Help me, please! This is my Reddit thread. This is a crisis.

If you cannot provide me tech support, then please share this post for signal boosting.

Thank you.

https://www.reddit.com/r/linux4noobs/comments/1pqairt/linux_partition_crisis_i_need_data_recovery_help/

@crowgirl Adding a hashtag Linux to the post might help visibility. Itโ€™s worked for me when I was stuck. Good luck!
@crowgirl ohhhhhh fuckballs.
This, kids, is why I warn to NEVER EVER EVER use Ubuntu and ESPECIALLY not derivatives.
And no, it WILL NOT preserve. It WILL wipe. Do you have any other computers available?
@rootwyrm No. And my book is on that partition.

@crowgirl okay, and you SEE the partition, but you can't mount, correct?

With the live CD, as root, what does `parted -l` output? (That's *list*. Non-destructive.)

@crowgirl generally you should see more than two partitions; first one should be fat32 with boot,esp flags, an 'ext4' or 'xfs', and then another with no filesystem type and flags 'lvm.' Ubuntu in addition to not testing, isn't consistent. *IF* there's three partitions like I'm hoping, it should actually be a VERY quick fix.
@crowgirl having been in this position before, I would say the first thing to do, before anything, is image that drive. Use dd or something to make a copy of it before doing anything. That way you can try risky things without worrying.
@90sScriptKiddiw I really hate to do this. But can you point me to instructions for doing that?

@crowgirl Scroll down to the "Making disk image with dd using live CD/DVD or USB pen drive" on this page:

https://www.cyberciti.biz/faq/unix-linux-dd-create-make-disk-image-commands/

@crowgirl If you get stuck or anything hit me up and I'll do what I can to help, I'm around for the next couple of hours and more or less all day tomorrow. I'm not a Linux expert but I've been running a Debian server for a few years and have gotten out of my share of jams.
@crowgirl encrypted but *not* LUKS? Do you know what your keys are? Sorry if I can't help much on this but will boost.
@earthshine I know my password. I don't know the keys?
@crowgirl is it possible you had a key file or something somewhere that got misplaced in the OS snafu? WDE can be set up to require more than just a password to decrypt.
@crowgirl one piece of advice I can offer is make a bit for bit copy of your disk and work on the clone not the original to avoid further mishaps, so you can safely try things without risking making things worse.
@crowgirl @drwho Before taking any action make an image backup of the storage device to another storage device. Buy an external hard drive if needed to store the copy. Make the image using dd or ddrescue running from the LiveCD. After making the backup remove the original storage device and store it in a safe place. Get a new storage device of the same size or larger and restore the image to it with ddrescue. Now you can try to recover using the new copy. Never write to the original until you have recovered the data from the copy.
@crowgirl @btanderson I see a lot of folks here offering the suggestion of backing up the drive with dd. this is a good suggestion but speaking from experience, be EXTREMELY careful, and quadruple check, with another person, that the arguments for dd are correct before running it. it is not a backup tool or a data preservation tool, it is a block copying tool, and it will happily annihilate your disk with no warning if you get the input/output arguments backwards.
@crowgirl use `file` cli program from livecd on the block device to check what it is, it is going to tell you what that partition actually is.
@crowgirl hi hiiii; let's see if I can maybe help a little?

You mentioned neither Crypsetup nor LUKs is working; you have the password, you're using ext4. Definitely do not reinstall Linux at this time because yeah, if you wipe that partition, it's probably all lost.

Do you have any details about the computer itself? Are you using a desktop or a laptop, and how new is it? If you have a TPM module, I'm seeing that maaaybe ubuntu 24.04 (and maybe kubuntu) has an option for using the TPM for disk encryption. I'm still reading into it, but in that case, it might be that the keys you've mentioned that you don't have are stored in there. I'll keep reading here, but if you get a chance would you mind letting me know about the computer age / make / model?
@crowgirl https://documentation.ubuntu.com/core/how-to-guides/manage-ubuntu-core/use-a-recovery-mode/index.html

This could be helpful if that's the case; in the live environment, can you try the command suggested here?

sudo snap recovery --show-keys

Also, does it ask for anything when you try and boot normally? If it asks for your recovery key or anything like, that would be really useful and helpful!
Use a recovery mode

Ubuntu Core is inherently robust. But if data corruption issues do occur, even on boot or data partitions, it can still access a recovery mode to help repair, restore or reinstall an impaired devic...

Ubuntu Core
@crowgirl If you just have a blank screen when you try and boot up, hit esc and see if any text is displayed or if there's a prompt or anything.

If you see
JUST a blinking cursor, try hitting enter and waiting; sometimes it might have tried to print out a statement and is asking for input, but the text displayed might have been clobbered for whatever reason. Usually just hitting enter will get it to repeat the question, most of the time.
@aud There is definitely a TPM in my ASUS ROG G15 Strix laptop, 2021 model. Because it briefly ran Windows 11 before I got rid of that malware!
@crowgirl are we talking about full disk encryption or an encrypted home directory?

@crowgirl A possibly helpful page on full disk encryption on Ubuntu, especially the way TPM could be used.

https://documentation.ubuntu.com/security/security-features/storage/encryption-full-disk/

Full disk encryption (FDE)

24.04 LUKS: supported TPM: supported in Ubuntu Core and Ubuntu Desktop 22.04 LUKS: supported TPM: supported in Ubuntu Core and Ubuntu Desktop 20.04 LUKS: supported TPM: supported in Ubuntu Core and...

Ubuntu security documentation
@crowgirl what do you mean by "I can't boot into my OS" ? Describe what happens as precisely as you can, maybe the failure happens in a stage where the system can still be operated and a working state recovered. Also, describe how you messed up driver packages, it seems unlikely that fiddling with a video driver would completely cripple the system.

@crowgirl

Is there someone you trust thatโ€™s knowledgeable enough to work on this with you in person or with a screen share?

When Iโ€™ve gotten myself in situations like this, anxiety kicks in and I miss things. A second head can be helpful.

Agree with imaging the drive, itโ€™s a good first move. Good luck. If you feel ok with it, shout out a general location, maybe someone can suggest a local group.

@crowgirl Ive been there before but didn't have encryption to contend with. Take a breath. It'll be ok, one step at a time.

I'll second all the people suggesting to make a backup with dd or whatever. You can't go wrong making a backup as long as you're comfortable with the tools you're using to create it.

I dont know your level of experience, so I'm gonna throw some questions and suggestions at the metaphorical wall to see what sticks. Feel free to ask questions or disregard if Im just not helpful.

We'll start easy, what do you see when you turn on the computer? BIOS splash? OS loading screen? Login screen?

If it's just desktop and graphics drivers that are screwed up, you might see nothing, just black, or maybe a login screen that just doesn't work. Press Ctrl-Alt and any one of the F keys. This should take you to a terminal only interface where you can log in. Usually F7 is the default for a normal desktop, but that varies depending on distro.

@TommyTorty10 BIOS splash then black screen, if I try to boot into Kubuntu 24.04 on internal disk.
@crowgirl are you sure it's actually encrypted? it doesn't seem like it, what happens if you just cd into the mount point?
@crowgirl just another thing: luks uses en_us keymap.

@crowgirl you said you already mounted something from the live cd? maybe you have a separate home and root partition, and only the former is encrypted?

if so, I would run
sudo chroot /path/to/mount /bin/bash
to do troubleshooting on the root partition like you would on a powered system. mainly, trying to trace back your steps

never used drive encryption before, so excuse me if I'm lost on the technicalities

@crowgirl "if so" = ONLY so. probably don't do that stuff if it's a single partition with encrypted directories
@crowgirl Your 20.04 LiveCD is quite old. It is possible that your 24.04 installation uses more recent cryptography not supported by 20.04's kernel or cryptsetup (i'm assuming it is cryptsetup). Try with a 24.04 LiveCD.

@crowgirl
Here's the content from your Reddit post, for convenience:

Linux partition crisis, I need data recovery, help!
I was using Kubuntu 24.04 without problems for well over a year.

Then some update messed with my NVIDIA drivers and I couldn't launch any of my Steam Linux games, Vulkan errors.

After messing around with various NVIDIA driver packages, I lost my ability to boot into my operating system.

I am now running Kubuntu 20.04 from a LiveCD.

Help me!

I tried all kinds of things with truecrypt, veracrypt, cryptsetup. No success.

LiveCD OS does see the Kubuntu 24.04 partition. It's /dev/nvme1n1p2, mounted on /media/kubuntu/kubuntu_2404

I know the password to that partition. But it doesn't seem to use LUKS encryption.

Cryptsetup and LuksOpen doesn't work because I get "/media/kubuntu/kubuntu_2404 is not compatible" and "/dev/nvme1n1p2 is not compatible"

Trying to install from LiveCD is a scary risk because when I tried the installer, there was no indication that it would preserve my documents in the old /dev/nvme1n1p2 24.04 partition.

So I'm not trying that.

A book that I owe Kickstarter backers is on that partition.

I know the password for whatever encryption is on there!

And it is ext4.

But it doesn't seem to be LUKS encryption.

And I can't figure out what it used for encryption. Or how to use the OS sudo password I was using to log into 24.04 to decrypt it so I can recover it.

Help!

I am in a crisis. ๐Ÿ˜ญ๐Ÿ˜ญ๐Ÿ˜ญ

@crowgirl Have you tried taking a look at the partition using a GUI utility of some sort? Kubuntu comes with the KDE Partition Manager, that should be able to auto-recognize it and AFAIK unlock and mount it.
@WinNT4 Yes, I was using KDE Partition Manager since yesterday.
@crowgirl When you select the device where the is partition and look at the "Type" column, what does it say next to the partition? Something like "ext4", "luks" "ext4 [Encrypted", "unknown" etc?

@crowgirl if you cannot afford to lose the data, start with creating a full disk image. Get yourself an external (or internal in case of a desktop) HDD (fast enough for a backup, no need to break the bank) that is big enough.
Boot into the live cd/usb. The dd command should look something like (make sure to replace sdX with the correct letter for the target drive):

dd if=/dev/nvme1n1 of=/dev/sdX statusprogress bs=1M

Try to find a local linux group, hands-on support is a lot easier!

@crowgirl heya, from the live cd, what happens if you run:

file -s /dev/nvme0n1p[2

@crowgirl maybe as a starting point:

lsblk --output vendor,model,name,label,size,fstype,fsused,uuid

should give you a first overview on the storage, partition and partition types found.

From there you can hopefully narrow down the issue. ๐Ÿคž

@crowgirl Putting the comment I just put there here as well:

I wrote up a whole thing about "yeah try the file command on the partition" before realizing... wait, it's mounted? Check out the contents of that partition, /media/kubuntu/kubuntu_2404.

It might be home encryption with, um, ecryptfs? I think it's called? It's file-based encryption, your files stored as encrypted files instead of a whole encrypted block device.

@crowgirl You can install ecryptfs tools from the ecryptfs-utils package (sudo apt install ecryptfs-utils). This works in the live desktop, until you reboot (which resets you to a clean slate).
@crowgirl IIRC ecryptfs is the other encryption thing that distros commonly offer out of the box, besides LUKS, and it's not LUKS.

@crowgirl Okay, it looks like you can use mount to mount ecryptfs like a normal filesystem:

mount -t ecryptfs /media/kubuntu/kubuntu_2404/home/... /mnt (with the .../home/... bit being wherever the ecryptfs encrypted files are)

and then the decrypted view of your files shows up in /mnt

assuming this is ecryptfs in the first place

edit: but maybe mount the partition that has your encrypted files read-only, if you can. (mount -o remount,ro /dev/nvme1n1p2 should do that.)

@crowgirl @_L1vY_ Whatever you do, be extremely cautious of ANY instructions around (g)parted or dd. You could lose the whole thing very easily if youโ€™re not familiar with how these tools work and mix up, swap or typo the syntax.

I would recommend hiring an expert if you have an entire book on the line, if thatโ€™s an option.

@crowgirl Oh! This is actually straightforward to fix, especially if getting access to the data read-only is the primary goal -- don't panic, don't try to reinstall. Boot into a shell with a livecd and see what lsblk tells you -- does it recognize the disk as `crypt`? Are you able to read the LUKS header?

@crowgirl if you had access to the disk, /etc/crypttab and /etc/fstab would be useful, but that would require you to be able to read the disk which is the point. However, if you can read anything, dump those files.

One question would be whether you have an encrypted home dir but not root filesystem, I think some versions of Ubuntu used to do that.

@crowgirl A hint here, though, is that it couldn't be mounted if it were encrypted. So either something else is mounted, or you're dealing with LVM and home directory encryption potentially

@crowgirl I wrote you this in Reddit but I put it here also for visibility

here's what I think is happening: The home directory is probably encrypted with ecryptfs (file-based encryption), not the whole disk with LUKS. This is a common Ubuntu setup option.

Try this:

Open a terminal and run: ls /media/kubuntu/kubuntu_2404/home

Can you see your username folder? Can you see files inside it, or does it look like gibberish/encrypted filenames?

If it looks encrypted, you need to decrypt your home folder:

sudo apt install ecryptfs-utils

sudo ecryptfs-recover-private /media/kubuntu/kubuntu_2404/home/.ecryptfs

It'll ask for your login password (the one you used to log into 24.04).

@crowgirl

My way, make a live antiX usb stick, boot explore your installed system

you give sparse details in the reddit thread. Is your whole setup encrypted, if so you have a massive problem, especially as it seems you have no backups.
But
If your root partition is not encrypted pls give info here. That would mean you have a repair chance.

But go slow, change too much too fast and you lose all data

@crowgirl i can hop on a call and try to help if you like. I have a calendar link on my mastodon profile so you can schedule from there.

Firstly though, try to make a clone of your storage so that you can experiment without the fear of losing your data

@crowgirl

I recommend the English-language Linux support from LinuxGuides, which is subject to a fee.

Nevertheless, the quality is very good. And to my knowledge, you do not have to pay/will receive a refund if the support team is unable to find a solution.

https://linuxort.com/linux-support/

Linux-Support โ€“ Linux Ort

@crowgirl I haven't read all the comments here or on Reddit, and the focus is clearly on lvm issues which I can't comment on, but here are some thoughts:

- Is the nvme device removable? (I presume so, but who knows.) If so, you might consider removing it until you get your computer back up and running with no risk of the install process messing up the nvme drive.

The following seem to me less likely to be relevant, but I thought I'd mention them.

- Also, you can get m.2 nvme enclosures from ugreen on Amazon for not too much money that with allow you to plug in the drive via usb at up to 10Gb/s. I mention this because it would avoid having to open up your machine to install the nvme drive during the recovery process, so just a but less messing around.

- I suggest making a full block level copy of the nvme drive that way if something goes wrong during recovery you should be able to recreate it and try again. The nvme enclosure mentioned above could make that slightly more convenient.

@crowgirl I could barely load that page because of the js and stuff like that, but from what I'm reading there, you have issues with losing the key to an encrypted partition? are you sure you have the correct partition type for what the issue is? what does the file command say when you point it at the encrypted partition?
@esoteric_programmer Partition type? It's an ext4 main Linux OS partition.
@crowgirl how do you know if it's encrypted then? it shouldn't have just ext4 there. Does the file command on the partition show you an ext4 filesystem without luks?
@esoteric_programmer I wrongly assumed it was encrypted.
@crowgirl so, why do you think the files are unreadable? did you run fsck on the partition?