Recovering a LUKS encrypted partition from dump

1

I did a Linux Mint 15 install on my notebook a couple of weeks ago, and chose to encrypt the whole disk. Yesterday I could no longer decrypt it (that is, it insisted that either the passphrase or options were wrong at boot time). Really needing the notebook to work ASAP, I booted from CD, made a dump of the partition (dd if=/dev/sda5 ..) to another computer and reinstalled from scratch.

I'm fairly certain I know the passphrase, and there's a week's worth of my work in there, so I'd like to try and attempt recovery. However, I have no idea how to proceed. Googling was not very useful, likely because I don't know enough about any of LUKS, cryptsetup or Mint to even make good queries. All I could find is stuff explaining I should give up..

So, given a "passphrase" and a really large file sda5.bin, what commands should I try? Or, alternatively, where can I find information on how Linux Mint does it? I'm also wondering where I could find some sort of a changelog/list of updates of Linux Mint, to see if any recent updates were related..

xs0

Posted 2013-11-27T15:21:57.600

Reputation: 111

Answers

1

Oh, wow, it's been a while. If memory serves, it goes roughly like this:

losetup /dev/loop0 /path/to/sda5.bin
cryptsetup luksOpen /dev/loop0 foo
mount /dev/mapper/foo /mnt 

If the cryptsetup stage fails, it's likely because your passphrase really is wrong, or because the corresponding key slot has been accidentally deleted. In either case, you're hosed.

MadHatter

Posted 2013-11-27T15:21:57.600

Reputation: 381