How ro recover lost LUKS partition on external harddisk

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ margin-bottom:0;
}

Using gnome-disk-utility, I accidentally removed a LUKS partition on an external hard disk. This hard disk now looks like this:

enter image description here

I just pressed the minus-sign, thus I guess I just removed the partition but not the data.

Following this documentation on help.ubuntu.com I used testdisk which only found the following:

http://www.cgsecurity.org

Disk /dev/sdg - 1000 GB / 931 GiB - CHS 121601 255 63

Partition               Start        End    Size in sectors

>* Linux                    0   1  1     0 254 63      16002

L HPFS - NTFS          114306 219 26 121601  80 59  117185452

Now I wonder, if this askubuntu answer could help me recovering my partition. But I have no idea what to enter precisely enter into sfdik

Any help is greatly appreciated as I am kind off desperate since I really need my data back...

Thanks!

asked Apr 5 at 11:25

mdthh

1133

add a comment |

Using gnome-disk-utility, I accidentally removed a LUKS partition on an external hard disk. This hard disk now looks like this:

enter image description here

I just pressed the minus-sign, thus I guess I just removed the partition but not the data.

Following this documentation on help.ubuntu.com I used testdisk which only found the following:

http://www.cgsecurity.org

Disk /dev/sdg - 1000 GB / 931 GiB - CHS 121601 255 63

Partition               Start        End    Size in sectors

>* Linux                    0   1  1     0 254 63      16002

L HPFS - NTFS          114306 219 26 121601  80 59  117185452

Now I wonder, if this askubuntu answer could help me recovering my partition. But I have no idea what to enter precisely enter into sfdik

Any help is greatly appreciated as I am kind off desperate since I really need my data back...

Thanks!

asked Apr 5 at 11:25

mdthh

1133

add a comment |

Using gnome-disk-utility, I accidentally removed a LUKS partition on an external hard disk. This hard disk now looks like this:

enter image description here

I just pressed the minus-sign, thus I guess I just removed the partition but not the data.

Following this documentation on help.ubuntu.com I used testdisk which only found the following:

http://www.cgsecurity.org

Disk /dev/sdg - 1000 GB / 931 GiB - CHS 121601 255 63

Partition               Start        End    Size in sectors

>* Linux                    0   1  1     0 254 63      16002

L HPFS - NTFS          114306 219 26 121601  80 59  117185452

Now I wonder, if this askubuntu answer could help me recovering my partition. But I have no idea what to enter precisely enter into sfdik

Any help is greatly appreciated as I am kind off desperate since I really need my data back...

Thanks!

asked Apr 5 at 11:25

mdthh

1133

Using gnome-disk-utility, I accidentally removed a LUKS partition on an external hard disk. This hard disk now looks like this:

enter image description here

I just pressed the minus-sign, thus I guess I just removed the partition but not the data.

Following this documentation on help.ubuntu.com I used testdisk which only found the following:

http://www.cgsecurity.org

Disk /dev/sdg - 1000 GB / 931 GiB - CHS 121601 255 63

Partition               Start        End    Size in sectors

>* Linux                    0   1  1     0 254 63      16002

L HPFS - NTFS          114306 219 26 121601  80 59  117185452

Now I wonder, if this askubuntu answer could help me recovering my partition. But I have no idea what to enter precisely enter into sfdik

Any help is greatly appreciated as I am kind off desperate since I really need my data back...

Thanks!

partitioning hard-drive data-recovery luks gnome-disk-utility

asked Apr 5 at 11:25

mdthh

1133

asked Apr 5 at 11:25

mdthh

1133

asked Apr 5 at 11:25

mdthh

1133

asked Apr 5 at 11:25

mdthh

1133

asked Apr 5 at 11:25

mdthh

1133

add a comment |

1 Answer
1

active

oldest

votes

If the data is still there, you can look for the LUKS header.

Fire up some hexadecimal editor (in read-only mode !). You better be sure how to use this editor so that not to make any modification.

My recommendation is to use xxd on the command line, like

sudo xxd /dev/sdg|less

and look for LUKS string: in less type '/' then 'LUKS' then 'Enter'

then if you find it, note down (on paper ?), the position of the L in LUKS.
Note that the offset is in hexa. Convert it to decimal.

If you have reach this point you have the start of your LUKS partition, now you need to find the end. You could use the start of sdg2 minus 1.

Then go and use fdisk or sfidsk to recreate the partition only. Don't use parted or gparted that will reformat it!

And you should be good.

Edit:
I made a python3 script to look that for you, if you are not familiar with cli.

Either run

sudo python3 search-for-luks-headers.py -l 16 /dev/sdg

or make a copy of the first MB of /dev/sdg and use the script as a user on the copy.

Note: with either method, you will find the offset of the LUKS partition in bytes. You must translate that in sectors to use it with [s]fdisk. Your disk most probably uses 512 bytes sector (please check this)

edited Apr 6 at 9:55

answered Apr 5 at 12:20

solsTiCe

6,50132151

Wow! Thanks for this elaborate answer + the py script. So I found the LUKS Header: Found LUKS header at offset 32256, then created partition with fdisk. p ĺooks like this: /dev/sdh1 32256 1836339711 1836307456 875,6G 83 Linux|/dev/sdh2 1836339712 1953525163 117185452 55,9G 7 HPFS/NTFS/exFAT but for some reason it didn't work. In gnome-disks looks like this: imgur.com/a/kK46Ggs Whats's wrong?

– mdthh
Apr 6 at 9:29

the offset given by the python is in bytes but fdisk use sector (possibly of 512 bytes). So if your disk uses 512 bytes sectors, then the start of the LUKS partition is at 32256/512 = 63. If you find it a good answer, please tick the check mark in the left margin to mark it as an accepted answer. thanks

– solsTiCe
Apr 6 at 9:51

add a comment |

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "89"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1131409%2fhow-ro-recover-lost-luks-partition-on-external-harddisk%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

If the data is still there, you can look for the LUKS header.

Fire up some hexadecimal editor (in read-only mode !). You better be sure how to use this editor so that not to make any modification.

My recommendation is to use xxd on the command line, like

sudo xxd /dev/sdg|less

and look for LUKS string: in less type '/' then 'LUKS' then 'Enter'

then if you find it, note down (on paper ?), the position of the L in LUKS.
Note that the offset is in hexa. Convert it to decimal.

If you have reach this point you have the start of your LUKS partition, now you need to find the end. You could use the start of sdg2 minus 1.

Then go and use fdisk or sfidsk to recreate the partition only. Don't use parted or gparted that will reformat it!

And you should be good.

Edit:
I made a python3 script to look that for you, if you are not familiar with cli.

Either run

sudo python3 search-for-luks-headers.py -l 16 /dev/sdg

or make a copy of the first MB of /dev/sdg and use the script as a user on the copy.

edited Apr 6 at 9:55

answered Apr 5 at 12:20

solsTiCe

6,50132151

Wow! Thanks for this elaborate answer + the py script. So I found the LUKS Header: Found LUKS header at offset 32256, then created partition with fdisk. p ĺooks like this: /dev/sdh1 32256 1836339711 1836307456 875,6G 83 Linux|/dev/sdh2 1836339712 1953525163 117185452 55,9G 7 HPFS/NTFS/exFAT but for some reason it didn't work. In gnome-disks looks like this: imgur.com/a/kK46Ggs Whats's wrong?

– mdthh
Apr 6 at 9:29

the offset given by the python is in bytes but fdisk use sector (possibly of 512 bytes). So if your disk uses 512 bytes sectors, then the start of the LUKS partition is at 32256/512 = 63. If you find it a good answer, please tick the check mark in the left margin to mark it as an accepted answer. thanks

– solsTiCe
Apr 6 at 9:51

add a comment |

If the data is still there, you can look for the LUKS header.

Fire up some hexadecimal editor (in read-only mode !). You better be sure how to use this editor so that not to make any modification.

My recommendation is to use xxd on the command line, like

sudo xxd /dev/sdg|less

and look for LUKS string: in less type '/' then 'LUKS' then 'Enter'

then if you find it, note down (on paper ?), the position of the L in LUKS.
Note that the offset is in hexa. Convert it to decimal.

If you have reach this point you have the start of your LUKS partition, now you need to find the end. You could use the start of sdg2 minus 1.

Then go and use fdisk or sfidsk to recreate the partition only. Don't use parted or gparted that will reformat it!

And you should be good.

Edit:
I made a python3 script to look that for you, if you are not familiar with cli.

Either run

sudo python3 search-for-luks-headers.py -l 16 /dev/sdg

or make a copy of the first MB of /dev/sdg and use the script as a user on the copy.

edited Apr 6 at 9:55

answered Apr 5 at 12:20

solsTiCe

6,50132151

Wow! Thanks for this elaborate answer + the py script. So I found the LUKS Header: Found LUKS header at offset 32256, then created partition with fdisk. p ĺooks like this: /dev/sdh1 32256 1836339711 1836307456 875,6G 83 Linux|/dev/sdh2 1836339712 1953525163 117185452 55,9G 7 HPFS/NTFS/exFAT but for some reason it didn't work. In gnome-disks looks like this: imgur.com/a/kK46Ggs Whats's wrong?

– mdthh
Apr 6 at 9:29

the offset given by the python is in bytes but fdisk use sector (possibly of 512 bytes). So if your disk uses 512 bytes sectors, then the start of the LUKS partition is at 32256/512 = 63. If you find it a good answer, please tick the check mark in the left margin to mark it as an accepted answer. thanks

– solsTiCe
Apr 6 at 9:51

add a comment |

If the data is still there, you can look for the LUKS header.

Fire up some hexadecimal editor (in read-only mode !). You better be sure how to use this editor so that not to make any modification.

My recommendation is to use xxd on the command line, like

sudo xxd /dev/sdg|less

and look for LUKS string: in less type '/' then 'LUKS' then 'Enter'

then if you find it, note down (on paper ?), the position of the L in LUKS.
Note that the offset is in hexa. Convert it to decimal.

If you have reach this point you have the start of your LUKS partition, now you need to find the end. You could use the start of sdg2 minus 1.

Then go and use fdisk or sfidsk to recreate the partition only. Don't use parted or gparted that will reformat it!

And you should be good.

Edit:
I made a python3 script to look that for you, if you are not familiar with cli.

Either run

sudo python3 search-for-luks-headers.py -l 16 /dev/sdg

or make a copy of the first MB of /dev/sdg and use the script as a user on the copy.

edited Apr 6 at 9:55

answered Apr 5 at 12:20

solsTiCe

6,50132151

If the data is still there, you can look for the LUKS header.

Fire up some hexadecimal editor (in read-only mode !). You better be sure how to use this editor so that not to make any modification.

My recommendation is to use xxd on the command line, like

sudo xxd /dev/sdg|less

and look for LUKS string: in less type '/' then 'LUKS' then 'Enter'

then if you find it, note down (on paper ?), the position of the L in LUKS.
Note that the offset is in hexa. Convert it to decimal.

If you have reach this point you have the start of your LUKS partition, now you need to find the end. You could use the start of sdg2 minus 1.

Then go and use fdisk or sfidsk to recreate the partition only. Don't use parted or gparted that will reformat it!

And you should be good.

Edit:
I made a python3 script to look that for you, if you are not familiar with cli.

Either run

sudo python3 search-for-luks-headers.py -l 16 /dev/sdg

or make a copy of the first MB of /dev/sdg and use the script as a user on the copy.

edited Apr 6 at 9:55

answered Apr 5 at 12:20

solsTiCe

6,50132151

edited Apr 6 at 9:55

answered Apr 5 at 12:20

solsTiCe

6,50132151

answered Apr 5 at 12:20

solsTiCe

6,50132151

answered Apr 5 at 12:20

solsTiCe

6,50132151

Wow! Thanks for this elaborate answer + the py script. So I found the LUKS Header: Found LUKS header at offset 32256, then created partition with fdisk. p ĺooks like this: /dev/sdh1 32256 1836339711 1836307456 875,6G 83 Linux|/dev/sdh2 1836339712 1953525163 117185452 55,9G 7 HPFS/NTFS/exFAT but for some reason it didn't work. In gnome-disks looks like this: imgur.com/a/kK46Ggs Whats's wrong?

– mdthh
Apr 6 at 9:29

the offset given by the python is in bytes but fdisk use sector (possibly of 512 bytes). So if your disk uses 512 bytes sectors, then the start of the LUKS partition is at 32256/512 = 63. If you find it a good answer, please tick the check mark in the left margin to mark it as an accepted answer. thanks

– solsTiCe
Apr 6 at 9:51

add a comment |

Wow! Thanks for this elaborate answer + the py script. So I found the LUKS Header: Found LUKS header at offset 32256, then created partition with fdisk. p ĺooks like this: /dev/sdh1 32256 1836339711 1836307456 875,6G 83 Linux|/dev/sdh2 1836339712 1953525163 117185452 55,9G 7 HPFS/NTFS/exFAT but for some reason it didn't work. In gnome-disks looks like this: imgur.com/a/kK46Ggs Whats's wrong?

– mdthh
Apr 6 at 9:29

the offset given by the python is in bytes but fdisk use sector (possibly of 512 bytes). So if your disk uses 512 bytes sectors, then the start of the LUKS partition is at 32256/512 = 63. If you find it a good answer, please tick the check mark in the left margin to mark it as an accepted answer. thanks

– solsTiCe
Apr 6 at 9:51

Wow! Thanks for this elaborate answer + the py script. So I found the LUKS Header: Found LUKS header at offset 32256, then created partition with fdisk. p ĺooks like this:

/dev/sdh1            32256 1836339711 1836307456 875,6G 83 Linux|/dev/sdh2       1836339712 1953525163  117185452  55,9G  7 HPFS/NTFS/exFAT

but for some reason it didn't work. In gnome-disks looks like this: imgur.com/a/kK46Ggs Whats's wrong?

– mdthh
Apr 6 at 9:29

Wow! Thanks for this elaborate answer + the py script. So I found the LUKS Header: Found LUKS header at offset 32256, then created partition with fdisk. p ĺooks like this:

/dev/sdh1            32256 1836339711 1836307456 875,6G 83 Linux|/dev/sdh2       1836339712 1953525163  117185452  55,9G  7 HPFS/NTFS/exFAT

but for some reason it didn't work. In gnome-disks looks like this: imgur.com/a/kK46Ggs Whats's wrong?

– mdthh
Apr 6 at 9:29

the offset given by the python is in bytes but fdisk use sector (possibly of 512 bytes). So if your disk uses 512 bytes sectors, then the start of the LUKS partition is at 32256/512 = 63. If you find it a good answer, please tick the check mark in the left margin to mark it as an accepted answer. thanks

– solsTiCe
Apr 6 at 9:51

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Ask Ubuntu!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Cfxtrjtrk