I have a LUKS encrypted filesystem on a second internal hard drive that I use as a backup. It was working fine but now, after doing a complete reinstall of Ubuntu Gnome 17.04 (onto the primary hard drive, not onto the encrypted drive) when trying to decrypt the encrypted drive (e.g. using Gnome Disks) I'm getting this error:

Error unlocking encrypted device

Error unlocking /dev/sdb1: Command-line `cryptsetup luksOpen "/dev/sdb1" "luks-..."' exited with non-zero exit status 2: No key available with this pass-phrase

I am definitely typing the pass-phrase in correctly (I've used it successfully hundreds of times). Can anyone help me figure out how to decrypt and mount this?

One thing that I'm worried about is that the Ubuntu Gnome installer might have caused this. I did a complete reinstall of Ubuntu Gnome onto the primary drive, /dev/sda, it did correctly wipe and install onto sda not sdb, but when the installer finished I was left with an error message, something like: "Failed to install GRUB onto /dev/sdb". Huh?

It gave me an option to re-try the GRUB install onto a drive of my choice, but this kept failing even when selecting the correct drive (sda).

In the end I physically disconnected sdb and re-ran the Ubuntu Gnome installer to force it to try to install GRUB onto sda the first time and it worked, but now after re-connecting sdb and booting into the new Ubuntu Gnome instance on sda I can no longer decrypt the encrypted drive (sdb). I wonder if the Ubuntu Gnome installer's failed attempt to install GRUB onto the wrong drive destroyed the keys.

  • when you reinstalled ubuntu it erased the key ring. as far as I know there is no way to get into the encrypted disk without the keyring. your passphrase only unlocks the keyring where the encryption key is stored
    – ravery
    Jun 18, 2017 at 21:45
  • @ravery That's what I feared, but I wondered if perhaps the failed attempt to install GRUB onto the wrong drive hard perhaps deleted some header files or something, which rendered luksOpen unable to find the key, but perhaps the key is still on there and can be recovered somehow. Jun 19, 2017 at 9:52
  • you can try extundelete. it is available in the ubuntu repo. thou with such a large write the chances ot it not being overwritten is low.
    – ravery
    Jun 19, 2017 at 10:04
  • I'm actually not sure that something like extundelete applies here (I did try it briefly, it didn't seem to find anything). I believe the passphrase-encrypted key files for a LUKS encrypted partition are stored somewhere else on the drive, outside of the encrypted partition. It's those (tiny) key files that I worry may have been deleted by the failed GRUB install - so it's not a large write. (The large write - reinstalling the OS - was done to my primary drive, not my encrypted backup drive, it just then for some reason tried to install GRUB onto the backup drive.) Jun 22, 2017 at 9:40
  • the keys were deleted by the reinstall which deleted everything and made new keyrings. the keys aren't in the encrypted file, they are somewhere on the system or user files
    – ravery
    Jun 22, 2017 at 10:39

1 Answer 1


In answer to why you had the grub error. sda isn't the internal drive ... it is the first drive detected by the system, regardless if you boot from it.

usually this is the internal drive, but in some cases, such as rebooting with an external plugged in, the external will be recognized first and be assigned sda by linux regardless of whether you boot from it.

Now as far as the encrypted drive goes, the passphrase is not the key. the passpphrase unlocks the gpg keyring where the key is stored. this keyring was deleted when you reinstalled ubuntu. I'm not sure exactly where this keyring is stored, but pretty certain it is somewhere in the root directory not your home folder or the encrypted drive.storing the keyring on the encrypted drive would be a security risk and defeat the purpose of the keyring, because then anyone that knew your passphrase could decrypt the drive on any machine

running a file recovery program might recover the keyring if it wasn't overwritten by the reinstall.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .