1

While setting up my new PC I also setup a new RAID 1 with 2 drives with LUKS on top. After copying all the data to it I made sure everything was usable and afterwards shredded the old drive.

But now I have no RAID anymore. I've found out that it's most likely due to me using full disks while creating the RAID instead of using partitions. Is there any way for me to recover the RAID and recovering the data within? I have saved the exact commands used to make the RAID but don't want to do anything until I'm certain I won't irreversibly mess something up.

Output of fdisk -l of both drives:

Disk /dev/sdb: 3.64 TiB, 4000787030016 bytes, 7814037168 sectors
Disk model: WDC WD40EFAX-68J
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: gpt
Disk identifier: 068E27EE-055B-A24A-B51B-D0B79E3DEA00

Disk /dev/sdc: 2.73 TiB, 3000592982016 bytes, 5860533168 sectors
Disk model: TOSHIBA HDWD130 
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: gpt
Disk identifier: F4ADCB83-B715-9B4A-A6A0-96687568611E

The RAID was created with the following command:

sudo mdadm --create --verbose /dev/md0 --level=1 --raid-devices=2 /dev/sdb /dev/sdc

mdadm --examine of both disks give the same output:

/dev/sdb:
   MBR Magic : aa55
Partition[0] :   4294967295 sectors at            1 (type ee)

/dev/sdc:
   MBR Magic : aa55
Partition[0] :   4294967295 sectors at            1 (type ee)

So it seems like the partition data is shot and that's why it's no longer visible as a raid member (type fd). Would it be possible to rewrite the partition data and restart the RAID?

The line in my mdadm.conf is as follows:

ARRAY /dev/md0 level=raid1 num-devices=2 metadata=1.2 name=WORKSTATION:0 UUID=fe2547a6:3296c156:303989ac:febb5051 devices=/dev/sdb,/dev/sdc

And could I otherwise start the RAID with just 1 member and recover the data that way? the LUKS data header should be the same on both disks right? or should I back them up before something overwrites it again?

I would greatly appreciate your help, there was around 1500GB of data on it before it failed.

P.S. I'm aware that the 2 disks are a different size, it used to be 2 3TB drives but one failed so I replaced it with a 4TB drive. The RAID has worked and was fully synced before this happened.

Improve this question
1
  • I should have been more clear about this, my bad. I created the RAID 1 then setup LUKS on top of it. So sudo cryptsetup luksFormat /dev/md0 and inside the LUKS device I created 1 ExFAT partition. Because the raid has to be used inside a windows system as well. I've read that using full disks isn't used recommended because other programs/OS'es will change the header information without confirmation. I suspect that booting windows was the culprit even though it's set to never mount any disk. Luckily the solution provided by frostschutz has worked and I'm currently backing up all the data. Commented Mar 2, 2023 at 2:28

2 Answers 2

Reset to default
1

Since RAID 1 is a simple mirror, you can ignore the RAID issue and instead search for the LUKS header directly. If no partitioning was involved, it should be somewhere around the start of the drive. Maybe with a few hundred MiB offset since mdadm uses quite generous data offsets.

The following command searches the first 1 GiB of the drive:

# hexdump -C -n 1G /dev/sdx | grep LUKS
08100000  4c 55 4b 53 ba be 00 02  00 00 00 00 00 00 40 00  |LUKS..........@.|

In this example, there is a potential LUKS header at offset 0x8100000 (129 MiB).

Create a (read-only) loop device at this offset and see if it works…

# losetup --find --show --read-only --offset $((0x8100000)) /dev/sdx
/dev/loop2
# cryptsetup luksOpen /dev/loop2 lukstest
Enter passphrase:
# mount -o loop,ro /dev/mapper/lukstest /mnt/somewhere

If that works, you could try to recover while keeping the data in-place. But I recommend you make a full backup copy first anyways.

Would it be possible to rewrite the partition data and restart the raid?

In theory, you'd have to

  1. create two loop devices(*), offset 1 MiB (future partition offset)
  2. run above hexdump command again on the loop device to determine correct offset (should be -1 MiB compared to bare drive),
  3. using those loop devices, re-create RAID using the correct offset and adapt mdadm.conf accordingly,
  4. cryptsetup open the raid,
  5. shrink the filesystem a little to make room for GPT backup header at end of disk,
  6. unmount the filesystem (if mounted), cryptsetup close luks, mdadm --stop the raid, losetup -d detach the loop devices,
  7. create a partition offset 1 MiB on both drives

At this point you should have drives with partitions, raid on the partitions, luks on the raid, filesystem inside luks.

However, this is the optimal case, and it will only work this way if I understood your situation correctly. There's plenty of ways how this can go completely wrong.

(*)

The hoop-jumping with loop devices is necessary because you have to shrink the filesystem first before you can create partitions without corrupting the end of device. And you can only shrink the filesystem if your RAID is running (if it runs off both drives and has to preserve consistency).

If you created partitions directly instead, probably nothing terrible would happen (or it already happened anyway) but it's technically not the correct way to go from bare disk to partitions in this scenario.

Improve this answer
3
  • 1
    Thank you so much, I've seen looking for the LUKS header data because it was suggested on another (much older) post and tried that. Didn't know it could be that far into the disk. Creating the loop device worked and I'm currently backing up all the data. Could booting (not installing) windows have changed the disk data? Is that preventable or should I just setup the RAID again but this time with partitions. I don't believe it's simple corruption since that would mean both disks had the exact same issue. Commented Mar 2, 2023 at 2:36
  • The in-place recovery method I posted above is still inaccurate but I'm too lazy to edit. Recommend you set it up from scratch — with partitions. Commented Mar 2, 2023 at 9:59
  • And yes, Windows is known for creating partition tables. But Linux does it too. For example Ubuntu LiveCD uses sfdisk/dd in its initramfs to create a writeable/persitence partition. Boot it once with the wrong parameters and you grow a partition you didn't really ask for. Stuff like that is around where you don't expect it. Commented Mar 2, 2023 at 10:04
0

Solved!

The answer provided by frostschutz worked perfectly and I am currently backing up all the data to another disk.

If you happen to stumble upon this question through google or another search engine. Try to find the LUKS header with the steps provided frostschutz, if you can't find anything it's probably better to post your own question but it's gonna get pretty difficult.

For using full disks in a mdadm raid I would highly recommend to make partitions first. If you know perfectly well what your doing it can work but if a disk is reused it will probably have a backup table at the end of the disk which by the UEFI standard will get used to overwrite your 'faulty' partition table (see the top comment on this HN article)

It's possible to fully clear all the partition info with a combination of sgdisk --zap and wipefs -a but spare yourself the headache and don't make the same mistake I did.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.