I've got a bit of a quite terrible situation on my hands and I'm just looking for a bit of insight before calling this a lost cause.

To put things into context, I'll just give you my partitioning scheme first.

I've got a server with a four-disk btrfs filesystem (the data is spanned with the btrfs raid0 mode). Each disk is has a LUKS-encrypted partition with the btrfs data on it, every LUKS partition is protected by a single key slot which resides in an encrypted file within the initramfs. A LUKS keyscript decrypts those boot keys automatically using a smart-card.

Now here comes the screw-up.

Many months ago I had to grow the btrfs filesystem and added a new disk, encrypted it, saved the bootkey, etc. HOWEVER, I overlooked a critical part of the process and forgot to run update-initramfs which would have propagated my new encrypted bootkey to the initramfs. Today, that server rebooted due to a power failure and to my horror, when I inspected it, /var/lib/bootkeys didn't contain the key to my newly-added disk!

This brings me to the actual question.

Is there any chance that the boot key file contained in my, now 25% missing, btrfs filesystem could be located on one of the three disks I still have access to? And if so, is there any chance of recovering that boot key and restore full access to my filesystem?

For starters I've tried running the following commands but they don't produce any meaningful output or seem to restore any files (/dev/mapper/c{0,2} are the readable decrypted disks).

btrfs restore --path-regex '^/(|var(|/lib(|/bootkeys(|/.*))))$' /dev/mapper/c0 /mnt/recovery0
btrfs restore --path-regex '^/(|var(|/lib(|/bootkeys(|/.*))))$' /dev/mapper/c1 /mnt/recovery1
btrfs restore --path-regex '^/(|var(|/lib(|/bootkeys(|/.*))))$' /dev/mapper/c2 /mnt/recovery2 
  • Sure, the bootkey file is there. But it's encrypted! It's time to restore from backup. – Michael Hampton Jan 11 '18 at 0:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.