Recovering files from an encrypted drive

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
SEOjoe
Posts: 1
Joined: 10 Oct 2012, 11:07

Recovering files from an encrypted drive

#1 Post by SEOjoe »

Hi there,

i'm quite new to testdisk and have used it a couple times to rebuild disk partitions and recover data from failed drives however recently we've had encyption software installed across all laptops in use.

Since then i've had one fail on me and with the encyption there i don't see a way anymore to access the drive.

i'm quite new to the software so i may be missing something but is there any way to get past the encryption and still recover the lost data?

Thanks.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovering files from an encrypted drive

#2 Post by cgrenier »

If the encrypted filesystem isn't damaged, you can use TestDisk, select the logical drive (ie. D:), partition type: None, Advanced, Undelete to recover the deleted file.

If the filesystem is ok and the encryption is done file by file, it may be possible to recover the encrypted file using PhotoRec, PhotoRec already supports OpenPGP/GNUPG, eCryptfs.

If the filesystem is damaged and the encryption is done on the whole filesystem, after unlocking the volume with your passphrase, try
- TestDisk, select the logical drive (ie. D:), partition type: None, Advanced, List.
- PhotoRec, remember to select the logical drive

Locked