Re: [Bug-ddrescue] fill-mode vs luks encryption

[Atom Smasher]

On Fri, 6 Jun 2014, Scott Dwyer wrote:

> The one that is likely to work the best in your case would be the one 
> using MD5 checksums. The idea is to make a list of all the files MD5 
> checksums, then use the fill mode to change the bad sectors, then make 
> another list of the checksums and compare the lists. Because the disk is 
> encrypted you won't be able to find a specific pattern like you say, but 
> this method looks for differences in the files themselves which won't 
> care what the pattern is.
===============

before i sent the drive back to the manufacturer, i had >99.95% of the 
drive recovered. over 99.72% of the recovered data was in four large 
blocks.

keeping the original 1.4TB img file intact, i made two copies to a 4TB 
drive, checked the image hashes, then worked from the 4TB drive.

one of the images i assigned to a loop device, opened with "cryptsetup 
luksOpen", fsck'd with no errors and mounted, read-only.

the other image was "filled" ("--fill=-/"), then attached to a loop 
device, then opened with "cryptsetup luksOpen", then fsck'd with no errors 
and mounted, read-only.

i ran "diff -r" on the two mount-points, and it found no differences.

100% data recovery!! no lost data!!

thanks y'all!!


--
        ...atom

 ________________________
 http://atom.smasher.org/
 762A 3B98 A3C3 96C9 C6B7 582A B88D 52E4 D9F5 7808
 -------------------------------------------------

        "No two men are alike, and both of them are happy for it."
                -- Morris Mandel