2

Using gnome-disk-utility, I accidentally removed a LUKS partition on an external hard disk. This hard disk now looks like this:

enter image description here

I just pressed the minus-sign, thus I guess I just removed the partition but not the data.

Following this documentation on help.ubuntu.com I used testdisk which only found the following:

http://www.cgsecurity.org
Disk /dev/sdg - 1000 GB / 931 GiB - CHS 121601 255 63
Partition               Start        End    Size in sectors
>* Linux                    0   1  1     0 254 63      16002
L HPFS - NTFS          114306 219 26 121601  80 59  117185452

Now I wonder, if this askubuntu answer could help me recovering my partition. But I have no idea what to enter precisely enter into sfdik

Any help is greatly appreciated as I am kind off desperate since I really need my data back...

Thanks!

Improve this question

1 Answer 1

Reset to default
1

If the data is still there, you can look for the LUKS header.

Fire up some hexadecimal editor (in read-only mode !). You better be sure how to use this editor so that not to make any modification.

My recommendation is to use xxd on the command line, like 

sudo xxd /dev/sdg|less

and look for LUKS string: in less type '/' then 'LUKS' then 'Enter'

then if you find it, note down (on paper ?), the position of the L in LUKS. Note that the offset is in hexa. Convert it to decimal.

If you have reach this point you have the start of your LUKS partition, now you need to find the end. You could use the start of sdg2 minus 1.

Then go and use fdisk or sfidsk to recreate the partition only. Don't use parted or gparted that will reformat it!

And you should be good.

Edit: I made a python3 script to look that for you, if you are not familiar with cli.

Either run

sudo python3 search-for-luks-headers.py -l 16 /dev/sdg

or make a copy of the first MB of /dev/sdg and use the script as a user on the copy.

Note: with either method, you will find the offset of the LUKS partition in bytes. You must translate that in sectors to use it with [s]fdisk. Your disk most probably uses 512 bytes sector (please check this)

Improve this answer
2
  • Wow! Thanks for this elaborate answer + the py script. So I found the LUKS Header: Found LUKS header at offset 32256, then created partition with fdisk. p ĺooks like this: /dev/sdh1 32256 1836339711 1836307456 875,6G 83 Linux|/dev/sdh2 1836339712 1953525163 117185452 55,9G 7 HPFS/NTFS/exFAT but for some reason it didn't work. In gnome-disks looks like this: imgur.com/a/kK46Ggs Whats's wrong?
    – mdthh
    Apr 6, 2019 at 9:29
  • the offset given by the python is in bytes but fdisk use sector (possibly of 512 bytes). So if your disk uses 512 bytes sectors, then the start of the LUKS partition is at 32256/512 = 63. If you find it a good answer, please tick the check mark in the left margin to mark it as an accepted answer. thanks
    – solsTiCe
    Apr 6, 2019 at 9:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .