Re: [sleuthkit-users] Which blocks my very partly zeroed out, recoverable luks volume file occupies
Brought to you by:
carrier
Menu
▾
▴
Re: [sleuthkit-users] Which blocks my very partly zeroed out, recoverable luks volume file occupies?
|
From: <mir...@zg...> - 2015-05-07 00:58:34
|
I had not received, and surely it is because of my provider being likely intentionally lousy, the reply that Atila's reply that I see in the list archives at: ( of this same subject as this message you are reading ) http://sourceforge.net/p/sleuthkit/mailman/message/33695222/ > Please don't use mke2fs!!! That's for create a new fs! > > Since you can mount the luks vol, I guess you are at a point were you > have a unencrypted ext4 fs with the first 5% (or other number) > overwritten. I think it is even more complicated than that; try and skimm through: i) the beginning of the topic, to see how exactly the trouble started: https://forums.gentoo.org/viewtopic-t-1004014.html ii) the very good explanation from frostschutz that I only recently grasped: https://forums.gentoo.org/viewtopic-t-1004014.html#7724060 iii) more of a good explanation by another Gentooer: https://forums.gentoo.org/viewtopic-t-1004014-start-25.html#7724620 > > Is this correct? If so, a 'hexdump -C' of the middle of your > unencrypted disk may have readable text. > > Did you try that that sugestion of using mount with sb=...? Yes, but as in iii) did not help, at this stage: https://forums.gentoo.org/viewtopic-t-1004014-start-25.html#7742740 > I didn't understand the MD5 part. You have the MD5 of the luks header? > How is this helpful? It's not. Forget it, that was wrong on my part. So to Atila's kind message I reconstructed a reply by pasting it from the web archives, as I already have done about a month ago, and that one from a month ago still got in the right place in the thread of the archives. Will this mail arrive to the Sleuthkit ML, remains to be seen... If this mail doesn't pass through my provider's censorship/sloppiness/other, to arrive to Sleuthkit ML, I'll post it at: Recover partly overwritten luks volume? https://forums.gentoo.org/viewtopic-t-1004014.html (where it will be publicly visible around the current date and time plus a few more hours), and there I will kindly ask readers of that topic to paste it in their mail and send it to Sleuthit ML for me. I have tried a few times to register to Sleuthkit Forum, and you can see two of my documented failed attempts, in screeencasts and packet dumps: i) linked from: https://forums.gentoo.org/viewtopic-t-1004014.html#7724054 registration completely successful at forum.sleuthkit.org, mail never arrived ii) linked from: https://forums.gentoo.org/viewtopic-t-1004014-start-25.html#7734200 my correct captcha response at the Schmoogle wouldn't be reacted at all, Schmoog was playing mute. It's a miniature, easily checked it I am saying the truth. As I kindly ask in i) above, help me some of you dear people at Sleuthkit.org! E.g. encrypt a random password for me to my 0x4FBAF0AE key, e.g. to user miroR that I tried to register as, and send it to me via email, but check for my reaction within a couple of days to see if I got it. And if no reaction from me, a stubborn wannabe SleuthKit Forum user, than it is very likely that it didn't get through to my mailbox. In which case, as I suggest in i), it's quick and easy (for you uncensored free people, and the most of your readers), to log into Gentoo Forums; people like, e.g. PaX Team, or the MirBSD creator Thorsten mirabilos Glaser did it for just a message or two... Log into Gentoo Forums some of you, and send me a private message with the necessary password, encrypted or even unencrypted to my 0x4FBAF0AE key. Once I can log into forum.SleuthKit.org, I'm likely free to finally post my issues there. With the email correspondence, my provider are real jerks. Thank you in advance! -- Miroslav Rovis Zagreb, Croatia http://www.CroatiaFidelis.hr |
