On Sat, Jun 22, 2024 at 11:39:12AM -0300, Crystal Kolipe wrote: > On Sat, Jun 22, 2024 at 02:33:21PM +0000, Anon Loli wrote: > > On Sat, Jun 22, 2024 at 11:25:32AM -0300, Crystal Kolipe wrote: > > > On Sat, Jun 22, 2024 at 01:02:04PM +0000, Anon Loli wrote: > > > > So, guess who did a DD with "of=/dev/rsd2c" instead of > > > > "of=/dev/rsd4c"... ME > > > > Can this volume/drive still be recovered? I think the metadata and > > > > stuff is > > > > lost > > > > "77594624 bytes transferred", so about 74M... > > > > > > First of all, STOP. Anything you do is likely to reduce the chance of > > > recovering data from it. > > > > I did, I realized my mistake the moment that I pressed enter, actually a few > > milliseconds before I pressed ENTER, but my body was too slow to react, and > > in > > my hurry to stop it, I clicked way too many buttons at once, opened a new > > terminal window, switched to a different tiling of windows and by the time I > > found the window and stopped the DD command, about 7 seconds have passed :( > > Unfortunately you've overwritten the volume which underlies the encrypted > volume. > > If you'd trashed the encrypted volume itself, (or the volume was unencrypted), > there is hope to recover some of the data, (we've actually published some info > on how to do this, which is why I said to stop immediately, because the method > relies on some metadata which happens to be in ram, and if you reset then it's > lost). > > In your case, if I understand correctly, you've overwritten the encryption key > and it's not backed up anywhere.
The encrypted disk is sd2, at the time of overwritting with DD, I overwrote the RAW sd2, so rsd2, the encrypted volume (sd2) was decrypted (became sd3) and was mounted on /mnt/whatever, with this command: `mount -o rw,noatime,noexec,nodev,nosuid ...` the decrypting on the encrypted volume sd2 was decrypted with: `bioctl -v -c C -l ...` if it matters So it should still be in RAM? df -h still shows the sd3i unencrypted volume mounted on /mnt/whatever but a ls -l of that shows that it's just a file (not a directory with like +200G of data), it gives me this amongst other stuff: `c--Srwx---` and /mnt/whatever*, like it's an executable, it also says the date is 1970 of the mountpoint.. a `du -ch *` says that /mnt/whatever is "-3.9E" in size ;-; if it matters, I did a fsck exactly before mounting it which might now be my last time :(
