Data Recovery Case File · Encryption & Linux · An Honest Limit

When the passphrase survives but the door does not: a reformatted LUKS volume, a mirror that never was, and a verdict delivered without a fee

This archive publishes its defeats deliberately, and this one carries the trade's most important encryption lesson. The customer — running an unRAID server, technically fluent — had accidentally reformatted a LUKS-encrypted XFS drive: a 1TB Crucial MX500 SSD. The safety net existed on paper: the drive "was meant to be mirrored to another SSD — however, it turns out this was not correctly processed on the server's side." He held the encryption key; he offered the working mirror-that-wasn't as a reference for how the setup looked; and he asked, before committing, the exact right question: "do you operate on a no-recovery no-fee basis?" Yes — and this is the case that shows why that answer is the whole foundation of honest encrypted-drive work.

Why encryption inverts the reformat odds — the header decode

Across this archive, "I reformatted it" is usually good news in disguise: formats replace a drive's front-page paperwork and leave the data body untouched, so recovery re-lists what a format un-listed. LUKS inverts that arithmetic, and every encrypted-volume owner should know why before they need to. A LUKS volume's opening territory holds its header: the structure containing the encrypted master key — the actual key that scrambled every sector — wrapped inside key-slots that the passphrase unlocks. The passphrase, in other words, doesn't decrypt your data; it decrypts the header, and the header decrypts your data. Which means the data body — terabytes of perfect, intact ciphertext — is only readable through that one small structure, and a reformat's writes land precisely where it lives: the drive's opening territory, the same real estate every format rewrites first. Destroy the header and the passphrase becomes a key to a door that no longer exists — with the ciphertext behind it cryptographically unreachable forever, by anyone, which is the encryption working exactly as designed against what it cannot distinguish from an attacker. The assessment's entire job, therefore, was archaeology at one address: image the SSD write-blocked, reconstruct from his reference system exactly where the original header had lived, and examine that territory byte by byte — including the search for LUKS's secondary structures and any header remnants the reformat's particular writes might have straddled.

The finding — and what honesty costs

The verdict was the hard one, delivered plainly and in writing: the reformat had rewritten the header's territory comprehensively — the key material overwritten, no recoverable remnants, no backup header in existence — and the terabyte of ciphertext behind it, though physically pristine, is permanently unreadable. His known passphrase, his documentation, his reference system: all correct, all supplied, all unable to matter, because the one structure they unlock was gone. And then the answer to his opening question, honoured by execution: no recovery, no fee — the assessment, the imaging, the forensics and the written report cost him nothing, because a lab that charges for hope on encrypted reformats is selling exactly the thing this page exists to warn against. What he received instead, free, was certainty: the search was exhaustive, the conclusion is final, and he can stop wondering — which, in the honest-limits genre, is the only product worth anything.

Outcome — and the two lessons that outlive the data

No recovery — and two lessons his candour paid for, published where they'll save others. First, the villain wasn't the reformat; it was the silent mirror. His safety net "was not correctly processed on the server's side" — a replication that never replicated, discovered only at the moment it was needed: the single most common shape of backup disaster this archive sees. Backups and mirrors are claims until tested; verify them on a schedule — restore a file, check the copy's contents, make the net prove it exists. Second, LUKS users: back up your headers. The encryption system ships with a header-backup facility for precisely this catastrophe — one small file, stored elsewhere, and a reformatted volume becomes recoverable again, because the door can be reinstalled. It's a five-minute task that converts this entire page's outcome from permanent to trivial. He'll run both habits now. The terabyte he lost bought the two sentences above; this page's job is making sure it bought them for more than one person.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.