cgsecurity.org

Hi there,

i'm quite new to testdisk and have used it a couple times to rebuild disk partitions and recover data from failed drives however recently we've had encyption software installed across all laptops in use.

Since then i've had one fail on me and with the encyption there i don't see a way anymore to access the drive.

i'm quite new to the software so i may be missing something but is there any way to get past the encryption and still recover the lost data?

Thanks.

If the encrypted filesystem isn't damaged, you can use TestDisk, select the logical drive (ie. D:), partition type: None, Advanced, Undelete to recover the deleted file.

If the filesystem is ok and the encryption is done file by file, it may be possible to recover the encrypted file using PhotoRec, PhotoRec already supports OpenPGP/GNUPG, eCryptfs.

If the filesystem is damaged and the encryption is done on the whole filesystem, after unlocking the volume with your passphrase, try
- TestDisk, select the logical drive (ie. D:), partition type: None, Advanced, List.
- PhotoRec, remember to select the logical drive