Recover files from LUKS-encrypted partition

luks

I have a partition encrypted with LUKS. I used it without problems every day until suddenly the password stopped working. Is there anything I can do?

I have tried with a different keyboard and from a different computer. I am 100% certain that I typed in the correct password. So (correct me if I am wrong) it seems to me that my hard disk must be corrupted. If this is the case, is it reasonable to assume that only one byte is corrupted, and if yes, can I try all possible one byte changes of the partition header?

EDIT: I should have mentioned that the encrypted partition contains /, so it was always in use. I don't know if LUKS does any write protection though.

Best Answer

You should restore from your backup. If you have no backup then you are screwed. That is the entire point of full-disk-encryption. There are methods to restore a corrupt luks header, but you would have had to make a backup of the header first.

See: cryptsetup FAQ - Backup and Data Recovery

The idea that you could somehow try all the possible changes if one byte was off is extremely silly, unless you know exactly which byte was broken.

Lets pretend for a second that your the header was only 1megabyte (it is bigger, I believe it is ~2MB). Then the number of possible changes is 2**(8,388,608) (or 4.2644×10^2,525,222) even if you could try a billion different possible changes per second you would still be attempting changes well past the time when our sun destroys our planet.

Related Topic