Re: echo "pass" piped to sudo tee cryptsetup luksOpen overwritten LUKS partition

On 11/30/24 2:36 PM, Rafal Babinicz wrote:
> During disk replacement I rendered my old LUKS encrypted disk unrecognized (my verbatim shell history attached).

You just discovered why LUKS header backup is kind of useful.

> TL:DR can I revert what I did there? Especially that line:
> $ echo "passphrase" | sudo tee cryptsetup luksOpen /dev/sdb3 enc

So this is the tee command what overwritten the header, not cryptsetup.

That said, you perhaps overwrote only 48 bytes.

Try this:

# create a fake container
truncate -s 16M fake.img

# format it with the same cipher you had in your image (password is not important)
echo | cryptsetup luksFormat --type luks1 --cipher aes-xts-plain64 fake.img

# replace these 48 bytes (it contain magic, version and cipher only)
dd if=fake.img of=luksheaderdamage.img bs=48 count=1 conv=notrunc

Now the image is LUKS1 gain, try you password.

The one you provided is not correct, so either you redacted it or something else happened.

BTW with LUKS2 format this would be fixed automatically as there is backup header.

Milan