Using TestDisk to undelete files
2 posts • Page 1 of 1
I accidently deleted a directory that was encrypted using cryptkeeper. The files are on an ext4 formated disk and I'm using Ubuntu 16.04 as my OS. I tried to recover using extundelete and ext4magic and I managed to recover about 50% of the files. I would like to recover the remaining files and I was wondering if photorec can do this. I understand that photorec works by examining magic numbers, right? I tried running photorec on this disk but it did not recover the encrypted files so I'm guessing that the encryption process masks the files magic number and photorec cannot tell what file type they are so it cannot recover them, right? Am I right in assuming that photorec is the wrong tool to use here? Thanks!
- Site Admin
- Posts: 4172
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
It's possible to create custom signature for PhotoRec (see https://www.cgsecurity.org/testdisk.pdf ) . Does CryptKeeper files have magic/constant values that can be used to identify them ?
Who is online
Users browsing this forum: No registered users and 1 guest