]

Re: [dm-crypt] LUKS encrypted hard disk crashed. Recovery question

[Michael Kjörling]

On 19 Aug 2016 08:57 +0000, from saibalka@yahoo.co.in (Saibal Kumar Adhya):
> Unfortunately, the hard disk crashed sometime back. It is a hardware
> fault. There was no backup.
> A data recovery agency managed to recover 50% of the sectors.
> However it is unable to recover any data as the original disk was
> encrypted.
> So now trying to figure out how to de-crypt and recover some of the
> data?

Unfortunately, if the key slots are lost or damaged beyond repair, and
you have no backup, then I am fairly certain that you are out of luck.

I assume that when you say that there was no backup, you also mean
that you do not have a LUKS header copy or master key data for the
container.

Such a situation is similar to having overwritten the key slot area of
the disk, which is a good way to quickly decomission a LUKS-encrypted
disk because it renders all other data non-recoverable (the data
required to gain access to the payload data no longer exists).

If you are able to somehow gain access to the key slots in the LUKS
header, it should be possible to decrypt the (stored) payload data, to
the extent that the data recovery agency was able to recover the data.
What they were not able to recover will decrypt to nonsense.

-- 
Michael Kjörling • https://michael.kjorling.se • michael@kjorling.se
                 “People who think they know everything really annoy
                 those of us who know we don’t.” (Bjarne Stroustrup)

Re: [dm-crypt] LUKS encrypted hard disk crashed. Recovery question

[Saibal Kumar Adhya]

[-- Attachment #1: Type: text/plain, Size: 1969 bytes --]

[saibal] Thanks a lot Michael. 
> If you are able to somehow gain access to the key slots in the LUKS
> header, it should be possible to decrypt the (stored) payload data, to
> the extent that the data recovery agency was able to recover the data.
> What they were not able to recover will decrypt to nonsense.
 
[saibal] I have couple of following question. 1) Is there a way to know, if the key slot area in the LUKS header has been recovered or not? How to recover the entire partition from there?
2) This question is for my information. As I understand, LUKS header and "key-slot" are very very critical. So, if any of these sectors get damaged then the entire partition is un-usable. Is there a backup copy of LUKS header and key slots, kept within the partition itself?
Thanks in advance.
--Regards~Saibal
Saibal Kumar AdhyaDebian user and Linux enthusiast.
>
> -- 
> Michael Kj?rling ? https://michael.kjorling.se ? michael@kjorling.se
>                ?People who think they know everything really annoy
>                those of us who know we don?t.? (Bjarne Stroustrup)

 

    On Friday, August 19, 2016 2:27 PM, Saibal Kumar Adhya <saibalka@yahoo.co.in> wrote:
 

 Dear experts,   I had a 500GB hard disk which was encrypted using the following specification.
type:    LUKS1cipher:  aes-xts-plain64keysize: 512 bitsdevice:  /dev/sda5offset:  4096 sectorssize:    999708672 sectorsmode:    read/write
Pass phrase is known.
Unfortunately, the hard disk crashed sometime back. It is a hardware fault. There was no backup.
A data recovery agency managed to recover 50% of the sectors. However it is unable to recover any data as the original disk was encrypted.
So now trying to figure out how to de-crypt and recover some of the data?
I'll be extremely grateful if you can provide some answer. Thanks in advance.
--Regards~Saibal
Saibal Kumar AdhyaDebian user and Linux enthusiast. 

 

  

[-- Attachment #2: Type: text/html, Size: 12059 bytes --]

Re: [dm-crypt] LUKS encrypted hard disk crashed. Recovery question

[Arno Wagner]

Hi Saibal,

On Fri, Aug 19, 2016 at 13:45:21 CEST, Saibal Kumar Adhya wrote:
>    [saibal] Thanks a lot Michael.
>    > If you are able to somehow gain access to the key slots in the LUKS
>    > header, it should be possible to decrypt the (stored) payload data,
>    to
>    > the extent that the data recovery agency was able to recover the
>    data.
>    > What they were not able to recover will decrypt to nonsense.
> 
>    [saibal] I have couple of following question.
> 
>    1) Is there a way to know, if the key slot area in the LUKS header has
>    been recovered or not? How to recover the entire partition from there?

Try a LuksOpen. It does not care about filesystem damage, but it
will obnly work if header and keyslot are undamaged.

>    2) This question is for my information. As I understand, LUKS header
>    and "key-slot" are very very critical. So, if any of these sectors get
>    damaged then the entire partition is un-usable. Is there a backup copy
>    of LUKS header and key slots, kept within the partition itself?
>    Thanks in advance.

No. You have to do such a backup yourself. See most of FAQ Section 6:
https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions

Regards,
Arno

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier