Re: [sleuthkit-users] Which blocks my very partly zeroed out, recoverable luks volume file occupies?

[<mir...@zg...>]

I have not received, and surely it is because I have a miserable
provider, the reply that Atila sent (at least) to the list.

This message (I didn't get but one unrelated of the 3 new messages
after, and including mine) I am referring to:
( of this same subject as this message you are reading )
http://sourceforge.net/p/sleuthkit/mailman/message/33695222/

So I'll reconstruct it. And if it get filtered out by my bad provider,
I'll post it at:

Recover partly overwritten luks volume?
https://forums.gentoo.org/viewtopic-t-1004014.html
(around the current date and time plus a few more hours.

[So I'll reconstruct it], as if I had received it.

> Please don't use mke2fs!!! That's for create a new fs!
> 
> Since you can mount the luks vol, I guess you are at a point were you 
> have a unencrypted ext4 fs with the first 5% (or other number)
> overwritten.
> 
> Is this correct? If so, a 'hexdump -C'  of the middle of your 
> unencrypted disk may have readable text.
> 
> Did you try that that sugestion of using mount with sb=...?
> 
> I didn't understand the MD5 part. You have the MD5 of the luks header? 
> How is this helpful?

Thank you most kindly, Atila! But, as I wrote, allow time for my
actions. The problem is I have other unpredictable unrelated work at
hand that I have to dedicate to previously to working on my recovery.

I love Sleuthkit! Patience!

-- 
Miroslav Rovis
Zagreb, Croatia
http://www.CroatiaFidelis.hr