Linux Encrypted Par...
 
Notifications
Clear all

Linux Encrypted Partition(s)

2 Posts
1 Users
0 Reactions
421 Views
minime2k9
(@minime2k9)
Honorable Member
Joined: 14 years ago
Posts: 481
Topic starter  

I'm struggling to mount an encrypted drive which was taken from a Linux laptop.

Background
Machine is a high end laptop, 2 SSD drives, one 120GB, one 480GB.
OS is Ubuntu 12

Created a virtual machine, however first part has been verified using live machine as well.
When machine is started up, it requires password for sda5_crypt. This is the encrypted partition on the 120GB hard disk.
When correct password is entered, it states the disk drive for /home/shared is not ready or present.
— end of live examination, rest is virtual machine—

So created a virtual disk of the 480GB drive and attached to VM.
Beginning of disk can see LUKS header for an encrypted drive.
Skipped mounting the /home/shared drive so that the machine boots into the OS.
Logged into user account
Go into terminal, change to root.
Fdisk -l brings back the devices
/dev/sdb is shown as the 480GB drive, no valid partitions.
No encrypted drives shown in home folder
Try sudo cryptsetup luksOpen /dev/sdb volume
Come out with /dev/sdb is not a valid LUKS device.

I've also tried attaching the encrypted virtual disk to a SIFT VM and that didn't work either, though it did as for a password before telling me it wasn't a LUKS device.

Any ideas on how to get the disk to mount?


   
Quote
minime2k9
(@minime2k9)
Honorable Member
Joined: 14 years ago
Posts: 481
Topic starter  

I've actually answered my own question.

For anyone else who comes across this, in my case the MBR boot record partition entries were 0'd out. I basically forged an MFT record for the partition on the virtual disk image and linux found it.


   
ReplyQuote
Share: