help with LUKS data recovery
#5
I want to thank you for the time you take to try and help me. 
I followed the instructions for the test on my VM system, and everything worked properly:
Code:
root@openmediavault-test:~# dd if=/dev/urandom of=test bs=1M count=100
100+0 records in
100+0 records out
104857600 bytes (105 MB) copied, 0.487188 s, 215 MB/s
root@openmediavault-test:~# cryptsetup luksFormat test

WARNING!
========
This will overwrite data on test irrevocably.

Are you sure? (Type uppercase yes): YES
Enter passphrase:
Verify passphrase:
root@openmediavault-test:~# cryptsetup luksOpen test tmp
Enter passphrase for test:
root@openmediavault-test:~# xxd -l 512 /dev/mapper/tmp
0000000: bcdf 1e02 2ef9 dfff 35d0 970d bddc fb65  ........5......e
0000010: 4e83 4155 61de 4b60 f4b8 6b50 681f 34d9  N.AUa.K`..kPh.4.
0000020: 7dff 6a7a 585b 8dc7 0fdc 06cb a50d 6f40  }.jzX[........o@
0000030: 1cc7 ae50 c7c8 f243 a740 7982 6d4e 7f36  ...P...C.@y.mN.6
0000040: 1541 7959 b0a3 4979 eebf b95c 3166 a5a8  .AyY..Iy...\1f..
0000050: 046d 8c4a 7da4 b3f0 9dbb 0b0e 72b3 c761  .m.J}.......r..a
0000060: cbef c3b5 4af9 72f9 6940 3ad3 be5b 220e  ....J.r.i@:..[".
0000070: ff7b db5e 9a34 88a4 b19a 371c 61f0 9d33  .{.^.4....7.a..3
0000080: ea24 5212 fb2b 88d0 e805 edbe 7969 5833  .$R..+......yiX3
0000090: 66e2 7071 1931 17c8 1039 1521 8420 d2ce  f.pq.1...9.!. ..
00000a0: 7d6b 5774 6059 12fe 10b1 7f56 d651 8d40  }kWt`Y.....V.Q.@
00000b0: 0a85 e4f0 80c1 278c 3b5a 973c 7e14 50fb  ......'.;Z.<~.P.
00000c0: 03d4 7607 a83f ea65 32ac c666 a965 cdbe  ..v..?.e2..f.e..
00000d0: 048c 8ede 0cc9 319e 5df0 8c0c 87ee 2ee5  ......1.].......
00000e0: 8939 46ea 2bd0 52f1 42bb 0577 066a 6170  .9F.+.R.B..w.jap
00000f0: 4f7d d0cd 5486 3dde 9e12 97e1 86cb dc6a  O}..T.=........j
0000100: 2511 1a68 4e04 fb75 e12e 3413 bea6 6fa2  %..hN..u..4...o.
0000110: 24ed d280 6779 13cc 257a 6663 e883 e9f8  $...gy..%zfc....
0000120: d544 042a 3653 9a74 b20d 3bc6 e38d c43d  .D.*6S.t..;....=
0000130: 6e90 125f c732 9a6e 7710 0dff 8073 c797  n.._.2.nw....s..
0000140: d2df 4e4d e132 c1cd d2d9 f58a d6ca c724  ..NM.2.........$
0000150: 4fa6 d8f1 eae6 3cf5 56dc ea2c f9fa 2736  O.....<.V..,..'6
0000160: 7cfb 2e00 423b 3e00 838a ce3d 64e0 b273  |...B;>....=d..s
0000170: 7f9f d294 ea23 397b bb49 548a a135 5d08  .....#9{.IT..5].
0000180: c0af 0ab3 bf17 38d8 a5ad 9e32 aa11 194a  ......8....2...J
0000190: efff 602d 3b3b 6e2a 89cf 40d8 92d7 4743  ..`-;;n*..@...GC
00001a0: eddd 5e67 3a04 fa45 71dd 30af 123f 2d78  ..^g:..Eq.0..?-x
00001b0: d4e3 ac50 6e30 e5a2 3a9c 9a54 8e6c 49c3  ...Pn0..:..T.lI.
00001c0: 33b4 75f6 48a2 a5ac 6288 b80d 4c90 f66a  3.u.H...b...L..j
00001d0: 2003 1e6f 09a7 56bd fc83 d0f7 a46a 92e8   ..o..V......j..
00001e0: 30a4 1132 6e5d e118 6c58 bcf7 a825 559d  0..2n]..lX...%U.
00001f0: 5823 e9a0 954c 8530 8172 c868 4755 34a3  X#...L.0.r.hGU4.
root@openmediavault-test:~# mkfs.ext4 /dev/mapper/tmp
mke2fs 1.43.3 (04-Sep-2016)
Creating filesystem with 100352 1k blocks and 25168 inodes
Filesystem UUID: ad5fe9aa-f669-4987-8581-e3b1cf0cfbde
Superblock backups stored on blocks:
       8193, 24577, 40961, 57345, 73729

Allocating group tables: done
Writing inode tables: done
Creating journal (4096 blocks): done
Writing superblocks and filesystem accounting information: done

root@openmediavault-test:~# xxd -l 512 /dev/mapper/tmp
0000000: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000010: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000040: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000050: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000060: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000070: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000080: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000090: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000100: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000110: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000120: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000130: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000140: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000150: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000160: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000170: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000180: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000190: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00001a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00001b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00001c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00001d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00001e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00001f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................


I noticed in the example files that the header has a lot of NUL chars too, but there's some apparently encrypted data at the very end. My header files don't have this and just EOF with NULs.

To answer the other questions:
1. architecture is 64bit amd
2. little endian
3. EXT4
4. Keyfiles are optional, but I didn't use them.

edit: could it be related to the raid5 that I use?


Messages In This Thread
help with LUKS data recovery - by j45645hn45 - 01-04-2018, 07:26 PM
RE: help with LUKS data recovery - by philsmd - 01-04-2018, 08:06 PM
RE: help with LUKS data recovery - by j45645hn45 - 01-05-2018, 01:18 AM
RE: help with LUKS data recovery - by philsmd - 01-05-2018, 10:56 AM
RE: help with LUKS data recovery - by j45645hn45 - 01-05-2018, 01:00 PM
RE: help with LUKS data recovery - by philsmd - 01-05-2018, 01:49 PM
RE: help with LUKS data recovery - by j45645hn45 - 01-05-2018, 02:18 PM
RE: help with LUKS data recovery - by philsmd - 01-05-2018, 02:31 PM
RE: help with LUKS data recovery - by j45645hn45 - 01-06-2018, 04:56 PM
RE: help with LUKS data recovery - by philsmd - 01-06-2018, 05:19 PM
RE: help with LUKS data recovery - by j45645hn45 - 01-06-2018, 06:20 PM
RE: help with LUKS data recovery - by j45645hn45 - 02-16-2018, 10:49 PM
RE: help with LUKS data recovery - by atom - 02-16-2018, 11:49 PM
RE: help with LUKS data recovery - by j45645hn45 - 02-17-2018, 12:13 AM