1

I have a hard disk which was previously used in my netbook with Ubuntu 13.10's default full disk encryption (FDE) configuration. I would now like to mount this disk as an external drive (via SATA to USB) to retrieve some files.

After I successfully:

sudo cryptsetup luksOpen /dev/sdc1 securedisk

I try to:

sudo mount /dev/mapper/securedisk /media/securedisk

And get the message:

mount: unknown filesystem type 'LVM2_member'

I don't understand how the LVM containers work! How am I supposed to mount the drive?

3
  • Tried reading through man lvm and the accompanying tools pages? Or web search for "how to mount lvm ubuntu"? (I don't know how either, but that's what I'd try, they usually work) --- Or maybe the encrypted drive is only one part of a larger LVM "set"?
    – Xen2050
    Feb 6, 2015 at 11:07
  • @Xen2050 Yes, but the fact that it is an encrypted LUKS container seems to be preventing the lvm2 toolkit from locating the drive, even after decrypted. An explanation of how the Ubuntu 13.10 bootstrapper would mount the drive would probably be sufficient for me to replicate the process. Feb 6, 2015 at 13:25
  • I had a look through the help file, it's not very helpful to me about trying to mount either... lvs or lvdisplay look potentially useful, maybe even pvscan but I'm not sure either. I thought that usually an encrypted device would just be decrypted and mounted like a regular partition, whether at boot or later, but this one seems different. Could try cryptsetup isLuks -v <device> to verify it is a LUKS device, but then luksOpen should fail if it weren't...
    – Xen2050
    Feb 6, 2015 at 14:02

2 Answers 2

1

I tried some experimenting with a 10MB file, using cryptsetup to "luksFormat" and "luksOpen" it (then used gparted on the /dev/mapper/xxxx device to create a MBR & partition & format it - I'm not sure if that's how a standard disk encryption works, or if it just formats the /dev/mapper/xxxx device & mounts it).

Then I can use dmsetup ls to see the "/dev/mapper/xxxx" file, and dmsetup is for "low level logical volume management". So you might want to try the sudo dmsetup ls command and see what it says, there might be a "partition" device like /dev/mapper/securediskp1 that you should try mounting...


Or, this very helpful archwiki page has info on using LVM on LUKS, mainly how to set it up though.


This very brief webpage indicates "Mount LVM partitions from an external hard drive" should be pretty easy, I think it should work after the device has been luksOpen-ed:

  1. As root (sudo), run

    vgscan
    vgchange -a y
    

    and all the partitions should have devices created in the form /dev/volumegroup/logicalvolume,

  2. which you can then mount in the usual way:

    mount /dev/volumegroup/logicalvolume /mnt/somewhere
    

This link "How to mount Linux LVM volume partitions on Linux" has some slightly different info:

  1. [root]# pvs

    This will list the volume groups to which our physical volume /dev/sda2 belonged. It would be of the form

    PV          VG          Fmt    Attr    PSize     PFree
    /dev/hda2   VolGroup01  lvm2   a-      148.94G   32.00M
    

    The second field, VG, shows the Volume group. The above output is just an example, showing that we are concerned with the Volume group "VolGroup01". The next step is to list the information about this volume group.

  2. [root]# lvdisplay /dev/VolGroup01

    It will throw a bunch of ouput, but the one we are concerned with is LV Name. It will look something like this

    LV Name /dev/VolGroup01/LogVol00
    

    In our case, there were two entries of type LV Name, the other being LogVol01, the swap. The whole output along with it will help you to identify the target logical volume you are looking for. Assuming that the above one is the partition that we need to mount, just use the usual method to mount it.

  3. [root]# mount /dev/VolGroup01/LogVol00 /mnt

    Now, you can to find the data you were looking for in the /mnt folder.


Other helpful looking questions:

2
  • Thanks for all your valuable information! It helped me identify the real issue, a naming clash of the Volume Groups names. See my self-answer for a detailed solution. Feb 20, 2015 at 12:47
  • You're welcome :) They do not make it easy to recover data from a fully encrypted disk, nowhere near as easy as an eCryptFS ecryptfs-recover-private & copy files... I'll give your answer a +1
    – Xen2050
    Feb 20, 2015 at 12:58
1

When trying to mount a remote Ubuntu FDE drive while your current Ubuntu installation is also using FDE, both LVMs will have the same Volume Group name ubuntu-vg. This makes the second drive with the same volume name inaccessible do to a naming clash.

This can be resolved by renaming the Volume Group name of the remote FDE drive:

  1. Boot to a live instance of Ubuntu (live CD), or another live linux forensic distribution.

  2. Once booted, decrypt the drive: sudo cryptsetup luksOpen /dev/sdb5 securedisk

  3. Look at the LVM groups: sudo vgs

  4. Rename the Volume Group: sudo vgrename ubuntu-vg ubuntu-13-10-vg

  5. Reboot to your standard installation.

  6. Once booted, decrypt the drive: sudo cryptsetup luksOpen /dev/sdb5 securedisk

  7. Active the Volume Group: sudo vgchange -a y

  8. Mount like normal sudo mount /dev/ubuntu-13-10-vg-root/ /media/securedisk

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .