File can be listed by testdisk but photorec does not recover the file (LUKS-encrypted ext4)

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Eelee2qui8
Posts: 2
Joined: 14 May 2020, 21:41

File can be listed by testdisk but photorec does not recover the file (LUKS-encrypted ext4)

#1 Post by Eelee2qui8 »

Hi,

I have a partition encrypted by LUKS, and it's in ext4 format.

When I use testdisk to list the files, I can still see the deleted file that I would like to recover, but when I copy the file to a destination. The copied file seems to be not interpretable.

I've also tried photorec. However, the recovered files do not seem to include the desired file even though I was able to recover a lot of other files.

Are there other things I could try or maybe there is no hope to recover the file at this stage?
Last edited by Eelee2qui8 on 18 May 2020, 16:58, edited 1 time in total.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: File can be listed by testdisk but photorec does not recover the file (LUKS-encrypted ext)

#2 Post by cgrenier »

What is the size of the file copied using TestDisk ? If it's 0, it explained why there is no content (file not "interpretable").
What is the file format of the file PhotoRec failed to recover ? Did you check the file hasn't been moved to the "Thrash" folder or equivalent ?

Eelee2qui8
Posts: 2
Joined: 14 May 2020, 21:41

Re: File can be listed by testdisk but photorec does not recover the file (LUKS-encrypted ext)

#3 Post by Eelee2qui8 »

cgrenier wrote: 15 May 2020, 09:08 What is the size of the file copied using TestDisk ? If it's 0, it explained why there is no content (file not "interpretable").
What is the file format of the file PhotoRec failed to recover ? Did you check the file hasn't been moved to the "Thrash" folder or equivalent ?
Thanks for the reply! The size of the file copied using TestDisk is about 167kB. The file format is jpg. I just check ".local/share/Trash/files" and TestDisk can also find the same deleted file there, but the copied file generated by TestDisk from this location is also corrupted. Actually, it is identical to the copied file from the original directory I tried (Downloads).

Locked