如何挽救被 Windows 工具部分修改的加密 LUKS 分区?

如何挽救被 Windows 工具部分修改的加密 LUKS 分区?

在具有双启动的系统上,Windows 工具戴尔支持助手现在我开始修改分区,但最终我的 Linux 安装却损坏了。

Linux 安装是/曾经是Ubuntu使用加密的 LUKS 分区,在应用一周前的备份之前,我认为可能会有挽救一些数据的变化。

实时分发仍然发现了分区和testdisk声称能够确定其边界。

似乎仍有一些数据可访问:

$ cryptsetup luksDump
LUKS header information
Version:        2
Epoch:          3
Metadata area:  16384 [bytes]
Keyslots area:  16744448 [bytes]
UUID:           3ebdbc55-c283-4b33-89f6-b254057db9d0
Label:          (no label)
Subsystem:      (no subsystem)
Flags:          (no flags)

Data segments:
  0: crypt
    offset: 16777216 [bytes]
    length: (whole device)
    cipher: aes-xts-plain64
    sector: 512 [bytes]

Keyslots:
  0: luks2
    Key:        512 bits
    Priority:   normal
    Cipher:     aes-xts-plain64
    Cipher key: 512 bits
    PBKDF:      argon2i
    Time cost:  7
    Memory:     1048576
    Threads:    4
    Salt:       a5 ff f5 ae 21 38 4f 44 4b af 26 fb bd b5 15 7f 
                41 dd 86 4a c1 41 7f 2c 35 f7 52 0b b8 ff 3b a4 
    AF stripes: 4000
    AF hash:    sha512
    Area offset:32768 [bytes]
    Area length:258048 [bytes]
    Digest ID:  0
Tokens:
Digests:
  0: pbkdf2
    Hash:       sha512
    Iterations: 187513
    Salt:       0d 92 31 9c ae 3c a7 d1 aa 04 5f 37 e5 ff 6f 4e 
                a7 4f 37 3f a5 0c 2c a4 db 31 69 06 52 91 79 16 
    Digest:     13 3c 62 0f 06 17 be 9b e5 da 86 05 d5 fb 39 ad 
                d8 e2 2f a5 fd 8f 14 55 50 c5 c1 73 e9 e6 84 76 
                86 e2 c3 f1 c2 ef 72 c4 bf f5 42 0a 8f 43 5a 0e 
                cd a9 2b c4 70 de 0d b8 d5 06 40 2b a6 4e 10 64 

但是当我尝试挂载它时收到一条错误消息(WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?):

$ sudo cryptsetup luksOpen /dev/nvme0n1p4 crypt
Enter passphrase for /dev/nvme0n1p4:
$ sudo vgchange -ay 
  WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?
  WARNING: One or more devices used as PVs in VG vgubuntu have changed sizes.
  device-mapper: reload ioctl on  (252:2) failed: Invalid argument
  1 logical volume(s) in volume group "vgubuntu" now active

所有命令都会弹出此错误:

$ sudo vgdisplay
  WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?
  WARNING: One or more devices used as PVs in VG vgubuntu have changed sizes.
  --- Volume group ---
  VG Name               vgubuntu
  System ID             
  Format                lvm2
  Metadata Areas        1
  Metadata Sequence No  3
  VG Access             read/write
  VG Status             resizable
  MAX LV                0
  Cur LV                2
  Open LV               0
  Max PV                0
  Cur PV                1
  Act PV                1
  VG Size               <1.67 TiB
  PE Size               4.00 MiB
  Total PE              437736
  Alloc PE / Size       437736 / <1.67 TiB
  Free  PE / Size       0 / 0   
  VG UUID               5v0f8R-w1Qg-SBI2-Ozzb-0f1z-aCML-yyDsxq

$ sudo vgchange -ay --activationmode partial
  PARTIAL MODE. Incomplete logical volumes will be processed.
  WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?
  WARNING: One or more devices used as PVs in VG vgubuntu have changed sizes.
  device-mapper: reload ioctl on  (252:2) failed: Invalid argument
  1 logical volume(s) in volume group "vgubuntu" now active

$ sudo lvscan
  WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?
  WARNING: One or more devices used as PVs in VG vgubuntu have changed sizes.
  ACTIVE            '/dev/vgubuntu/swap' [<41.04 GiB] inherit
  inactive          '/dev/vgubuntu/root' [<1.63 TiB] inherit

我认为重新设置边界可能会有帮助,但事实并非如此:

$ sudo lvreduce -L -1M /dev/vgubuntu/root
  WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?
  WARNING: One or more devices used as PVs in VG vgubuntu have changed sizes.
  Rounding size to boundary between physical extents: 0   .
  New size (427230 extents) matches existing size (427230 extents).

所以从我的角度来看这可能不是一个好主意。

其结构如下testdisk

磁盘 /dev/nvme0n1 - 2048 GB / 1907 GiB - CHS 1953514 64 32 分区开始结束扇区大小 >P MS 数据 2048 1085439 1083392 [恢复] P EFI 系统 1085440 1290239 204800 [EFI 系统分区] [无名称] D MS 数据 403359745 405266432 1906688 D MS 数据 405266432 407173119 1906688 D MS 数据 405676033 407175168 1499136 D MS 数据 407175168 408674303 1499136 P Linux 文件系统。数据 408674304 412581887 3907584 P Linux 文件系统。数据 412581888 2397717532 1985135645

其密集扫描如下所示:

testdisk 密集扫描结果

DMDE 中的结构如下:

DMDE 分区概述

DMDE 的屏幕截图

关于如何继续尝试挽救数据,有什么建议吗?

答案1

保持冷静,不要进一步对测试盘应用更改。

  1. 获取 USB 硬盘(重要的)
  2. 使用以下方法将整个磁盘克隆到 USB HDD:命令
  3. 然后,尝试挽救下面标记的分区在 USB 硬盘中

最后检测到的丢失分区

如果幸运的话,你可以挂载并从 USB HDD 中取出数据。否则,请重复步骤 2,但要逐个尝试标记分区,并希望获得最佳结果。

编辑:我之所以要求你在内部驱动器之外执行此操作,是因为一旦你用 testdisk 弄乱了驱动器,最先检测到的分区很可能会损坏。一旦损坏,我们就无能为力了。

相关内容