will photorec work on cryptkeeper encrypted files?

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
megatronrex
Posts: 1
Joined: 31 Dec 2017, 17:01

will photorec work on cryptkeeper encrypted files?

#1 Post by megatronrex »

I accidently deleted a directory that was encrypted using cryptkeeper. The files are on an ext4 formated disk and I'm using Ubuntu 16.04 as my OS. I tried to recover using extundelete and ext4magic and I managed to recover about 50% of the files. I would like to recover the remaining files and I was wondering if photorec can do this. I understand that photorec works by examining magic numbers, right? I tried running photorec on this disk but it did not recover the encrypted files so I'm guessing that the encryption process masks the files magic number and photorec cannot tell what file type they are so it cannot recover them, right? Am I right in assuming that photorec is the wrong tool to use here? Thanks!

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: will photorec work on cryptkeeper encrypted files?

#2 Post by cgrenier »

It's possible to create custom signature for PhotoRec (see https://www.cgsecurity.org/testdisk.pdf ) . Does CryptKeeper files have magic/constant values that can be used to identify them ?

Locked