0

I am trying to recover files from an encrypted disk on ubuntu. I used rm -rf in the wrong dir. And killed the commnad a few seconds when realising my mistake.

These are the steps I did so far:

$ cryptsetup luksOpen /dev/sdb 4TB_crypt
$ mount -o ro /dev/mapper/4TB_crypt /media/user/4TB_crypt/
$ lsblk
...
sdb                     8:16   0   3,7T  0 disk  
└─4TB_crypt           253:3    0   3,7T  0 crypt
sdc                     8:32   0   1,8T  0 disk  
└─sdc1                  8:33   0   1,8T  0 part  /media/user/restore

When I want to run the restore command I get the following error:

$ sudo extundelete --restore-directory /media/user/4TB_crypt/private_files/ /dev/mapper/4TB_crypt
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... extundelete: Extended attribute has an invalid value length when trying to examine filesystem

Further when I use (after umounting /dev/mapper/4TB_crypt):

$ fsck -r /dev/mapper/4TB_crypt
fsck from util-linux 2.34
e2fsck 1.45.5 (07-Jan-2020)
4TB_crypt contains a file system with errors, check forced.
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Entry 'somefile.mp3' in /shared_files/medien/audio/audio_books/???/some_dir (221118752) has deleted/unused inode 221118834.  Clear<y>?

Which I killed because I was unsure if I do something irreversible.

Some tips and ideas are greatly appreciated.

Kind regards John

EDIT

The disk is LUKS encrypted and ext4 formated.

1 Answer 1

0

If this is an extX filesystem, you could try using photorec and testdisk to see if you are able to get any farther!

You should be able to find both in whichever package store you are using and they both provide a CLI.

6
  • 1
    Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Jan 30, 2022 at 19:45
  • Recovering deleted data from an encrypted volume with data recovery tools is realistically impossible. Data recovery tools work, by finding fragments of files, and attempting to reconstruct them. The command that was issued makes that reconstruction impossible due to the fact every single file on the volume is encrypted.
    – Ramhound
    Jan 30, 2022 at 20:54
  • If it is still able to be decrypted, it makes sense to my non-filesystem-oriented brain to think that some of the files could still be intact. I dunno. Its worth a try?
    – wanwandrew
    Jan 30, 2022 at 20:57
  • Thank you for your answer. I would first try to use extundelete as it will keep my filenames and dir structure intact. If this attempt realy fails I will try photorec and such and I am only really intersted in one folder.
    – john
    Jan 31, 2022 at 8:48
  • @Ramhound I should be no problem as I can decrypt the disk.
    – john
    Jan 31, 2022 at 8:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .