cgsecurity.org

ive got a data drive which i managed to wipe out with a stray dd command, and subsequently lost most of the data on there, however ive managed to recover some with photorec thus far, but i had a couple of truecrypt file containers in there with no extension, just the filename.

im not entirely sure as to whether photorec can pull them back up, but if it can how will i spot them? will it automatically add a .tc extension to the files?

and before anyone asks, the filesystem is long gone, a 100mb iso made sure of that, so theres no chance of recovering them that way.

A Truecrypt volume is designed to be impossible to distinguish from random data. There is no clear text signature that can be use to recover it.

even the encrypted file containers? no identifiable info whatsoever?

i hear there are specialist tools that can identify possible volumes though, are they any good?