I wanted to install Debian Linux after a weird journey with Gentoo Linux. My partition layout is this:
- Boot Partition (512 MiB, mount at /boot)
- Swap Partition (4 GiB)
- Root Partition (~80 GiB, mount at /)
- Home Partition (~170 GiB, mount at /home, LUKS encrypted)
While trying to preserve the home partition, I think I clicked ‘Configure encrypted partitions’ on the Debian installer and then set a password for it (the same that it had before).
Now, I can unlock it like before, but after it is unlocked, no utility recognizes the filesystem (ext4) and the file command reports it as being data:
# file -s -L /dev/mapper/home
/dev/mapper/home: data
file on the encrypted partition returns the following:
# file -s /dev/nvme0n1p4
/dev/nvme0n1p4: LUKS encrypted file, ver 2, header size 16384, ID 3, algo sha256, salt 0x590d84c0e8397ad0..., UUID: c5ff37db-11f7-4ccf-8869-c4bc22648202, crc 0x345f75d85c9f444a..., at 0x1000 {"keyslots":{"0":{"type":"luks2","key_size":64,"af":{"type":"luks1","stripes":4000,"hash":"sha256"},"area":{"type":"raw","offse
(This is the complete output, it cuts at offset for some reason)
My luksDump output is this:
# cryptsetup luksDump /dev/nvme0n1p4
LUKS header information
Version: 2
Epoch: 3
Metadata area: 16384 [bytes]
Keyslots area: 16744448 [bytes]
UUID: c5ff37db-11f7-4ccf-8869-c4bc22648202
Label: (no label)
Subsystem: (no subsystem)
Flags: (no flags)
Data segments:
0: crypt
offset: 16777216 [bytes]
length: (whole device)
cipher: aes-xts-plain64
sector: 512 [bytes]
Keyslots:
0: luks2
Key: 512 bits
Priority: normal
Cipher: aes-xts-plain64
Cipher key: 512 bits
PBKDF: argon2id
Time cost: 6
Memory: 1048576
Threads: 4
Salt: 18 b4 a6 e9 87 1f 94 f6 7d 96 f2 9c 0f 2e ca 75
e6 0f 80 7d 09 70 40 19 d0 a4 a1 49 ff 5c 1c 0b
AF stripes: 4000
AF hash: sha256
Area offset:32768 [bytes]
Area length:258048 [bytes]
Digest ID: 0
Tokens:
Digests:
0: pbkdf2
Hash: sha256
Iterations: 171785
Salt: c2 b0 a6 f5 e1 bf 5f 85 82 b1 d5 f3 10 c6 ae b7
7c fc 50 41 c5 a6 03 f6 5a bd ac df 46 89 7b c6
Digest: 57 7d fb 87 69 c5 58 07 cf 82 88 5e f8 c6 39 f5
7d 00 ec 07 e0 df b8 ee b5 dd ff 20 bf b3 bc 01
My guess is that I re-encrypted the already encrypted partition. Also, I noticed that the UUID changed. Can anyone help me recover it? Thanks in advance.
If you need more logs, I will happily provide them to you.
Given that the UUID changed, you almost certainly made a new LUKS container, overwriting the old one. That’s bad, because the LUKS header is the only source of the actual encryption key that was used, and making a new one will overwrite both the main header as well as its backup copy immediately. Your password/keyfile/whatever is merely used to decrypt the part of the header that has the actual encryption key, and that’s gone in that case.
Unless you have access to a header backup from before that, there’s a fairly strong chance it’s irrecoverable. I’d suggest going through any archives you might have to see if you have such a backup - most of the instructions on the Gentoo wiki encourage making one, so you might have made one through the power of copying & pasting instructions. Should be a file of around 16MB.
Sadly, I don’t have a backup of the header. But I know the password that was used to decrypt the partition. Anyway, from the things you said, I can conclude that it might be irrecoverable.
What are the chances the header is stored in the partition map? Could you use testdisk to try and recover the old partition map and its data?
I think the header is stored in the partition map but just like chameleon said, it has been overwritten by the new one, that I created by accident.
Right, well testdisk has worked wonders in the past for me. It might worth a try especially if this is a spinning rust drive. It has helped me recover broken partitions and lost files so if you know where you’re looking you just might have a chance. I’m no expert but it seems like one of your last options with all the info provided. Best of luck!