3

The 2TB disk that I use as an encrypted backup, is now reported by Ubuntu as being just free space. The encryption was setup as a LUKS encrypted device.

The output of sudo fdisk -l reports:

Disk /dev/sdc: 2000.4 GB, 2000398934016 bytes
255 heads, 63 sectors/track, 243201 cylinders, total 3907029168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x6b6edeba

Device Boot      Start         End      Blocks   Id  System

Note that there is no partition information reported (there was only one partition on the disk).

Trying to open the disk with sudo cryptsetup luksOpen /dev/sdc crypt1 returns the error:

Device /dev/sdc is not a valid LUKS device.

Now luckily I have backups of the backup, so I can live with the data being going this time, however I need to know: What caused it and/or how I can fix it, because otherwise I can't trust my backup to be there in the future and I will have to find a different solution.

Edit1: Per request a screenshot of the Disks Utility: enter image description here

This is on Ubuntu 14.04.3 LTS.

5
  • Can you also identify Ubuntu version? What does Gnome Disk Utility (aka 'disks') show for this device (eg. /dev/sdc)?
    – david6
    Sep 16, 2015 at 8:32
  • I have updated my question, but mostly it just says: "Free Space" and "Disk is OK"
    – Minos
    Sep 16, 2015 at 8:51
  • From: askubuntu.com/questions/643610/luks-partition-lost try testdisk /debug /log /dev/sdc
    – david6
    Sep 16, 2015 at 10:32
  • 2
    Can you upload the output from sudo head -c 4M /dev/sdc | xz > 4M.img.xz somewhere? This will dump and compress the first 4 MiB of the drive into a file named 4M.img.xz, which might have some clues about what happened. In the future, I suggest making sure that the drive is partitioned with MBR or GPT. It is possible and common to create a LUKS volume out of the raw drive (without any partitioning), and many tools cannot recognize LUKS volumes, leading them to conclude falsely that the drive can be overwritten without harm. I suspect that is what happened here.
    – Vincent Yu
    Sep 17, 2015 at 1:39
  • Thank you @david6 and vincent-yu for thinking with me. I won't be posting the first sector of my disk here, as this should contain the LUKS header and from a general security viewpoint it seems insecure to post it on the internet, as it would no longer be possible to wipe the disk by deleting the header. Unfortunately I am pretty certain that in this case the LUKS header is already deleted. See my answer below.
    – Minos
    Sep 18, 2015 at 8:13

1 Answer 1

2

Running sudo file -s /dev/sdc returns:

/dev/sdc: x86 boot sector

Making it very probable that the LUKS header, which was raw on disk, was overwritten by a bootloader. The default for Ubuntu without LVM seems to be to install a LUKS volume directly to the disk.

The system is actually dual-booting Windows 10 and Ubuntu (should have mentioned this, sorry!). To find out the culprit (hint: It's always Microsoft): we parse the strings in the first sector of the disk:

sudo dd bs=512 count=1 if=/dev/sdc 2>/dev/null | strings

Which shows for the backup disk with the lost LUKS header:

Invalid partition table
Error loading operating system
Missing operating system

The default boot drive has Grub 2 and for the same command returns:

GRUB 
Geom
Hard Disk
Read
 Error

The Windows 10 disk with the Windows 10 boatloader:

Invalid partition table
Error loading operating system
Missing operating system

Bingo! Now I know that I manually installed the Windows bootloader only to the Windows 10 disk, as I had accidentally overwritten it myself with a Grub bootloader and I know the LUKS volume was still there afterwards. However, I have run several automatic Windows 10 repair utilities, as my Windows 10 install keeps freezing/crashing. So it could be possible that one of them decided to appropriate the backup disk for an extra bootloader.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .