I have an old laptop that runs Ubuntu. Its partition was full so I tried to extend it.
In a moment of idiocy, I deleted the primary partition. I thought all my files were backed up, so I just re-installed Ubuntu using the whole disk (the rest of it had Windows at one point I think).
Well, turns out that my Keepass password file was not synched up. I pulled the disk out of the laptop and connected it via USB to my deskop and ran PhotoRec on it.
I attempted recovery on the whole disk, using default options, and only selecting the 2 Keepass file extensions (kdb, and kdbx)
I have 17 recovered files, varying in size from a bit over 100 KB to about 37GB. The original file is around 10KB.
I have a couple of other password DBs that are ~ 100KB each.
The versions of the password DB file I need vary in size between ~ 100KB to about 300MB
I'm trying to figure out why the file sizes vary so much, when they are almost identical?
Some of the very large files that were recovered (10s of GB) are unreadable.
Is there anything I can do beyond the basics that can help in this situation? I have the outdated version of the password file if that matters.
I'm running in expert mode (no paranoid, not keeping corrupt files) and it asked me if it should attempt to unformat FAT. I assume this is because the file system is mounted?
I read in the step by step guide that I should select the smallest block size possible, so I selected 512.
Now I see a bunch of i_node directories, and a number of different files in them, not only .kdbx ones, even though that's the only file extension selected in the file options?
Finally, is "brute force" only for JPEGs?
Recover a kdbx file
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
recuperation
- Posts: 2760
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Recover a kdbx file
Please rerun PhotoRec with all other file types selected to see if the file size of your password databases shrinks.
Re: Recover a kdbx file
Re-running now with Paranoid (brute force enabled), Expert Mode: No, Keep Corrupted Files: Yes and All file types enabled.
I'm seeing a bunch of recup_dir.<num> being created with a bunch of different files in them. Will report if the files shrink. Do you suspect a bug?
Also, when in expert mode, it seems that the file options are being dis-regarded?
I'm seeing a bunch of recup_dir.<num> being created with a bunch of different files in them. Will report if the files shrink. Do you suspect a bug?
Also, when in expert mode, it seems that the file options are being dis-regarded?
Re: Recover a kdbx file
When I run with all file types enabled, the size of the recovered files is much more reasonable.
It still appears slightly over the expected size but it's much closer in size.
However, I still notice slight file size growth.
In my case, I have a file that periodically changes slightly. Photorec recovers, say, 8 version of that file.
Version 1 is just about the expected size. Version 2 is slightly bigger. Version 3 is slighly bigger, and so forth.
In my case the expected file size is 7.8KB
Recovered file sizes are : 12.3 KB, 49.2 KB, 53.2 KB, 57.3 KB, 81.9 KB, 159.7 KB, 335.9 KB, 555.7 KB
The files are still valid and I can open them.
It still appears slightly over the expected size but it's much closer in size.
However, I still notice slight file size growth.
In my case, I have a file that periodically changes slightly. Photorec recovers, say, 8 version of that file.
Version 1 is just about the expected size. Version 2 is slightly bigger. Version 3 is slighly bigger, and so forth.
In my case the expected file size is 7.8KB
Recovered file sizes are : 12.3 KB, 49.2 KB, 53.2 KB, 57.3 KB, 81.9 KB, 159.7 KB, 335.9 KB, 555.7 KB
The files are still valid and I can open them.
-
recuperation
- Posts: 2760
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Recover a kdbx file
Enabling the other families tends to shorten the file because PhotoRec stops when it hits another file signature which will close the current file in recovery.
Re: Recover a kdbx file
Isn't that a bug?
I would expect photorec to do that regardless. The only difference should be that files with extensions that are not selected are not saved.
I would expect photorec to do that regardless. The only difference should be that files with extensions that are not selected are not saved.
-
recuperation
- Posts: 2760
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Recover a kdbx file
If PhotoRec worked like you proposed, any known file signature that in reality is not a file signature but represents pure data within another file with a different type would have the current file being finalized.
Doing it your way there would be no way to prevent this behaviour.
Doing it your way there would be no way to prevent this behaviour.