2

I know, I only have myself to blame, but yesterday I mistakenly deleted all my partitions of my main drive - a standard ubuntu xenial install using LUKS and LVM, but everything with default options using the whole 1 TByte drive. No EFI etc.

Here you can see fdisk -l from another laptop with the same installation (it has a smaller drive though!):

Device     Boot   Start       End   Sectors   Size Id Type
/dev/sda1  *       2048    999423    997376   487M 83 Linux
/dev/sda2       1001470 624949247 623947778 297.5G  5 Extended
/dev/sda5       1001472 624949247 623947776 297.5G 83 Linux

Gpart is running (10 hours plus now), I also let testdisk do a scan but was confused as to what to do in the end (it also found some old HP_Tools partition which was deleted a long time ago). Sorry I'm still a learner with Linux.

I see that I could be able to restore the two main partitions sda1 and sda2, but how do I have to proceed to get the LUKS container inside sda2 back and the LVM inside the LUKS, while not actually changing any data?

Am I correct that by just dropping the partitions, I did not loose yet any data?

Thanks for any help with detailed steps.

1

Few... I managed to solve it and to get all my partitions back. Here in a nutshell what I did:

First, I took an Ubuntu live USB drive and booted into the live system. Then:

  1. install gddrescue and use ddrescue to backup the whole drive bit by bit into a file on an external drive. This gives peace of mind when playing around: The original state can always be restored if necessary
  2. Use testdisk to do a quick search. It did not get the crypt partition right, but the boot one, so I restored that one with testdisk.
  3. Use "grep -a -b -P --only-matching 'LUKS\xba\xbe' /dev/sda" to search for the beginning of the LUKS crypt.
  4. Use "losetup -o result_from_grep -r -f /dev/sda" and "hexdump -C -n 128 /dev/loop0" to verify if this is really the beginning of the LUKS crypt including the header. It should look something like: |LUKS....aes.....|
  5. The grep returned the start in Bytes, calculate it in sectors
  6. Use parted to create an Extended partition starting two sectors before the LUKS crypt, till -1s (End of Disk, as in my case, the whole rest of the disk was used)
  7. Use parted to create a logical partition on the sector where the LUKS crypt starts until -3s (three sectors before the end - see my example fdisk -l in the question)
  8. Open the crypt and follow the steps as outlined in link 2 to restore SWAP, root etc.
  9. You can try to save your data at this point, but in my case I could just reboot and get the computer up and running normally again.

These three links helped me with the different steps, as well as man pages of the commands:

1) parted: how to create the partitions exactly at the right positions

2) Mount crypt and find all the logical volumes again

I hope this helps others with similar problems.

  • In step 4, that should have been: 'losetup -o 1048576 -r -f /dev/sdb' where the number is the byte offset provided by grep. See (ubuntuforums.org/showthread.php?t=1643334&page=2) for more details. – Fillinux Mar 21 '17 at 14:27
  • Thanks for sharing your result :-) BTW; You can edit your answer instead of adding corrections in a comment :-) – sudodus Mar 21 '17 at 14:29
  • Oops, true - but I was not allowed to share three links in one answers ;-) – Fillinux Mar 21 '17 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.