[Solved] Need help to recover luks partition

[efrpcabo]

Hi,

I need help to recover a LUKS partition.
It would be great if someone could give me some advice.

I have already posted in the ubuntu forums in december-2016, but nobody answered:
https://ubuntuforums.org/showthread.php ... st13581732

This is a disk I use for important data.
I have a backup, but I lost some data from the date of the last backup I've made and I would like to get it back.

So, here's what happened.
Initially, I was using Debian 7 and at that time I've formated the disk like this:

parted /dev/sdx
mklabel gpt
unit s
mkpart primary ext3 2048s -1
cryptsetup luksFormat --cipher aes-cbc-essiv:sha256 --verify-passphrase --key-size 256 /dev/sdx
cryptsetup luksOpen /dev/sdx sdx_crypt
mkfs.ext3 /dev/mapper/sdx_crypt
Copied data to it and used it for many months without problems.
Life was perfect up to this point.

Then, I changed from Debian 7 to Debian 8, doing a clean install.
I mention this because it may be relevant, as the versions of many programs may have changed, like cryptsetup, parted, etc, and also because I may have made some mistakes on my old or new Debian instalation that led to this situation.

One day, I connected the disk to my new Debian 8 system and tried mounting and it gave me an error and didn't mount anymore.
When I tried with terminal, is said "either superblock or partition table is corrupt".
When I tried to mount it with the Gnome-Disk-Utility, I got this error:
"Error mounting /dev/dm-6 at /media/user1/3PAB:
Command-line `mount -t "ext3" -o "uhelper=udisks2,nodev,nosuid" "/dev/dm-6" "/media/user1/3PAB"' exited with non-zero exit status 32:
mount: wrong fs type, bad option, bad superblock on /dev/mapper/luks-c4ebeef5-7537-417e-b63b-fedc99561677, missing codepage or helper program, or other error

So, instead of making a clone with DD to another disk, I did one thing that I shouldn't have done:
I created a new partition table equal to the one before, as you can see in the above:
parted /dev/sdx
mklabel gpt
unit s
mkpart primary ext3 2048s -1
(and stopped here)

I did that hoping it would solve my problem, because in the past it had worked in similar situations
But this time, it didn't work

Then, afraid of making more mistakes, I made a clone using DD to another disk of the same make and model
And now I would like somebody to give me some advice or tell me I should give up on this

I also would like to mention that I had other disks with different data on them and they also stopped mounting in this Debian 8 install
But the I went and booted with a clone of my Debian 7 installation I had from a year ago and I could mount them
Bad luck I didn't think of that before making a new partition disk to this disk

At this point, I believe that all my luks encrypted data is still on the disk, because the new partition table start in the same 2048 sector
But I'm not sure if I can recover it or not

So, I'd appreciate if you could share your thoughts on this
Please do that, even if you think it may be a long shot or even if you are unsure but have some hint you could share

[efrpcabo]

Now I'm making a clone (using DD) of an identical disk, formatted the same way, to an identical third disk.

Afterwards, I will only copy (also using DD, starting at sector 2048 until the correct sector of the partition) the LUKS partition to this third disk.

[efrpcabo]

Well, I thought that would solve the problem, but it didn't.

DD stopped saying sdd ran out of space

Although boths disks are exactly the same, there's a difference in the number of sectors, like fdisk shows:



Disk /dev/sdb: 3000.6 GB, 3000592982016 bytes
255 heads, 63 sectors/track, 364801 cylinders, total 5860533168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disk identifier: 0x00000000

Device Boot Start End Blocks Id System
/dev/sdb1 1 4294967295 2147483647+ ee GPT
Partition 1 does not start on physical sector boundary.




Disk /dev/sdd: 3000.6 GB, 3000591900160 bytes
255 heads, 63 sectors/track, 364801 cylinders, total 5860531055 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disk identifier: 0x00000000

Device Boot Start End Blocks Id System
/dev/sdd1 1 4294967295 2147483647+ ee GPT
Partition 1 does not start on physical sector boundary.



The problem is that initially when sdd worked, it had the same number of sectors as sdb.

What caused sdd to loose some sectors?
Because after that it sopped working.

Any ideas?

[efrpcabo]

I've found the cause of this in here:
https://bbs.archlinux.org/viewtopic.php?id=171759
Excerpts:
"I suspect you motherboard set a HPA - that's what some gigabyte motherboard tend to do (or used to, at least, someone convinved me a while ago this should no longer happen"
"max sectors = 5860531055/5860533168, HPA is enabled"
"what happened is that Gigabyte boards have a feature to backup the BIOS to the end of the primary HDD"
"It used to be buggy on some boards"

I still can't believe how on earth a f*ck*ng motherboard does this!!!!

I'm mad as hell and posting this in case anyone has the same problem!

I'll never again buy a Gigabyte motherboard in my life! Never!!!

[efrpcabo]

Read also this link, for more info on HDA and why it is a curse:
https://forums.lime-technology.com/topi ... ent-sizes/

[efrpcabo]

For anyone facing a similar problem, don't make a partiton and at the same time create a filesystem like I did (mkpart primary ext3 2048s -1s).
This parted command is fine in normal conditions, but not in this cenario I had.
At most, I should have created an empty partition, not a filesystem, in order to preserve the LUKS header.

You can read the rest of the this story here:
https://www.linuxquestions.org/question ... ost5756098

[efrpcabo]

Now I know the solution for this situation was quite simple.
In fact, all I had to do was remove the HPA and the LUKS partition and data would come back after restarting the computer:

1st step - check if HPA is enabled:
hdparm -N /dev/sdx

/dev/sdx:
max sectors = 78125000/78165360, HPA is enabled

2nd step - remove the HPA:
hdparm -N p"max number of sectors" /dev/sdx

example:
hdparm -N p78165360 /dev/sdx
78165360 = denominator from fraction above

done
restart

credits:
https://superuser.com/questions/642637/ ... le_rich_qa

see also DCO