/wsr/ - Worksafe Requests » Thread #1546848

[8 / 1 / 1]

1KiB, 100x100, Testdisklogo_clear_100.png

Deleted LUKS partition recovery

Anonymous Wed 29 Oct 2025 22:19:34 No.1546848 View View Reply Original Report

In windows disk utility deleted my fucking LUKS ext4 Linux partition (on separate SSD),only the bootloader remains on its small separate partition. I ran testdisk (on a live cd) after 2 hours of searching it says theres a 1572GB LUKS 2 data size unknown Linux filesys. data on my 1024GB SSD. AI says I should not restore it since its the wrong size, doing so will just make it worse.

How fucked am I?

Anonymous

Anonymous Wed 29 Oct 2025 22:57:40 No.1546849 Report

Quoted By: >>1546850

>>1546848
Before attempting partition restoring you should always mirror the disk and only work on the copy.
Then you can attempt to restore it.
dd copies a disk bit by bit, no matter if formally deleted or not.

Anonymous

Anonymous Wed 29 Oct 2025 23:04:35 No.1546850 Report

Quoted By:

>>1546849
I'll probably do that i guess but any suggestions for the recovery?

Anonymous

Anonymous Wed 29 Oct 2025 23:35:33 No.1546853 Report

Quoted By: >>1546855 >>1546860

If only partition table was affected, you can just re-create the partition with exact same offset and size as the old and it should work. Partitions are just the entries in MBR/GPT tables, deleting/adding them does not affect the data itself.

Anonymous

Anonymous Thu 30 Oct 2025 00:02:49 No.1546855 Report

Quoted By: >>1546861

>>1546853
Not OP, but how can you get the right values? Trial and error might be too risky

Anonymous

Anonymous Thu 30 Oct 2025 00:09:26 No.1546860 Report

Quoted By:

>>1546853

Problem is the geometry info seems to be faulty, with the partition size being bigger than the whole drive...
Most important is the correct starting point (offset) and geometry, so everything is in the correct spot.
He needs those info and the weird info from TestDisk seems a little untrustworthy. That#s why he should at least mirror th boot sector and partition table to restore if needed in case it gets completely corrupted so that even TestDisk does not find anything anymore.

Anonymous

Anonymous Thu 30 Oct 2025 00:15:26 No.1546861 Report

Quoted By:

>>1546855
You should be freely able to experiment with offsets in read-only mode, try first creating the partition right after the previous one, they're usually tightly packed and use all remaining space for size. If luks can't find it's header or the data matching the detached header, it will complain right away, which incidentally you can also use to discover the proper offset in case it's in odd places.

Anonymous

Anonymous Thu 30 Oct 2025 00:20:58 No.1546863 Report

Quoted By:

Good news after looking around using the following I got my data showing in dolphin
sudo hexdump -C /dev/nvme0n1 | grep LUKS
sudo losetup -o xxxxxxxxx -r -f /dev/nvme0n1
sudo losetup -a
sudo cryptsetup luksOpen /dev/loop1 recovery
Bad news, right as I looked through a couple folders my live CD froze, I wanted to copy all the actual data off first before trying to restore the partition, so ill do this again after restarting the live cd and hope i can copy over everything before trying to figure out how to restore the partition

Capcode	All Only User Posts Only Verified Posts Only Moderator Posts Only Manager Posts Only Admin Posts Only Developer Posts Only Founder Posts
Show Posts	All Only With Images Only Without Images Only Spoiler Images Only Non-Spoiler Images
Deleted Posts	All Only Deleted Posts Only Non-Deleted Posts
Ghost Posts	All Only Ghost Posts Only Non-Ghost Posts
Post Type	All Only Sticky Threads Only Opening Posts Only Reply Posts
Results	All Grouped By Threads
Order	Latest Posts First Oldest Posts First

On these archives

Your latest searches

Deleted LUKS partition recovery