Recovering a LUKS Ext4 Partition that was over written

Question

I have a external HDD that was formatted as one 2TB Ext4 partition and LUKS encrypted.

It was turned into an ubuntu install disk using start disk creator.

Is there anyway that this can be recovered?

Answer 1

Sorry, but I'm afraid you pretty surely have absolutely no chance to recover even a single bit of your whole partition, unless you have a backup of the encrypted partition's LUKS header.

Why? By creating an Ubuntu install disk on the device, you overwrote the first about 1.4 GB of it. However, the first 2 MB is where the LUKS header and key slots are located. Let's look at what these are:

The LUKS header is about 4 kB in size and contains some important info about the encrypted volume like an UUID, the used encryption and hashing algorithms, etc. After that, there's a section of 8 key slots, each used one of them containing a master key for the data blocks, encrypted with your passphrase.

To decrypt a data block, you need to enter your passphrase to decrypt the corresponding key slot containing the master key, which then again is used to decrypt the actual data.

Now the fastest way to destroy a LUKS encrypted volume is actually to nuke its header and key slots. You may still know your user passphrase, but the master key that encrypts your data is gone irrecoverably.

So no master keys, no chance to recover any data, even although over 99% of your 2 TB partition are untouched. Those crucial 2 MB at the beginning of the volume would be needed to make any sense of the data - and it's gone.

However, if you have a recent backup of at least your LUKS header and key slots (recent means after you modified the encryption configuration last time, e.g. by changing a passphrase), you might try to restore that header backup and use it to decrypt the data parts on your disk that did not get overwritten yet.

Further reads about LUKS header structure:

• https://security.stackexchange.com/questions/109223/what-does-luks-header-contain
• https://gitlab.com/cryptsetup/cryptsetup/wikis/LUKS-standard/on-disk-format.pdf