Home / ubuntu / Questions / 581285
Accepted
warsong
Asked: 2015-02-04 08:48:28 +0800 CST

Can I recover an encrypted partition that I quick-formatted in Lubuntu?

  • 772

I had a USB drive encrypted with dmcrypt+LUKS which I forgot the password to.

I later formatted it but as soon as I formatted it I remembered the password.

Is there any way to recover/restore the partition or is it gone?

encryption

1 Answers

  1. Best Answer

    If you have:

    • A backup of the LUKS header (from luksHeaderBackup <device> --header-backup-file <file>)
    • The master key (from the option --dump-master-key the actual encryption key, no passphrase required)

    then it might be possible to recover some files, depending on how much was overwritten.

    • With a backup LUKS header, you could use --header <device or file storing the LUKS header> with open to open the container using the backup header and a passphrase.
    • With the master key, you could use --master-key-file with open to open the LUKS device without a passphrase.

    See man cryptsetup for more descriptions of the options & usage.

    Even if some areas were overwritten, it might be possible to repair/recover some files, either fixing the filesystem or doing an "undelete" type search, or a data carving tool to grab the remaining readable files. testdisk can go a long way towards those goals.

    • 0