Qubes can not decrypt the root directory partition.

[Alexander Villalba]

Regards!:

Although it was today that for the first time that I join the group, I have been using Qubes for years. But today when I wrote the disk encryption password, the system displays a message saying it can not boot. Try to load the encrypted disk with a bootable pendriver that has the Tails operating system installed, from the file browser, asked for the password, I wrote it, but could not load the partition of the hard disk containing Qubes. The unencrypted partitions were able to load and read them.

I understand that maybe I should give more information to solve the problem. I will provide the information requested.

I write from Venezuela, I translated this with the help of Google.

Thank you.

[te...@outoftheblue.pl]

On Sat, 26 Nov 2016 15:35:06 -0800 (PST)
Alexander Villalba <alexvil...@gmail.com> wrote:

> Regards!:
>
> Although it was today that for the first time that I join the group,
> I have been using Qubes for years. But today when I wrote the disk
> encryption password, the system displays a message saying it can not
> boot. Try to load the encrypted disk with a bootable pendriver that
> has the Tails operating system installed, from the file browser,
> asked for the password, I wrote it, but could not load the partition
> of the hard disk containing Qubes. The unencrypted partitions were
> able to load and read them.

Actually similar issue has happend to me. The partition was no longer
accessible via Qubes boot process nor Qubes USB with properly set
keymap. This happened after upgrade/reboot cycle, although I suspect
some kind of HW issue.

According to cryptsetup/luks man page, you should always have a backup
of LUKS partition header as it may get corrupted. Due to some
anti-forensic techniques in place such corruption is
claimed to be irrecoverable.

Hope that you had backups.

Regards,
tezeb

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Sat, Nov 26, 2016 at 03:35:06PM -0800, Alexander Villalba wrote:
> Regards!:
>
> Although it was today that for the first time that I join the group, I have been using Qubes for years.

Welcome!

> But today when I wrote the disk encryption password, the system displays a message saying it can not boot. Try to load the encrypted disk with a bootable pendriver that has the Tails operating system installed, from the file browser, asked for the password, I wrote it, but could not load the partition of the hard disk containing Qubes. The unencrypted partitions were able to load and read them.

I guess you've checked obvious things like Caps Lock or such? Or maybe
some key on your keyboard is broken? Or maybe different keyboard layout?
Generally the above looks like you're entering wrong password (at least
from the tool point of view), or your data is somehow broken (faulty
disk or such).

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJYOijyAAoJENuP0xzK19cstjAH/ij27PGHgC+adC3yNXFaS01F
vxVQS0/gpz5HAVkna7YDlKBH4UaGV5V/CTz++VZg4i0YNoxoxADcP93JxOrGu9fK
+xbnxWvc3UYI6BW9fVtkxWA1MjypTe6TFRMu3v7wtdHM46qj13bYSTIoSPMxs8+D
/mYg+MmLxIfpxtvFI3KIkPYjOZBaxE72Bn0vpRh+foPoYOAsWZeYxSD7hymwHIlM
Je7aLZjVhQ8qZMC/CIEBaJquqBeRV6P2cGyWc2phMJi4xAV/cXek9FBbjO0gpzfV
kuEH2T1DCGwswh18Ee4demSeGWnBiJl4cTlIn7ydrHvd6JcdvfPNkgT7aN+3Qsk=
=hVpl
-----END PGP SIGNATURE-----

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Sun, Nov 27, 2016 at 01:19:11AM +0000, Alexander Villalba wrote:
> tezeb:
>
> I do not have Backup ! And I do not think it's a hardware problem. Anyway
> there's diagnostic software for that.
>
> Marek Marczykowski-Górecki:
>
> And not, it's not the Caps Lock, the keyboard is fine (please, I'm not a
> baby!)
>
> But I do believe there are more options. It would be terrible if there were
> no more options.

Lets start from the beginning. In default installation you should have
LUKS container on one partition. You should be able to access it
from console (from whatever running linux - Tails, Qubes installation
disk in rescue mode or anything else):

Check what partition it is:

sudo blkid

Search for TYPE="crypto_LUKS", on my system it is /dev/sda3, so lets go
to the next step:

sudo cryptsetup open /dev/sda3 sda3crypt

This should ask you for your disk passphrase. If all goes well, you
should get /dev/mapper/sda3crypt. If not, examine LUKS header:

sudo cryptsetup luksDump /dev/sda3

You should see at least one key slot "ENABLED". If not (and you don't
have any backup), there is no way to recover the data.

Next step is to activate LVM - this is what lies inside LUKS container
on Qubes. This is easy:

sudo vgscan -ay

You should get /dev/qubes_dom0/root, which you can mount normally and
access your data - VM data images are in /var/lib/qubes/appvms.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJYO5r2AAoJENuP0xzK19csOV4H/jeg5fisG5eufBn10M0Iy7NK
ObiNpRO7Cgu8pPSrdecqeKWDL0Tdm2fiGMviRw65UM0x3vBFxa0LhmCFFCKJ+kYP
pLX4fjyK+hXuanay5WX2cFhS/w7RvQ7D1MTQvQmUDRJonDoce6jXGH4lJkebRGPb
WOqZ2LK5H0HfmAkib+WP8+Q2GOTZgWmtQc8gjcxFYfcbAYsFwTolzOb3863vycWj
xbvVoL0FZJqfyC7Z+prCXtXCxuDRf6Vj9fyJXp51IDwJazZ+WamCnIOcaFhE1Ugj
y8HYdBwGdwTpyavcKvRQ6q0mUNbiHGWrHEPQqKfnXAhNdINa1qgUMFCRN3OF/Fg=
=I3gv
-----END PGP SIGNATURE-----