Recovery from corrupt block

[salvadorsosa]

Hi. I run gocryptfs in a directory with automount in a laptop.
From some days ago a message is showing in the logs:

Feb  8 15:46:21 machine gocryptfs[1123]: DecryptBlock: cipher: message authentication failed, len=560
Feb  8 15:46:21 machine gocryptfs[1123]: ino8004098: doRead: corrupt block #2: cipher: message authentication failed
Feb  8 15:46:21 machine gocryptfs[1123]: ino8004098: Read: returning EIO, offset=12288, length=0
Feb  8 15:46:21 machine gocryptfs[1123]: DecryptBlock: cipher: message authentication failed, len=560
Feb  8 15:46:21 machine gocryptfs[1123]: ino8004098: doRead: corrupt block #2: cipher: message authentication failed
Feb  8 15:46:21 machine gocryptfs[1123]: ino8004098 fh292: RMW read failed: 5=input/output error
Feb  8 15:46:21 machine gocryptfs[1123]: DecryptBlock: cipher: message authentication failed, len=560
Feb  8 15:46:21 machine gocryptfs[1123]: ino8004098: doRead: corrupt block #2: cipher: message authentication failed
Feb  8 15:46:21 machine gocryptfs[1123]: ino8004098: Read: returning EIO, offset=4096, length=8192
Feb  8 15:46:21 machine gocryptfs[1123]: DecryptBlock: cipher: message authentication failed, len=560
Feb  8 15:46:21 machine gocryptfs[1123]: ino8004098: doRead: corrupt block #2: cipher: message authentication failed
Feb  8 15:46:21 machine gocryptfs[1123]: ino8004098: Read: returning EIO, offset=4096, length=8192
Feb  8 15:48:11 machine gocryptfs[1123]: DecryptBlock: cipher: message authentication failed, len=560
Feb  8 15:48:11 machine gocryptfs[1123]: ino8004098: doRead: corrupt block #2: cipher: message authentication failed
Feb  8 15:48:11 machine gocryptfs[1123]: ino8004098: Read: returning EIO, offset=12288, length=0
Feb  8 15:48:11 machine gocryptfs[1123]: DecryptBlock: cipher: message authentication failed, len=560
Feb  8 15:48:11 machine gocryptfs[1123]: ino8004098: doRead: corrupt block #2: cipher: message authentication failed
Feb  8 15:48:11 machine gocryptfs[1123]: ino8004098: Read: returning EIO, offset=12288, length=0
Feb  8 15:48:11 machine gocryptfs[1123]: DecryptBlock: cipher: message authentication failed, len=560
Feb  8 15:48:11 machine gocryptfs[1123]: ino8004098: doRead: corrupt block #2: cipher: message authentication failed
Feb  8 15:48:11 machine gocryptfs[1123]: ino8004098 fh28: RMW read failed: 5=input/output error
Feb  8 15:48:11 machine gocryptfs[1123]: DecryptBlock: cipher: message authentication failed, len=560
Feb  8 15:48:11 machine gocryptfs[1123]: ino8004098: doRead: corrupt block #2: cipher: message authentication failed
Feb  8 15:48:11 machine gocryptfs[1123]: ino8004098: Read: returning EIO, offset=4096, length=8192
Feb  8 15:48:11 machine gocryptfs[1123]: DecryptBlock: cipher: message authentication failed, len=560
Feb  8 15:48:11 machine gocryptfs[1123]: ino8004098: doRead: corrupt block #2: cipher: message authentication failed
Feb  8 15:48:11 machine gocryptfs[1123]: ino8004098: Read: returning EIO, offset=4096, length=8192

I already run fsck on the disk. How I can detect what files were affected? There is a file integrity verifier? Could be possible to include in the log more information to detect where the problem is?

Thanks

Additional info: I run gocryptfs/stable,now 1.2-2+b1 amd64 [installed] on Debian 9 on ext4.
Linux machine 4.9.0-5-amd64 #1 SMP Debian 4.9.65-3+deb9u2 (2018-01-04) x86_64 GNU/Linux

[rfjakob]

Hi, let's decode the message:

ino8004098: doRead: corrupt block #2
   ^^^^^^^                  ^^^^^^^^
   the problem affects      ciphertext block
   the inode number         #2 is affected
   8004098

It is intentional that no file name is logged, as this could leak information. But you can find the file using the inode number: Use

find . -inum 8004098

in your mounted gocryptfs filesystem, and you should get the file name.

As for what part of the file is affected, ciphertext blocks are 4096 bytes long, so we have

block #0 = byte    0 to  4096
block #1 = byte 4097 to  8194
block #2 = byte 8195 to 12288  <-- this block is corrupt

If you want to check all files, there is no special tool for that yet, but you can just md5sum all your files an see if you get any read errors. In your mounted gocryptfs, you could do this:

find . -type f -print0 | xargs -0 md5sum

[salvadorsosa]

Thanks. I found the file and was a non important file. I just delete it.

[rfjakob]

Ok, good!