LinuxQuestions.org
Review your favorite Linux distribution.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 05-10-2024, 10:03 PM   #16
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: Rocky Linux
Posts: 4,783

Rep: Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214

Quote:
Originally Posted by Jackson111 View Post
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sdb - 4000 GB / 3726 GiB - CHS 486401 255 63
Partition Start End Size in sectors
>P Linux filesys. data 1046287267 1053821026 7533760 [^K~M27n1ҥ %~JMM-7D]
That's not a good sign. It means that testdisk found nothing but the existing partition with unidentifiable content.

If you have the hexedit command available, then rather than fussing with testdisk it's a lot easier just to run "hexedit -s /dev/sdb" (preferably in a window with at least 36 lines so that a complete sector can be shown) and search for the hex string "4C554B53BABE". That's the ASCII characters "LUKS" followed by the hex bytes 0xBA and 0xBE. It would take quite a while to search the whole disk, but if it doesn't find that string in the first few minutes then there is little chance of finding your LUKS header.
 
Old 05-10-2024, 11:00 PM   #17
Jackson111
LQ Newbie
 
Registered: Jul 2019
Posts: 28

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by rknichols View Post
That's not a good sign. It means that testdisk found nothing but the existing partition with unidentifiable content.

If you have the hexedit command available, then rather than fussing with testdisk it's a lot easier just to run "hexedit -s /dev/sdb" (preferably in a window with at least 36 lines so that a complete sector can be shown) and search for the hex string "4C554B53BABE". That's the ASCII characters "LUKS" followed by the hex bytes 0xBA and 0xBE. It would take quite a while to search the whole disk, but if it doesn't find that string in the first few minutes then there is little chance of finding your LUKS header.
Going through the manual I didn't get smarter. Thank you, I thought I maybe didn't understand something.

I'll try hexedit (does it make sense to pipe it through grep?), but now I really want to know what happened, as I am sure a simply accidentally formatted disk wouldn't be such a head scratcher.
 
Old 05-11-2024, 08:58 AM   #18
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: Rocky Linux
Posts: 4,783

Rep: Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214Reputation: 2214
Quote:
Originally Posted by Jackson111 View Post
Going through the manual I didn't get smarter. Thank you, I thought I maybe didn't understand something.

I'll try hexedit (does it make sense to pipe it through grep?), but now I really want to know what happened, as I am sure a simply accidentally formatted disk wouldn't be such a head scratcher.
Don't try to pipe hexedit output through anything. It's an interactive editor. Just type the "/" key to enter the search function and then enter the string "4c554b53babe" (without the quotes). You want to find that sequence at the start of a sector, which will be a hex address ending in n00, where n is an even number. If it finds that somewhere else, just type "/" and <enter> to continue the search. If your encrypted partition really was the only partition on the disk, that sequence should be found almost immediately.
 
Old 05-11-2024, 09:37 AM   #19
Jackson111
LQ Newbie
 
Registered: Jul 2019
Posts: 28

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by rknichols View Post
Don't try to pipe hexedit output through anything. It's an interactive editor. Just type the "/" key to enter the search function and then enter the string "4c554b53babe" (without the quotes). You want to find that sequence at the start of a sector, which will be a hex address ending in n00, where n is an even number. If it finds that somewhere else, just type "/" and <enter> to continue the search. If your encrypted partition really was the only partition on the disk, that sequence should be found almost immediately.
Out of luck, it seems

Last edited by Jackson111; 05-11-2024 at 09:38 AM.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Can I have an encrypted HD and a non-encrypted HD in the same computer? grumpyskeptic Linux Mint 1 02-15-2017 05:21 PM
LXer: Two Tips to Keep Your Phone's Encrypted Messages Encrypted LXer Syndicated Linux News 0 05-02-2016 11:21 PM
Shrink partition (LVM encrypted PVs + encrypted LVs) gedaj Linux - Newbie 2 05-22-2013 03:44 AM
Resizable encrypted LVM requiring just one password on boot (encrypted volume group)? Nyyr Linux - Software 9 01-24-2013 05:52 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 05:38 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration