Most likely you've mistyped your password, as I had similar issue and blamed upgrade as well.
You can dump the header and try to brutal force it.
Following steps can help.
Confirm you've the right device:
sudo cryptsetup isLuks /dev/sda3 -v
Validate the header:
sudo cryptsetup luksDump /dev/sda3
Try initial few passwords (consider adding --debug for more output):
sudo cryptsetup luksOpen --test-passphrase /dev/sda3
Or: tcryptDump, but shouldn't make any difference.
Consider to backup the header:
sudo cryptsetup luksHeaderBackup /dev/sda3 --header-backup-file luksHeader.bin
Alternatively run (replace count with Payload offset found in header dump):
dd if=/dev/sda3 of=luksHeader.bin bs=512 count=4096
You can also consider to backup the whole device using dd.
Use header file to try different passwords: (quicker than using the actual device)
sudo cryptsetup luksOpen --test-passphrase luksHeader.bin
Brutal force
Having a small header file (as per above steps), you can try to brutal force it.
Assuming you know your original password, create the list of your potential password and their permutations in passes.txt (make the list unique by sort -ou passes.txt).
In shell, you can use the following script to try these combinations:
set -x
while read pass; do
printf $pass | cryptsetup luksOpen --test-passphrase luksHeader.bin $@ && echo Success && break;
done < passes.txt
Notes:
- Since the files are small, you can scale it to many machines.
- Consider adding
--key-slot 0 for quicker checks.
- You can try to override
--pbkdf-force-iterations (check how many there are in the header dump), but most likely it won't help.
Live CD
If you think that happened due to upgrade, use different Ubuntu Live CDs to use the above commands (Ubuntu 16, 18, 20 and so on).
Either boot from USB/CD, or install VM VirtualBox (Create Ubuntu VM, then load the ISO to boot from it).
To attach the physical device to VM VirtualBox (not recommended):
- In your newly created Ubuntu VM, attach Ubuntu's Live CD
.iso file.
- Use
VBoxManage internalcommands createrawvmdk command to create .vmdk files pointing to the real device. Attach these .vmdk into the VM (before starting it).
- If your user won't have access to these special devices during run, run
VirtualBoxVM as root (also not recommended).
Final steps, copy the header file then test passphrases using older version of cryptsetup (cryptsetup --version).
Mounting
Once success, use these commands to mount the filesystem:
sudo cryptsetup isLuks /dev/sdb5 -v
sudo cryptsetup luksOpen /dev/sdb5 newhd
sudo lvscan # Check if LVs are active.
sudo vgchange -ay # Activate LVs if not active.
sudo lvdisplay # List logical volumes (note the LV Path).
sudo mount /dev/ubuntu-vg/root /mnt
mount # List mounted filesystems.
xdg-open /mnt # Open in file explorer
Other useful commands:
sudo lvmdiskscan # List devices.
sudo vgdisplay # Display volume group information.
Answer: No.
Answer: No.
Answer: Yes it is and there is still one keyslot.
Answer: No.
Answer: Apart from the fact that a few blog posts say that everything above 1000 should be random characters: No.
