1

On a system with dual boot, the Windows tool Dell SupportAssist started to modify partitions now I ended up with a broken Linux installation.

The Linux installation is/was Ubuntu with an encrypted LUKS partition and before applying a week-old backup I thought that there might be a change of rescuing some data.

A live distribution still found the partitions and testdisk claimed that was able to identify its boundaries.

It seems that there's still some data accessible:

$ cryptsetup luksDump
LUKS header information
Version:        2
Epoch:          3
Metadata area:  16384 [bytes]
Keyslots area:  16744448 [bytes]
UUID:           3ebdbc55-c283-4b33-89f6-b254057db9d0
Label:          (no label)
Subsystem:      (no subsystem)
Flags:          (no flags)

Data segments:
  0: crypt
    offset: 16777216 [bytes]
    length: (whole device)
    cipher: aes-xts-plain64
    sector: 512 [bytes]

Keyslots:
  0: luks2
    Key:        512 bits
    Priority:   normal
    Cipher:     aes-xts-plain64
    Cipher key: 512 bits
    PBKDF:      argon2i
    Time cost:  7
    Memory:     1048576
    Threads:    4
    Salt:       a5 ff f5 ae 21 38 4f 44 4b af 26 fb bd b5 15 7f 
                41 dd 86 4a c1 41 7f 2c 35 f7 52 0b b8 ff 3b a4 
    AF stripes: 4000
    AF hash:    sha512
    Area offset:32768 [bytes]
    Area length:258048 [bytes]
    Digest ID:  0
Tokens:
Digests:
  0: pbkdf2
    Hash:       sha512
    Iterations: 187513
    Salt:       0d 92 31 9c ae 3c a7 d1 aa 04 5f 37 e5 ff 6f 4e 
                a7 4f 37 3f a5 0c 2c a4 db 31 69 06 52 91 79 16 
    Digest:     13 3c 62 0f 06 17 be 9b e5 da 86 05 d5 fb 39 ad 
                d8 e2 2f a5 fd 8f 14 55 50 c5 c1 73 e9 e6 84 76 
                86 e2 c3 f1 c2 ef 72 c4 bf f5 42 0a 8f 43 5a 0e 
                cd a9 2b c4 70 de 0d b8 d5 06 40 2b a6 4e 10 64 

but I'm getting an error message when trying to mount it (WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?):

$ sudo cryptsetup luksOpen /dev/nvme0n1p4 crypt
Enter passphrase for /dev/nvme0n1p4:
$ sudo vgchange -ay 
  WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?
  WARNING: One or more devices used as PVs in VG vgubuntu have changed sizes.
  device-mapper: reload ioctl on  (252:2) failed: Invalid argument
  1 logical volume(s) in volume group "vgubuntu" now active

This error pops up on all commands:

$ sudo vgdisplay
  WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?
  WARNING: One or more devices used as PVs in VG vgubuntu have changed sizes.
  --- Volume group ---
  VG Name               vgubuntu
  System ID             
  Format                lvm2
  Metadata Areas        1
  Metadata Sequence No  3
  VG Access             read/write
  VG Status             resizable
  MAX LV                0
  Cur LV                2
  Open LV               0
  Max PV                0
  Cur PV                1
  Act PV                1
  VG Size               <1.67 TiB
  PE Size               4.00 MiB
  Total PE              437736
  Alloc PE / Size       437736 / <1.67 TiB
  Free  PE / Size       0 / 0   
  VG UUID               5v0f8R-w1Qg-SBI2-Ozzb-0f1z-aCML-yyDsxq

$ sudo vgchange -ay --activationmode partial
  PARTIAL MODE. Incomplete logical volumes will be processed.
  WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?
  WARNING: One or more devices used as PVs in VG vgubuntu have changed sizes.
  device-mapper: reload ioctl on  (252:2) failed: Invalid argument
  1 logical volume(s) in volume group "vgubuntu" now active

$ sudo lvscan
  WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?
  WARNING: One or more devices used as PVs in VG vgubuntu have changed sizes.
  ACTIVE            '/dev/vgubuntu/swap' [<41.04 GiB] inherit
  inactive          '/dev/vgubuntu/root' [<1.63 TiB] inherit

I thought that maybe resetting the boundaries might help but it didn't:

$ sudo lvreduce -L -1M /dev/vgubuntu/root
  WARNING: Device /dev/mapper/crypt has size of 1985102877 sectors which is smaller than corresponding PV size of 3585935360 sectors. Was device resized?
  WARNING: One or more devices used as PVs in VG vgubuntu have changed sizes.
  Rounding size to boundary between physical extents: 0   .
  New size (427230 extents) matches existing size (427230 extents).

So maybe that wasn't a good idea on my side.

This is how the structure in testdisk looks like:

Disk /dev/nvme0n1 - 2048 GB / 1907 GiB - CHS 1953514 64 32     Partition               Start        End    Size in sectors >P MS Data                     2048    1085439    1083392 [Recovery] P EFI System               1085440    1290239     204800 [EFI System Partition] [NO NAME] D MS Data                403359745  405266432    1906688 D MS Data                405266432  407173119    1906688 D MS Data                405676033  407175168    1499136 D MS Data                407175168  408674303    1499136 P Linux filesys. data    408674304  412581887    3907584 P Linux filesys. data    412581888 2397717532 1985135645

This is how its intense scan looks like:

testdisk intensive scan result

This is how the structure in DMDE looks like:

partition overview of DMDE

screenshot of DMDE

Any advice on how to proceed to try rescuing the data?

10
  • 2
    simple task, restore from backup
    – djdomi
    Nov 1, 2023 at 9:46
  • "After booting to SuppportAssist OS Recovery you will see a Tutorial. Exit the tutorial and click on the repair tile on the home page. Follow the onscreen prompts and at the end of the process restart back to the main OS". dell.com/support/kbdoc/en-us/000187311/…
    – Greg Askew
    Nov 1, 2023 at 10:08
  • Hello @djdomi, you might want to read the second sentence. ;) Nov 1, 2023 at 10:20
  • Thank you @GregAskew, but unfortunately this won't recover the lost data on Linux partitions. Nov 1, 2023 at 10:23
  • If nothing was overwritten aside from the partition metadata, perhaps you can create two duplicate disks, one using your broken disk and the other using your backup and restore the partition table from that which hopefully will fix the sector size for the devices used by the physical volume, and then see if it still produces the error. I haven't used the tool you mentioned, but most tools such as parted support restoring the partition table from a backup and you may be able to get a clean partition table backup from your backup.
    – philipenix
    Nov 2, 2023 at 2:50

1 Answer 1

2
+50

Keep calm, don't apply changes on testdisk further.

  1. Get an USB Hard Drive (important)
  2. Clone entire disk to USB HDD with dd command
  3. Then, attempt to rescue marked partition below in the USB HDD

Last detected missing partition

If you're lucky, you could mount and get the data out from the USB HDD. Otherwise, repeat step 2 but upper than the marked partition in trial & error manner, one-by-one, and hope for the best.

Edit: The reason why I ask you to do this outside internal drive, because once you messed up the drive with testdisk, most likely first-most detected partition would be broken. Once broken, there is nothing we could do.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .