I deleted an encrypted file container with my research files - 400 GB - windows asked if it was a permanent delete and was answered yes.
The intention was to delete an older backup of the exact same file (4 months older).
Both the deleted file and the backup are on separate external hard drives - no writing of any kind is happening on them.
The deleted file was named xyz.pdf (the actual extension may be a .hc ? its a veracrypt file)
Ran photorec, then testdisk_win - nothing shows in the undelete log. Other files, including pdfs show up but not the 400 GB file.
Can anything be done about this?
Yes, its a bad way for me to start Christmas - but am hoping for a silver lining and something good to come out of this - Thanks!
Encrypted file undelete
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
cgrenier
- Site Admin
- Posts: 5432
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: Encrypted file undelete
Try TestDisk, Advanced, Undelete.
If it failed, you can try TestCrypt but it's designed to recover lost partition, not lost file. Write down the "partition" location but do not alter the partition table.
What are the results ?
If it failed, you can try TestCrypt but it's designed to recover lost partition, not lost file. Write down the "partition" location but do not alter the partition table.
What are the results ?
Re: Encrypted file undelete
Photorec appeared to ID a PDF file and was on it for a long time - that file was not recovered - probably because of size?
TestDisk -Undelete - 0 files identified for 'undelete'
Recuva Pro - identified an unrecoverable 0 byte pdf file with correct file name of deleted file
EaseUS identified the deleted file instantly as the first file on the list, with correct file name and file size of 400+ GB - paused the scan and recovered the file in around 2-3 hours, happy ending!
(Disk from which file was recovered was a SSD - just for clarity).
Not sure how TestDisk could be tweaked to have EaseUs like large file recovery capability with original file name?
Thanks!
TestDisk -Undelete - 0 files identified for 'undelete'
Recuva Pro - identified an unrecoverable 0 byte pdf file with correct file name of deleted file
EaseUS identified the deleted file instantly as the first file on the list, with correct file name and file size of 400+ GB - paused the scan and recovered the file in around 2-3 hours, happy ending!
(Disk from which file was recovered was a SSD - just for clarity).
Not sure how TestDisk could be tweaked to have EaseUs like large file recovery capability with original file name?
Thanks!
-
recuperation
- Posts: 2735
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Encrypted file undelete
Your encrypted Veracrypt file container does not contain any id.
The filesystem involved is important - not the disk type like HDD or SSD.(Disk from which file was recovered was a SSD - just for clarity).