cgsecurity.org

Hi,

I accidentally deleted an Outlook ".pst" file and used PhotoRec to undelete the file. The file was on a encrypted disk. The file was recovered with the exact same size, however the filename and extension has changed. The file was initially called "hm.pst" and now is called "f599212.gpg". I did some research on google and found out that gpg is a type of encryption. I have tried to use Gpg4win to decrypt the file, however no key is available on the keyring, I have tried this using the computer where the file was stored.

My question is, can I recover the original file?If so, how?

Thanks in advance,

Mário Amaral

If you only deleted it, it would be possible to recover it using TestDisk and the menu Advanced / Undelete.
Your drive must be decrypted and mounted.
In TestDisk it should appear as Drive (not disk).
Also if you use PhotoRec, you should have a try using the mounted and decrypted drive, not disk.
Please use the version 6.14-32bit.

Fiona,

first of all, thanks for your quick reply. I have followed your instructions, but the file no longer appears when trying to undelete. I can find older ".pst's" that I deleted long ago, but not the one I need. Is there any kind of size limitation? The file size is about 6 Gb.

Nevertheless, I have the file that I originally recovered as a ".gpg". Is there anyway to decrypt that file? I have the hard disk decryption key, does it help?

Thanks for all,

Mário Amaral

Currently I have no idea about any file size limitation.
Only FAT32 has a file size limit of 4 GB.
I've tested TestDisk and undelete up to files size of 4 GB.
I'll repeat a test using a file of 7 GB size.
It's an Acronis image.

Fiona

Fiona,

thanks again. Are you saying you're going to test with an Acronis image file or that I can recover my file from the .gpg using Acronis? How? I have just downloaded Acronis True Image, and Acronis Disk Director, none seems to be able to open the .gpg file.

Can you be more specific? I'm in a dire situation and really need to recover that file.

Mário Amaral

It only means that I have a File which has a file size of 7 GB (doesn't a matter what file type).
I'll check, does TestDisk copy it or not?

Fiona

Hi Fiona,

thanks once more. The deleted file is no longer "found" by PhotoRec or TestDisk, so it will not be possible recover the file as it was.

So my question is, do you have any suggestion as how I can recover the original ".pst" from the ".gpg" that was recovered by PhotoRec? That is the only alternative that I have now...

Thanks,

Mário Amaral