Ubuntu Security :: Recovering Data From Corrupt Encrypted Partition
Feb 25, 2010
I have recently recovered from an HDD failure on my Drobo. One of the disks died and corrupted the entire array (which is not supposed to happen). I have since managed to copy the data off onto smaller disks and after replacing the failed drive, have copied everything back.
Now that im up and running again, i was wondering how this situation would play out on encrypted disks, or in the case of a drobo a large encrypted partition (as you cannot encrypt the entire array).
Would i still be able to recover the data if i were to encrypt it? It is a 4.2TB array, and i assume that I would need to copy the data in its entirety to recover it, so using multiple smaller disks would be out of the question right?
View 5 Replies
ADVERTISEMENT
Jul 20, 2011
I recently suffered a hard disk failure, meaning I had to replace the faulty device. After attempting to mount the old faulty hard drive using and external caddy, I got the following message... Unable to mount 144 GB Filesystem Error mounting: mount: wrong fs type, bad option, bad superblock on /dev/sdb5, missing codepage or helper program, or other error In some cases useful info is found in syslog - try dmesg | tail or so
I'd like to attempt to recover what I can from my /home directory but unfortunately I use encryption (although I do actually know my pass phrase). What procedures and software can I use to try and recover data from this drive?
View 5 Replies
View Related
Mar 4, 2010
I have a Hard Drive that has a corrupted file system and i have tried the usual MS Windows fixes, chkdsk and a number of recovery tools inc Dos recovery tools and failed.
The Drive is an MS Windows drive with an NTFS file system.
chkdsk scans and after several hours fixing numerous problems eventually gives up and fails to complete.
The directory "My Documents" contains several GB of data and displays that this is true. When trying to access the directory, access is denied because its corrupt. Using Windows and Dos recovery tools i can view the contents of the directory sometimes! but cannot copy out any of the data, the applications return messages saying no can do basically.
I would like to try to use Linux to recover the data.
Problem number one is i have never tried to add a hard drive to an existing Linux system before, how do i go about adding a new drive?
The 2nd problem is, is there a Linux application that i can use to attempt to repair and recover the corrupt data on this drive or more specifically in the "My Documents" directory.
View 7 Replies
View Related
Dec 1, 2010
Recently I was forced to hard reset my computer a couple of times (mostly out of frustration) and due to my idiocy i was confronted with the standard Kernel Panic message at bootup. I tried running an fsck from live cd which corrected a bunch of errors but to no avail (as far as getting rid of the Kernel Panic msg). I then tried to mount the filesystem by accessing it from live cd (and later even installed ubuntu on a small leftover partition to get rid of the annoying live cd lag) but it says that I don't have access to my home or root folder. Mounting from command line gave the same issue.
So now to the question. Is there a general procedure to access data in my corrupt filesystem if it is encrypted?
View 7 Replies
View Related
Apr 6, 2011
I was trying to fix some hardware on my laptop and i ended up mucking the whole thing up. The HDD seems to fine though. I have it in a external HDD enclosure and it's plugged into my mothers desktop through usb.I'm trying to print some files I have, but my home directory on the external HDD is encrypted.
View 3 Replies
View Related
Mar 4, 2010
I have installed fedora 11 in my system. While installing it asked me encrypted password which i passed. But I forgot that. Now the problem is whenever i boot my system before going to root itself it is asking for volume encrypted password, which as i told you i have forgot. Now i am not able to access my hard disk since it is completely locked. Is there any way to decrypt the password or unlock it. Or if that is not possible can data be recovered,which is my primary requirement..
View 6 Replies
View Related
Mar 4, 2010
I have installed fedora 11 in my system. While installing it asked me encrypted password which i passed. But I forgot that. Now the problem is whenever i boot my system before going to root itself it is asking for volume encrypted password, which as i told you i have forgot. Now i am not able to access my hard disk since it is completely locked. Is there any way to decrypt the password or unlock it. Or if that is not possible can data be recovered,which is my primary requirement..
View 1 Replies
View Related
Apr 8, 2010
I have been using fedora 12 for last 6 months, recently I bought an external USB hard drive of 320 GB capacity. I made 2 partitions using the Disk Utility in Fedora. I encrypted the first partition as it was supposed to hold a lot of sensitive data, and yes it did have. Now I had to change my OS to AV linux for some audio-video editing work which wasnt being done properly on fedora due to some issue beyond my knowledge. now the problem is my encrypted partition is not accessible in my new installation. I see an empty space on my /dev/sda1. although no change to partition data has been done and the data on the second partition /dev/sda2 is easily accessible. when putting the drive on automount, is does not ask me for the password and neither does it show me the data. I have tried fdisk and sme other utilities but have failed to get my drive unencrypted.
View 7 Replies
View Related
Jul 19, 2010
Let's begin from the top. I have a relatively new laptop that I've been running Ubuntu on (along with a little-used Windows boot). Picked it up in November or so, installed the current "latest" version of Ubuntu at the time (9.10). I have been doing incremental upgrades, and it's been progressively breaking down more and more. Yes, this includes 10.04.
After GRUB stopped working, I decided it was time to try a reinstall from the top. I told it to leave all the other operating systems alone and do a full reinstall.
Fortunately, I had managed to stuff most of my current work in duplicate locations during this whole debacle, somehow. Don't ask me how I managed to do that when GRUB wasn't working. However, when I installed, I conscientiously said "Oh, yes, Ubuntu, encrypt my home folder! I love privacy!" As a result, about... 30 gigabytes of useful (but ultimately re-downloadable) material is rather inaccessible at the moment. When I try to boot the old system using the newly fixed GRUB, it goes into kernel panic. This seems like a no-go.
I have a saved hojillion-character long passphrase for decryption from my install back in November. Conscientiously saved in the case of just such an emergency.
I read this how-to and followed it to the letter as far as I could tell, trying to mount with ecrytfs to recover my data.
[USERNAME] here is a proxy for my actual username. Yes, the location of my old home folder may seem a little bizarre.
Code:
sudo mount -t ecryptfs /media/c82ca9fe-2b15-4aca-a98d-6482b1d80a32/home/[USERNAME]/ /home/[USERNAME]/oldhome
Passphrase:
Select cipher:
1) aes: blocksize = 16; min keysize = 16; max keysize = 32 (not loaded)
[Code].....
View 9 Replies
View Related
Dec 19, 2010
I just installed kubuntu 10.10, replacing an older installation. I have three hard drives one of which had all of the data I wanted to save, about 500gb. I repartitioned and formatted the other two drives and made sure that the data drive would be mounted but not formatted. When I booted into my new installation, the data drive was blank. I'm not sure if it's relevant, but I had just upgraded the file system from ext2 to ext4 before starting the installation.
I've been trying to recover my lost partition with testdisk. The website has instructions for recovering a formatted partition. It looks like it's working until the instructions tell me to choose Boot and RebuildBS, which I don't see as options. Can anyone give me any advice on how to recover? How did this even happen? Has anyone had a similar issue with installation?
View 1 Replies
View Related
May 16, 2010
I was trying to delete a logical drive in windows xp and the damn disk management tool in windows not only deleted my other windows partition but also my linux /data ext3 partition. Now I have a unallocated space in place of these partitions. The data is still there but the entries in the partition table have been removed. So how do I recover my partition. I was trying to use the following tutorial. [URK]
I used the sudo parted /dev/sda -- and then rescue START END command and could get back the /data partition. But it gives me the following error while mounting the partition. mount: wrong fs type, bad option, bad superblock on /dev/sda7, missing codepage or helper program or other error. In some cases useful info is found in syslog - try dmesg | tail or so.
What does this mean. How to I fix this? Also when I try to recover my windows partition using parted it scans for a while and then does nothing. It doesnot ask for writing the lost partition in the partition table. What do I do?
View 3 Replies
View Related
Jan 18, 2010
I have an external USB hard drive that I need to recover some data from, but I see from fdisk -l that the partition uses LVM:
Code:
[root@localhost ~]# fdisk -l /dev/sdd
Disk /dev/sdd: 160.0 GB, 160041885696 bytes
255 heads, 63 sectors/track, 19457 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
[code]....
I've followed various lvm tutorials all of which describe setting up lvm from fresh on empty disks. Unfortunately non mention how to 'install' new a drive that was previously set up with lvm. I have had a go anyway and may have now lost my data. Here's what I've ended up with (the partition in question is sdd1):
Code:
[root@localhost ~]# pvdisplay
--- Physical volume ---
PV Name /dev/sdd1
VG Name vg02
[code]....
I've tried mounting with other fstypes, but all give the same error.
View 7 Replies
View Related
Feb 21, 2011
following problem. A friend phoned me in despair. Her Ubuntu didn't start any more - ASUS-Laptop switched on stops at a ramfs-prompt.
I started Puppy-Linux from DVD-Drive. Worked fine. But puppy can't mount her /dev/sda1 partition either. At least you can see that the partition is still there. Fsck stops with an error. May be the initial problem is a sort of bad hardware by which bad bytes were written to the hard drive. Hard drive and/or memory could be replaced but not the data.
View 7 Replies
View Related
Jun 3, 2010
After a disastrous upgrade to 10.04 I am at my wits end trying to recover my /home partition from my unbootable system. The /home partition is part of a RAID5 array across 4 disks and I've been trying to use some disk imaging tools from Ultimate Boot CD to recover it with, but none of the utilities seem to recognize or will let me work with my multi-disk device.
Currently I've been booting up with a Live CD in attempts to mount the encrypted partition then copy all the files to an external device I bought, but the mounting process has presented me with some problems. The partition in encrypted with ecryptfs and I have both the disk's passphrase as well as an FNEK signature to work with. Attempting the following:
Code:
Another small issue is the cipher I used. I don't remember which kind of encryption the disk is encrypted with (80% sure it's aes though). I assume figuring out which cipher I used will be more like a guessing game through the ecryptfs mount prompt, but I'm wondering if this would affect the error message I get.
View 9 Replies
View Related
Jan 10, 2010
I have an external 3.5" USB 250Gb HDD which is showing symptoms of hardware problems (repeated /var/log/messages errors of "reset high speed USB device using ehci_hcd"). This was originally plugged in to my NSLU2 running Debian Etch. I have just installed Ubuntu Desktop 9.10 to a spare Pentium-3M laptop and was hoping to copy the contents of this HDD to a fresh drive. However, I cannot mount it even read-only; mount -o ro /dev/sde3 /mnt/disk fails, and the /var/log/messages error is "recovery required on readonly filesystem", "write access unavailable, cannot proceed". I cannot understand why mounting a disk read-only should require write access. Following advice I googled elsewhere, I tried running mke2fs -n /dev/sde3 to try to list the alternative superblocks - but once again I got the error that the device was read-only. How can I go about accessing the data on this disk?
View 11 Replies
View Related
Jun 13, 2011
I've just tried to open an .odt file which says it's corrupt and cannot be recovered... The last backup I can find is from about a month ago and is 10,000 words shorter than the corrupt version.I have no idea why the file has suddenly become corrupt
View 3 Replies
View Related
Jul 17, 2010
Around six months ago (last time I reinstalled Ubuntu 9.10), on a whim I decided to check that option to "encrypt [my] home directory". I wanted to see what it was like. Mistake. Since then, I've been unable to figure out how to access the data in my home directory using any method besides booting the computer (usb drive, rip-out-and-stick-it-in-an-enclosure, etc.). Specifically, I find that shell script sitting there that tells you to run it in order to see your files, but it gives some kind of error. I also still have the code Ubuntu tells you to write down in order to decrypt your files.
Fast forward to this past week. I brought in the laptop to Best Buy for repairs to the hinge (the hinge! Ace Hardware could fix this problem! But I wanted to make full use of the service plan.), and I got a phone call a few days later, saying that it hit Best Buy's "No Lemon" policy. They were going to keep my computer and give me in-store credit toward a new one. Of course, I refused to pay ~$70 for them to back up my data for me; what could possibly happen to it when they were fixing a hardware problem?
Anyways, I pleaded with them for my hard drive back, and they said that they could ship the hard drive back to the store so I could get my data off of it. I'm planning on going in there with my external backup hard drive and an external enclosure and doing it myself at the counter (If they charge $70 to back up a Windows partition, how much more will they charge for an encrypted Linux one?). I don't want to embarrass myself by standing around and not being able to get into my own data.
View 7 Replies
View Related
May 17, 2010
If I wanted to transfer a home folder that was encrypted to another ubuntu computer could I? If I had a separate home partition that was encrypted, but I wanted to upgrade ubuntu to the latest version by doing a clean install is there an easy way so that I can still read the data encrypted with the old version?
View 5 Replies
View Related
Jul 20, 2011
I am running ubuntu 11.04 I'd like to encrypt my home folder. - how can it be done, without creating new user/starting from scratch. -I'd like to keep all the files and desktop settings - the only change should be that the folder is encrypted now.
View 2 Replies
View Related
Oct 11, 2010
I am facing a serious problem.I installed UBUNTU 10.04 and encrypted it during installation. I accidentally erased some of the necessary files from root folder. now the the OS is NOT booting.luckily i still have the encryption key i have some important documents in that drive (desktop folder).
PS: I have tried to run Live Ubuntu it shows the Root, but it does not enter any of the folder.
View 14 Replies
View Related
Apr 26, 2010
While setting up my laptop on a new hard drive (a bad mobo caused writes which pretty much rendered teh old hdd unusable) I was asked if I wanted to encrypt my home partition.
I've been wanting this for several years - even going as far as trying to get a copy of CheckPoint. That's waht my organization uses on all Wintendo laptops and is required.
In any case, I said "yes" and am happily using my laptop with an encrypted home partition. I'm assuming based on this - [URL] - that it is using EncryptFS as the scheme.
if I were to misplace my laptop, how easy would it be for a forensics team to retrieve my data. Let's assume I have a fairly strong passphrase, such as BisZumBitterenEnd3. [URL]
View 5 Replies
View Related
May 3, 2010
I had some major problems after the recent Ubuntu upgrade and had to boot from a live cd. I have a separate /home partition, but it was encrypted using the default install encryption in the 9.10 install cd. How can I get to my files so I can back them up?
I have tried this but it did not work: http://ubuntuforums.org/showthread.php?t=1337693
View 9 Replies
View Related
Apr 8, 2011
I have to operating systems installed, Ubuntu 10.10 and Windows 7, working perfectly. I also have a partition, currently empty, to be shared between both OS, but I would like that partition to be encrypted.
View 2 Replies
View Related
Feb 22, 2010
I'm trying to have a LUKS encrypted partition mounted at startup and to have GDM ask for my key so it will decrypt. Now I followed [URL] to the letter. Except for now, I have it just mounted into /mnt/cryptohome so I'm not messing with my system. My problem is the one everyone mentions in the comments, ubuntu isn't asking for the LUKS key in the X display, it's asking in the first terminal (Ctrl-Alt-F1). This will not do. I need it to ask to mount my drive before I'm even asked to login, so eventually I can encrypt my /home.
View 9 Replies
View Related
Apr 11, 2010
What are the steps I must take to move my existing home folder to a separate, encrypted partition? Can I create this partition without damaging my current partition? Where is a trusted location to download App Armor profiles? What else can I do to harden the security of Ubuntu?
View 1 Replies
View Related
Sep 20, 2010
Hello everI'm really confused by the ways an encrypted partition get mounted.It just mounts the partition without asking for the passphrase used to create it. I can list the files in /mnt/sda2, create a new file test.txt, but have no access to the files written to the "real encrypted partition".Then I can see/change the content of the encrypted partition but without being able to see/change the file test.txt created previously with the normal mount command.
The reason I'm asking is that I'm having my custom Debian to automount every partition available on the system at boot time. Is there any way/command to tell if a particular partition is encrypted (by cryptsetup) or not? So that I can mount it the right way and not make the users confused (or even harm the encrypted data).
View 6 Replies
View Related
Jun 3, 2010
Ubuntu 9.10 64bit. Acer Laptop
Using ubuntu 9.10 cd to access laptops hard drive.
foun readme file in /media/disk/mark
opened with openoffice. THIS DIRECTORY HAS BEEN UNMOUNTED TO PROTECT YOUR DATA.
From the graphical desktop, click on: "Access Your Private Data"
or
From the command line, run: $ ecryptfs-mount-private
So I tried a couple of ways...
View 9 Replies
View Related
May 20, 2010
Anyone had any experience with unlocking a LUKS encrypted root partition via ssh? It is ok to leave /boot unencrypted.
There are a few pages from google with the debians variants, archived by putting dropbear into initrd.
I like to do that with my fedora/centos remote servers, but struggle to find any resources specific to it. Anyone has any suggestions and thoughts as to what might be a suitable way forward?
View 2 Replies
View Related
Apr 25, 2010
I purchased a larger hard drive to upgrade my HTPC running MythTV and a Samba file server. I put the old hard drive into an e-SATA enclosure and can still boot to it to access my files, but I can't seem to mount it correctly under the new installation to copy over my files even though I have the mount passphrase and encrypted filenames key.I have tried using this howto, but I run into problems with the encrypted filenames.This is how I'm doing it. I replaced the actual key data with A's and B's to protect my keys:
Code:
$ sudo -i
# ecryptfs-add-passphrase --fnek
[code].....
View 2 Replies
View Related
Jan 21, 2009
I need a FREE solution that can image an entire Luks system encrypted volume and the rest of the used HDD, the MBR and /boot partition. Note: MBR and /boot are not encrypted. Note 2: I want to be able to restore entire drive from image with only a couple of steps. Note 3: Destination HDD space is a factor. Image file must be compressed and the image file must be around 40 to 50 GB or less. The smaller the image the better.
I have used clonezilla live cd before but not for encrypted volumes. I know you can install it in Linux. But, I don't know how to configure it after installation. I would be very happy if someone could tell me how to configure clonezilla in Fedora. How to guides are also welcome. I have one more question. If I image the encrypted volumes and all the stuff I mentioned above while logged in to Fedora, and I restore the drive from the image, will the recovered drive still be encrypted?
View 8 Replies
View Related
