Ubuntu – Partition table lost – how to recover lost LUKS partition, I have some backup partitioning data

data-recoverydual-bootencryptionpartitioning

Thanks for choosing to take a look and help.

The problem is this:

I have a 1TB external hard disk with
One encrypted partition(about 286 gb) – luks (I'll call this EP)
One unencrypted partition(about 580 GB). – ntfs (i'll call this UEP)

The rest of the partitions were empty so they don't matter. I changed the UEP to "read only" in windows using "diskpart attributes volume set readonly". It seemed to work fine without issues, but after a short while there was some error and my partition table went missing partition manager said the whole drive was unalocated. So too did gparted and fdisk.

I tried using testdisk and it found all the missing partitions, When I wrote the recovered partition to disk, the UEP returned fine, but the encrypted partition is now inexplicably downsized to 2MB.

Fortunately I did some partition data backup earlier when I was trying to convert this from GUID to MBR, before all this and have some sector data which may help in recovery.

The Pre-Crash data created by Partition Wizard is Here (line 37/39 are the partitions I speak of).

The Post-Crash data is here (noticeably start of 37 and end of 39 match the luks partition from the Pre-Crash data)

The LUKS partition is this one:

letter: * PartID:  7 Start:   137117696 End:   737118207 Size:   600000512 FsId: 255 Label:                      ClusterSize:  -1 FreeSectors:           0 Primary: 1 Bootable: 0 BootVolume: 0 SystemVolume: 0

Is there any way to recover the LUKS partition while also keeping the 580 GB NTFS Drive?

I only need to recover the two drives that I have discussed here.

Please help me out with this.

-Danish

Best Answer

To recreate the original partition scheme you will need to run a partitioning tool and create each partition with the start and end sectors from the backup data. That should restore the MBR exactly as it was. Try sfdisk:

sfdisk /dev/sdb -uM << EOF
2,114828,52
114830,19074,0
133904,585938,255
719842,1187896,7

You should check this for yourself. Each line is start,size,id with size in megabytes (-uM) based on your old partition data:

Start:        2048 End:   117585919 Size:   117583872 FsId: 52 Label:                      ClusterSize:   8 FreeSectors:   109144672 Primary: 1 Bootable: 0 BootVolume: 0 SystemVolume: 0
Start:   117585920 End:   137117695 Size:    19531776 FsId:  0 Label:                      ClusterSize:   1 FreeSectors:    19531776 Primary: 0 Bootable: 0 BootVolume: 0 SystemVolume: 0
Start:   137117696 End:   737118207 Size:   600000512 FsId: 255 Label:                      ClusterSize:  -1 FreeSectors:           0 Primary: 1 Bootable: 0 BootVolume: 0 SystemVolume: 0
Start:   737118208 End:  1953523711 Size:  1216405504 FsId:  7 Label:           Data-Drive ClusterSize:   8 FreeSectors:  1002478672 Primary: 1 Bootable: 0 BootVolume: 0 SystemVolume: 0

If you can not get the partition table recreated, have a look at this thread on recovering LUKS partitions.