0

I have an external backup hard drive that is encrypted using LUKS. As I was re-organising my backups, I copied the data to another encrypted drive and did a kind of "quick wipe" on the original drive by replacing the key in the key slot with random data. Goal was to use the drive afterwards as a second backup, but at that moment, time failed to properly clean-up the drive and do the second copy.

Unfortunately, meanwhile, my second backup drive and computer were stolen. I'm left with the original backup drive, which theoretically contains the data, but behind a key that I don't know. However, I still know the original key, the one that was previously used in the keyslot, before replacement.

Is there a chance to get back this old keyslot? The drive is a standard magnetic 2.5" USB3 drive, not an SSD. So I don't know if it uses some kind of copy-on-write for such metadata or if some tools could find the data buried underneath the new keyslot?

Internal FS is EXT4 for what is worth.

Improve this question

1 Answer 1

Reset to default
1

The problem is the content of the key slot. In order to access the data you need the master key. The people having one of the slot keys may not be supposed to know the master key (because then you could not lock somebody out without reencrypting all the data).

Thus a new key is given (password or file), turned into a key of the suitable key length, and then the key slot data is generated by XORing the input key and the master key. In other words: When you know the password then you still need the slot data for building the master key. Without the slot data, the password is completely useless.

Sorry.

If you had a dump of the LUKS header, then you could restore that and use the old password.

Improve this answer
4
  • Do you think that the slot data could be salvaged by some kind of recovery software to get a dump of the old LUKS header? I don't know how LUKS secures by default the erasing of the old data. Is that a simple overwrite or a multiple pass data shreding? Commented May 25, 2020 at 0:27
  • Well, reading on this topic, it seems I am wrong in even asking the question. The belief that I had that some recovery tools (possibly advanced) could read back the "underdata" looks like a myth. Some sources even claim that "shredding procedures" are somewhat just pedantic as nobody can effectively recover data that was overwritten, even just once. Commented May 25, 2020 at 1:38
  • @Cilyan Overwriting once is a 100% solution against software attacks. Only extremely powerful (and expensive) hardware attacks may have a chance to find data which has been overwritten once. Commented May 25, 2020 at 2:06
  • Indeed. Well even worse, most sources say that with the new disk tecnologies, even with expensive hardware, this is impossible (older papers refer to track drift, which is now non-existent). I read more on the key change process of LUKS, the key data is even overwritten first, before the keyslot metadata. So in fact, this answer is the definitive only, unfortunately... Commented May 25, 2020 at 18:52

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.