Stuck in Grub Recovery after installing Second OS to alternate Hard drive. How to recover?

[ForeverANoob22]

I have a notebook that has 2 internal hard drives. On the first drive, I installed Qubes OS Successfully. On the Second internal hard drive, I installed a different version of linux. Now, after installing linux on the 2nd hard drive, grub no longer boots qubes.

When I first boot up my Qubes os, I get a black screen that says:

Attempting to decrypt master key...
Enter passphrase for hd1,msdos1 (1234afj2030fha0fa0fea93202r94jfnj):

After entering the encryption passphrase correctly, I get the following message and then the grub rescue command prompt:

error: access denied.
error: no such cryptodisk found.
error: disk 'cryptouuid/1234afj2030fha0fa0fea93202r94jfnj' not found.
grub rescue>

Note1: I don’t have a gpt partiton on Qubes because my computer boots in Bios mode as opposed to Uefi mode.

Note2: It is possible that my debian installer for my second hard drive chose to write over the Qubes bootloader on the gubes drive. How can I check if thats what happened and how can I fix that if thats the case?

How can I fix this and get Qubes to boot again? I have no idea about grub rescue commands. Please help?

[apparatus]

You can boot from some LiveCD or from Qubes OS installer USB and try to decrypt and mount your Qubes OS partitions there.
You can also check the partitions on your drives with fdisk -l and check their IDs with blkid.

[ForeverANoob22]

Once I decrypt and mount my qubes os from the live cd what do I do? How do i get it back to a bootable state? Doesn’t seem like mounting it from a live cd will do much aside from fsck. It seems like I have to use some commands in grub recovery to find the proper partition/drive or something. Can you elaborate on your answer to help me get this installation bootable?

[apparatus]

@ForeverANoob22

Once I decrypt and mount my qubes os from the live cd what do I do?

It’s so that you can check that your encrypted partition is present and is not corrupted. Maybe your cryptodisk is not found because it was overwritten by second OS.

[ForeverANoob22]

How do i check if the encrypted partiton is corrupted or not. What do I do after I verify it is NOT corrupted? How do I get my Qubes OS to boot?

[apparatus]

@ForeverANoob22

How do i check if the encrypted partiton is corrupted or not.

First you can check the partitions on your drives with fdisk -l and check their IDs with blkid to see if partition 1234afj2030fha0fa0fea93202r94jfnj exists.
If it exists then try to decrypt it and mount some qube for a test:

Qubes won’t start - not enough disk space

Boot in a live usb (even the Qubes OS installer, enter TTY with CTRL+ALT+F2) and deal with the qube in question from there. # If your QubesOS installation is encrypted: $ cryptsetup open /dev/<device> luks-qubes # Find the name of the qube of interest and mount it $ lsblk # Grep can help you locate the exact qube $ lsblk | grep <my-qube> $ mount /dev/mapper/qubes_dom0-vm--<my-qube>--private /mnt # Do what you need to do then unmount $ umount /mnt $ vgchange -a n $ cryptsetup close luks-qubes (…

[ForeverANoob22]

First you can check the partitions on your drives with fdisk -l and check their IDs with blkid to see if partition 1234afj2030fha0fa0fea93202r94jfnj exists.
If it exists then try to decrypt it and mount some qube for a test:

Is 1234afj2030fha0fa0fea93202r94jfnj supposed to be a UUID of a partition? Because if it is, then blkid did not match that partition. lsblk and blkid show the following:

$ sudo blkid
/dev/sda2: UUID="88888888-8888-8888-8888-88888888888" TYPE="crypto_LUKS" PARTUUID=899999999-02
/dev/sda1: UUID="77777777-7777-7777-7777-77777777777" BLOCK_SIZE="4096" TYPE="ext4" PARTUUID="8999999999-01"

I was indeed able to decrypt /dev/sda2 with gnome-disks utility, and then I mounted several qubes successfully. So it seems like my actual encrypted Qubes disk is okay. However, Grub can’t find the actual LUKS partition it’s installed on.

Boot in a live usb (even the Qubes OS installer, enter TTY with CTRL+ALT+F2) and deal with the qube in question from there.

What do you mean “Deal with the qube in question”? I am not haveing issue with any specific qube. All qubes mount fine from a debian live cd and so does the encrypted LUKS partition they are contained in. So what exactly are you talking about? Could you be more specific?

If your QubesOS installation is encrypted: $ cryptsetup open /dev/ luks-qubes # Find the name of the qube of interest and mount it

Again, my qubes are fine. The OS just won’t boot into qubes. So why am I tinkering with specific qubes inside of my encrypted LUKS Partition?

lsblk # Grep can help you locate the exact qube $ lsblk | grep $ mount /dev/mapper/qubes_dom0-vm––private /mnt #

What qube am I trying to locate with grep? dom0? What exactly does your notation mean? It’s not very clear. Should It look more like this?

$ lsblk | home-vm
$ mount /dev/mapper/qubes_dom0-vm--home-vm--private /mnt

Are these the correct commands? If so what will these commands do?

Do what you need to do then unmount

I have no idea what I need to do. What is it exactly that you are telling me to do? This makes no sense.

then unmount $ umount /mnt $ vgchange -a n $ cryptsetup close luks-qubes (…
Your commands are confusing. Do you mean this?

$ umount /mnt
$ vgchange -a n
$ cryptsetup close luks-qubes

what about the "(.." What does that mean?

Can you please walk me through this? Thank you!

[ForeverANoob22]

Anyone out there that can help me? I had all of my work on my qubes installation and desperately need to recover it.

[apparatus]

@ForeverANoob22

What do you mean “Deal with the qube in question”? I am not haveing issue with any specific qube. All qubes mount fine from a debian live cd and so does the encrypted LUKS partition they are contained in. So what exactly are you talking about? Could you be more specific?

I’ve linked you a post in another topic as an example of how to mount your qubes from LiveUSB or Qubes installer in case you don’t know how.
The forum embedded the linked post this way in my post, but the link was:
https://forum.qubes-os.org/t/qubes-won-t-start-not-enough-disk-space/14759/2

@ForeverANoob22

what about the "(.." What does that mean?

You see the preview of the linked post and not full post. To see full post clink on the down arrow in the top right of the embedded post box or open the link to the post by pressing on the linked topic name.

Regarding your problem - are you sure that you’re booting the Qubes OS grub and not your second OS grub?
The grub messages don’t look like they belong to Qubes OS grub.
Check the BIOS boot order to see if you’re booting from the correct drive.

[apparatus]

Maybe your second OS overwritten your Qubes OS grub config.
I don’t have PC with legacy BIOS to test it but you can try to restore your Qubes OS grub config by decrypting Qubes OS dom0 root, mounting, chrooting into it and then running grub2-mkconfig there.
You can mount and chroot into dom0 root like this (this guide is for EFI so you’ll have to adapt it for legacy BIOS):

Reversing qvm.usb-keyboard

You can install the grub again. Boot from some LiveUSB (e.g. from Qubes OS installer in Rescue) and chroot your Qubes, assuming /dev/sdb is your Qubes drive: Read how to mount your root: How to mount a Qubes partition from another OS | Qubes OS Mount your system: mkdir /mnt/system mount /dev/qubes_dom0/root /mnt/system cd /mnt/system mount /dev/sdb2 boot mount /dev/sdb1 boot/efi mount -t proc /proc proc mount -t sysfs /sys sys mount --rbind /dev dev mount --rbind /run run mount --rbind /sys…

Then try to fix your grub like this:

Multibooting Qubes

Introduction You should think carefully before dual booting Qubes on your box. Read the guidelines carefully. One problem is that when you dual or multiboot, even if you are using encryption on your Qubes installation, /boot is still unprotected and could be maliciously modified by the other OS, possibly leading to Qubes itself being maliciously modified. The other problem is firmware security - for example the other system could infect the BIOS firmware, which might enable compromise or spyi…

[ForeverANoob22]

I’ve linked you a post in another topic as an example of how to mount your qubes from LiveUSB or Qubes installer in case you don’t know how.

Your answers are not very helpful because they don’t answer any of my questions. I don’t understand what qube is in question in the first place, and what qube I should be mounting in the first place to fix the bootloader. I already told you I was able to mount my qubes sucesfully and that they were in working condition. But which cube should I mount to do surgery on and what surgical procedures should I be doing on that qube to make the bootloader find the right partition to boot? If you could you please reread my previous post and give me a full detailed explanation of what I need to do after mounting whatever cube I need to mount so that I can fix this? I’m really having issues drawing any conclusions whatsoever from your reply’s and some more details and instructions would be heavily appreciated.

[apparatus]

You don’t need to mount your qubes to fix your issue. I’ve asked you to check if you can mount any of your qubes to know if your Qubes OS LUKS partition is damaged or not.
You’ve tested this and it’s not damaged.

As I written in my last posts your problem is with Qubes OS boot partition.
I can’t give you a precise step by step guide on what to do because I don’t have a PC with legacy BIOS and Qubes OS installed on it to test all the steps before I tell them to you for you to follow them.
I can just give you a general idea on how to fix your problem.

First of all you need to check in your BIOS boot order if you’re booting from the correct hard drive.
Better yet just disconnect your second hard drive with second OS and try to boot with only Qubes OS hard drive.
If you’ll have the same error then it means that your second OS overwritten Qubes OS grub in Qubes OS hard drive boot partition and you need to restore it .
The general instructions on how to restore it are given in the links in my last post but these instructions are not step by step guide and you need to change them for your case.

[ForeverANoob22]

In the first link “Reversing…” it says to do the following from the Qubes rescue usb:

mkdir /mnt/system
mount /dev/qubes_dom0/root /mnt/system
cd /mnt/system
mount /dev/sda2 boot
mount /dev/sda1 boot/efi
mount -t proc /proc proc
mount -t sysfs /sys sys
mount --rbind /dev dev
mount --rbind /run run
mount --rbind /sys/firmware/efi/efivars sys/firmware/efi/efivars
chroot .

When starting the rescue disk, it automatically mounts my root Qubes partition with
cryptsetup open /dev/sda luks-qubes after asking for my root partition password.

This prevents me from proceeding with

cd /mnt/system
mount /dev/sda2 boot

Giving me the error that the LUKS partition is already mounted on luks-qubes.
I tried to unmount luks-qubes, but can’t because it is in use from the following command:
mount /dev/qubes_dom0/root /mnt/system.

These instructions are not clear, and already on step 3 I am encountering problems. How can I mount /dev/sda2 to /mnt/system/boot when /dev/sda2 is already mounted on luks-qubes? I can’t unmount luks-qubes either because dom0 is using it on /mnt/system/.

How can I proceed from here?

[apparatus]

If the system is already mounted by Qubes OS rescue (to /mnt/system?) then you can just skip all the mounting steps and chroot to it (chroot /mnt/system if it’s mounted there) right away to follow the next steps.
You can check where it’s mounted with this command:
mount | grep luks-qubes

[ForeverANoob22]

I’ve spent over 14 hours now reading in and out over and over again the links you posted, and google links and I am still getting nowhere. I tried following this several guides and stack exchange answers but I am getting nowhere and am literally going to tear my hair out. I swear. Every post you made are instructions to do something else then the specific purpose of reinstalling grub on a bios legacy machine. They all contradict themselves. Some tell me to mount the rootfs partition, some tell me not to, etc. etc. Isn’t there anyone out there who can just give me step by step instructions as to how I can reinstall grub on my current qubes? I would imaging that this is a relatively common problem. Why is it so hard to solve? I don’t know what else to do and my brain can’t even think anymore. SHould I be chrooting into my boot partition at /dev/sda1? Or… Then what? Can’t someone out there pretty please with a cherry on top help me with a step by step set of instructions to fix my qubes grub installation? I don’t have the capacity to keep reading in circles and am thinking of posting on stack exchange just to get an actual definitive answer. I don’t know what else to do anymore but I’m brain really hurts! Any step-by-step help would be greatly appreciated!

[apparatus]

I can give you the untested step-by-step guide if you can post here the output of these commands when you boot in rescue mode using Qubes OS installer after it automatically mounts your Qubes partition:

fdisk -l /dev/nvme* /dev/sd*
mount | grep -e /dev/nvme -e /dev/sd

I need to know what’s the correct drive name and partition numbers of your installed Qubes OS and where is it automounted.

[ForeverANoob22]

Here it is…

$ fdisk -l /dev/nvme* /dev/sd*
Disk /dev/sda: 1.84 TiB, 2000398934016 bytes, 3907029168 sectors
Disk model: Qubes SSD Drive
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x5aa95411

Device     Boot   Start        End    Sectors  Size Id Type
/dev/sda1  *       2048    2099199    2097152    1G 83 Linux
/dev/sda2       2099200 3907028991 3904929792  1.8T 83 Linux


Disk /dev/sda1: 1 GiB, 1073741824 bytes, 2097152 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/sda2: 1.84 TiB, 1999324053504 bytes, 3904929792 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/sdb: 238.49 GiB, 256060514304 bytes, 500118192 sectors
Disk model: Generic Internal Hard Drive (secondary drive)
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x76537dba

Device     Boot     Start       End   Sectors   Size Id Type
/dev/sdb1  *         2048 464182623 464180576 221.3G 83 Linux
/dev/sdb2       464182624 500103449  35920826  17.1G 83 Linux


Disk /dev/sdb1: 221.35 GiB, 237660454912 bytes, 464180576 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/sdb2: 17.13 GiB, 18391462912 bytes, 35920826 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/sdc: 7.27 GiB, 7801405440 bytes, 15237120 sectors
Disk model: USB Flash Disk
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x2fd1ea9f

Device     Boot Start      End  Sectors  Size Id Type
/dev/sdc1  *        0 12044287 12044288  5.8G  0 Empty
/dev/sdc2         808     5427     4620  2.3M ef EFI (FAT-12/16/32)


Disk /dev/sdc1: 5.76 GiB, 6166675456 bytes, 12044288 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x2fd1ea9f

Device      Boot Start      End  Sectors  Size Id Type
/dev/sdc1p1 *        0 12044287 12044288  5.8G  0 Empty
/dev/sdc1p2        808     5427     4620  2.3M ef EFI (FAT-12/16/32)


Disk /dev/sdc2: 2.26 MiB, 2365440 bytes, 4620 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00000000

$ mount | grep -e /dev/nvme -e /dev/sd
/dev/sdc on /run/install/repo type iso9660 (ro,relatime,nojoliet,check=s,map=n,blocksize=2048,iocharset=utf8)

Thank you for all of your time and energy!

[apparatus]

Untested, assuming /dev/sda is your Qubes OS drive:

cryptsetup luksOpen /dev/sda2 luks-qubes
vgchange -ay
mkdir /mnt/qubes
mount /dev/qubes_dom0/root /mnt/qubes
cd /mnt/qubes
mount /dev/sda1 boot
# Backup the /boot partition
cp -r boot root/boot-backup
mount -t proc /proc proc
mount -t sysfs /sys sys
mount --rbind /dev dev
mount --rbind /run run
chroot .
grub-install /dev/sda

After running grub2-mkconfig command below you only will be able to boot into Qubes OS.
If you want to be able to boot into your second OS as well as Qubes OS you need to copy the menuentries for your second OS from root/boot-backup/grub2/grub.cfg to /etc/grub.d/40_custom by following this guide:

Multibooting Qubes

Introduction You should think carefully before dual booting Qubes on your box. Read the guidelines carefully. One problem is that when you dual or multiboot, even if you are using encryption on your Qubes installation, /boot is still unprotected and could be maliciously modified by the other OS, possibly leading to Qubes itself being maliciously modified. The other problem is firmware security - for example the other system could infect the BIOS firmware, which might enable compromise or spyi…

grub2-mkconfig -o /boot/grub2/grub.cfg
exit
reboot

If you formatted the /boot partition you may also need to regenerate initramfs (with dracut -vf --regenerate-all) and vmlinuz (reinstall the kernel package) files for your Qubes OS kernels in /lib/modules.

[ForeverANoob22]

Sorry for the late reply. Thanks for the help, but I am having the following problem:

grub-install /dev/sda
bash: grub-install: command not found

What can I do?

[apparatus]

Try:

grub2-install /dev/sda