1

I have a luks encrypted SD Card and I want to recover all deleted files from it. I have been truing with extundelete using the following commands:

extundelete --restore-directory RecoverDir/ /media/user/Cardname/
extundelete: "/media/user/Cardname/" is a directory. You need to use the raw filesystem device (or a copy thereof).
extundelete: Operation not permitted when trying to open filesystem /media/user/Cardname/

so I tried using using the device with:

extundelete --restore-directory RecoverDir/ /dev/dm-0
extundelete: Permission denied when trying to open filesystem /dev/dm-0

ok, this way I do not call the decrypted device, so I tried:

extundelete --restore-directory RecoverDir/ /dev/mapper/luks-63728377-654f-7ad0-8fa7-aa890ab098b7
extundelete: Permission denied when trying to open filesystem /dev/mapper/luks-63728377-654f-7ad0-8fa7-aa890ab098b7

I changed the numbers of the filename.

when I try as root I get

extundelete: Superblock checksum does not match superblock when trying to open filesystem

Is there a way to get this going, or does extundelete not go with encrypted luks devices?

nath
  • 5,430
  • 9
  • 45
  • 87

1 Answers1

1

You've basically tried all of the combinations except the right one. Here's what needs to be true for the tool to have a hope of working:

  • Run extundelete as root
  • Have the LUKS container mounted
  • Point extundelete at the device file corresponding to the LUKS device (the one you pass with mount to mount the filesystem)
Joseph Sible-Reinstate Monica
  • 3,298
  • 14
  • 27
  • I'm on a debian "testing" with gnome desktop and the system mounts the card automatically after correct password input. With `df` i get a line `/dev/dm-0 [...] /media/user/Cardname`. Would it then be `/dev/dm-0 `? – nath Oct 20 '18 at 16:38
  • 1
    Yes. (Though note that you don't want it to be mounted, definitely at least not rw-mounted, when you run extundelete.) – Joseph Sible-Reinstate Monica Oct 20 '18 at 16:47
  • 2
    Could you please come back to this and update with some specific steps? I have the same problem but the internet is pretty scarce on how to use extundelete with encrypted lvm partitions. – DeepDeadpool Jul 27 '21 at 04:27