Recovering data from a partition without the passphrase

Question

How can I recover data from a crashed disk whose encryption passphrase I have forgotten? I have the root password, and my Ubuntu 16.04 is not booting. I am able to see the partition when I mount the disk in another computer but the files are not accessible.

Answer 1

The entire point of encryption is to keep unauthorized users out of files. This authorization is usually done via password. It is very likely all data on that drive (especially if it suffered a failure) should be considered lost.

However, for the sake of knowledge, you may theoretically launch a brute force attack against this drive:

1. First and foremost (as with any failing hard drive), create a full disk image using the dd command. If this fails, you may have luck with ddrescue and other such emergency recovery utilities. Once you have an image, get rid of the hard drive. It's dead.
2. Use a tool like John the Ripper or bruteforce-luks to attempt to brute force the encryption password. This will take a very long time, as decoding the master key for a LUKS-encrypted drive takes time. See this question on Security.SE, where a few passwords a second is considered good.

All in all, the data there is lost. In the future, ensure you have available (and working!) backups available to you. Also ensure that you either have an emergency recovery encryption key, or have your standard LUKS password written down and stored in a safe location (e.g. bank security deposit box).

See the Red Hat documentation for a couple other approaches (if you have a second keyslot, a master key, or the drive is still open). In your case, however, it seems unlikely that any of those apply.