How to find corrupted files on LUKS encrypted disks by searching for unencrypted content

1

I have a full disk encrypted Ubuntu 16.04 system running at home on a SSD which had uncorrectable media errors and so had to be replaced.

So I used ddrescue to copy all partitions to a new SSD, and then ddrescues fill-mode to fill all unreadable sectors on the original disk with the string "BAD SECTOR ". The idea of this mode is to permit searching for corrupted data later on when the file system is mounted again by searching for files that contain "BAD SECTOR BAD SECTOR BAD ..." etc.

In my case, I only had about 600kb of unreadable data on the original disk, spread over about 50 locations, so there should be some data corruption on the disk somewhere.

Unfortunately searching for "BAD SECTOR" does not seem to work with a mounted LUKS (which makes sense) since I modified the plain text of the encrypted data. But none of my files are unreadable (= undecryptable because of corrupted plaintext data) either, at least this command returns no errors:

find $HOME -type f | while read X ; do cat "$X" > /dev/null ; done

Also installing debsums (which verifies all files installed by packages against their original MD5sum) returns only two modified files, both of which do not look correupted. So my system still seems to be fine.

So where are my file system / data corruptions? Or better yet, how do I find out given I know the physical location of the bad sectors on disk?

Jens

Posted 2017-06-04T20:00:05.997

Reputation: 111

600k is tiny compared to a 4GB drive, if you're talking about a 1TB or bigger hard drive you may be trying to find a needle in a mountain of hay. Why not just check/verify your personal files are ok and re-install the OS? But searching for "disk sector in LUKS" may lead to your answer – Xen2050 – 2017-06-05T05:03:19.960

No answers