(SOLVED) How to repair superblock on the encrypted disk? [Solved]

[JanK]

Hi! Need some help. Recently i ran into the problem, that left me with the corrupted superblock on the encrypted home folder.

Now i try to at least extract some valuable information from it with the help of MX LIVE-USB.

At first i checked backup superblocks

Code: Select all

demo@mx1:~
$  sudo mke2fs -n /dev/nvme0n1p3
[sudo] password for demo: 
mke2fs 1.46.2 (28-Feb-2021)
/dev/nvme0n1p3 contains a crypto_LUKS file system
Proceed anyway? (y,N) y
Creating filesystem with 21504000 4k blocks and 5382144 inodes
Filesystem UUID: 883b534d-ae5f-426c-9f83-f2300cbf1f61
Superblock backups stored on blocks: 
	32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, 
	4096000, 7962624, 11239424, 20480000

Then i tried to "open" the disk with passphrase

Code: Select all

demo@mx1:~
$ sudo cryptsetup luksOpen /dev/nvme0n1p3 homeMX
Enter passphrase for /dev/nvme0n1p3: 
demo@mx1:~
$ sudo cryptsetup luksOpen /dev/nvme0n1p3 homeMX
Enter passphrase for /dev/nvme0n1p3: 
Device homeMX already exists.

But i am not sure if "homeMX" is right word here. I think it should it should be "volume mapper" here, but i don't know what it must be exactly.

Then i tried to repair the superblock from the backup. But it tells, that disk is in use. Probably because i "opened" it before.

Code: Select all

$ sudo e2fsck -b 20480000 /dev/nvme0n1p3
e2fsck 1.46.2 (28-Feb-2021)
/dev/nvme0n1p3 is in use.
e2fsck: Cannot continue, aborting.

I have "closed" it and tried again

Code: Select all

demo@mx1:~
$ sudo cryptsetup luksClose homeMX
demo@mx1:~
$ sudo e2fsck -b 20480000 /dev/nvme0n1p3
e2fsck 1.46.2 (28-Feb-2021)
e2fsck: Invalid argument while trying to open /dev/nvme0n1p3

The superblock could not be read or does not describe a valid ext2/ext3/ext4
filesystem.  If the device is valid and it really contains an ext2/ext3/ext4
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
    e2fsck -b 8193 <device>
 or
    e2fsck -b 32768 <device>

Bad result. I tried again with the different backup number

Code: Select all

$ sudo e2fsck -b 294912 /dev/nvme0n1p3
e2fsck 1.46.2 (28-Feb-2021)
e2fsck: Bad magic number in super-block while trying to open /dev/nvme0n1p3

The superblock could not be read or does not describe a valid ext2/ext3/ext4
filesystem.  If the device is valid and it really contains an ext2/ext3/ext4
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
    e2fsck -b 8193 <device>
 or
    e2fsck -b 32768 <device>

/dev/nvme0n1p3 contains a crypto_LUKS file system

And now it again says something about LUKS.

Am i doing smth wrong or just no way to help here?

[Adrian]

From what I can find online you need to have the LUKS open to be able to fix Ext4.

Here's a summary that ChatGPT did, seems correct, might give you an idea of the steps:

To use fsck to check and repair a LUKS-encrypted disk, you need to perform a few additional steps compared to a regular unencrypted disk. Here's a step-by-step guide:

Open a terminal on your system.

Ensure that the encrypted disk is not currently mounted. If it is mounted, unmount it using the appropriate command. For example, if the disk is mounted at /dev/mapper/encrypted_disk, use the following command to unmount it:

Code: Select all

sudo umount /dev/mapper/encrypted_disk

Open the LUKS container using the cryptsetup command. Replace /dev/sdXN with the appropriate device and partition number for your setup. For example:

Code: Select all

sudo cryptsetup luksOpen /dev/sdXN encrypted_disk

After opening the LUKS container, you should have a mapped device available at /dev/mapper/encrypted_disk (or a similar path). Run the appropriate fsck command for the file system you are using on the encrypted disk. For example, if you're using ext4, use the following command:

Code: Select all

sudo fsck.ext4 /dev/mapper/encrypted_disk

Note: Replace ext4 with the appropriate file system type if you're using a different one (e.g., fsck.ntfs, fsck.xfs, etc.).

fsck will now check the file system and report any errors it finds. If it detects any errors, it will prompt you to confirm whether you want to repair them. Type y and press Enter to allow fsck to fix the errors. If it doesn't find any errors, it will simply display a message indicating the file system is clean.

Once the fsck process completes, you can close the LUKS container using the cryptsetup command. Run the following command to close the container:

Code: Select all

sudo cryptsetup luksClose encrypted_disk

At this point, you can mount the encrypted disk back if needed using the appropriate command. For example:

Code: Select all

sudo mount /dev/mapper/encrypted_disk /mnt

Remember to replace /mnt with the desired mount point for your system.

It looks like the difference between this and what you did is that you tried to run fsck on the actual partition, while it seems like you need to run in on /dev/mapper/encrypted_disk

[JanK]

Code: Select all

sudo fsck.ext4 /dev/mapper/encrypted_disk

Sorry for the late reply! That one worked! Thank you and AI)

Actually i didn't try plain "fsck.ext4" command, tried to change superblock on the backup one with "e2fsck -b". Maybe that's the case, or maybe i did "e2fsck -b" somehow wrong.

Friendly reminder: do backups!