themaddoctor
themaddoctor
Test data: ``` artist: Artist Name title: Song Title album: Name of Album album artist: Album Artist disk: 01 track: 99 date: 2018 genre: rock comment: ``` (No comment because...
``` hexdump -C test 00000000 49 44 33 03 00 00 00 00 11 12 54 50 45 31 00 00 |ID3.......TPE1..| 00000010 00 0c 00 00 00 41 72...
Dump some of /dev/mapper/wd so that I can see. hexdump -C -n 1024 /dev/mapper/wd and dd if=/dev/mapper/wd skip=2048 count=2 | hexdump -C
You didn't decrypt it right.
Try mounting /dev/sdb1. What makes you think it is encrypted?
OK, start over and work carefully. In the meantime, send me a copy of your keyblock and dek.hex. I'll look at them tomorrow. (hexdump -C kb.bin)
What DEK did you get?
Are you sure it's sdb? If so, dump sectors 0 and 2048 for me. sudo dd if=/dev/sdb count=1 | hexdump -C sudo dd if=/dev/sdb count=1 skip=2048 | hexdump -C
Sector 0 is NOT encrypted. Sector 2048 contains only zeroes. This is what happens if you connect to a Windows machine and allow it to "initialize" the disk. Dump sector...
You need to get another 1TB drive, and back up /dev/mapper/wd to it. Then do data recovery on the new decrypted disk. I suggest using ddrescue to do the copying.