[dm-crypt] HELP, luksFormat over existing container
arno at wagner.name
Sat Jan 7 13:48:16 CET 2012
On Sat, Jan 07, 2012 at 10:57:08AM -0000, Konstantin V. Gavrilenko wrote:
> Hello list,
> I have a problem :(
> by mistake, instead of luksOpen I executed lukFormat on the loop device
> with associated cryptofile. even though the key is was the same, I have
> no backup of original luksHeader, so I assume i have no way of recovering
> the SALT.
And the master key is different in addition, at least in the first
key-slot that also has been overwritten.
> I am pretty much in Acceptance that it is not possible to
> recover anything, but would like to get an external confirmation, advice.
You are correct. Next step is to fix your set-up by adding
backup, see the FAQ.
> p.s. surprised and disappointing that cryptsetup does not issue a warning
> when running luksFormat over luks preformatted container :(
It gives you a very clear warning and asks for an uppercase "YES"
and asks for the passphrease two times. That _should_ be enough.
There is only so much a tool can do to protect you. The UNIX way is
to warn you, but to assume you want to do what you specified if
you ignore the warning.
There are a number of ways to kill the header that give a lot less
warning. Or none at all. Also the FAQ warns very, very clearly that
you _need_ a backup and should have a header backup. The backup
is the second line of defense and one of its major tasks is to
protect against user errors.
See it this way: Most people do not bother with backup until
they lose something important. The earlier you make that
experience, the better.
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno at wagner.name
GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
One of the painful things about our time is that those who feel certainty
are stupid, and those with any imagination and understanding are filled
with doubt and indecision. -- Bertrand Russell
More information about the dm-crypt