truecrypt volumes in a trashed filesystem

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
ganooplusleenuchs
Posts: 2
Joined: 12 Sep 2013, 02:15

truecrypt volumes in a trashed filesystem

#1 Post by ganooplusleenuchs »

ive got a data drive which i managed to wipe out with a stray dd command, and subsequently lost most of the data on there, however ive managed to recover some with photorec thus far, but i had a couple of truecrypt file containers in there with no extension, just the filename.

im not entirely sure as to whether photorec can pull them back up, but if it can how will i spot them? will it automatically add a .tc extension to the files?

and before anyone asks, the filesystem is long gone, a 100mb iso made sure of that, so theres no chance of recovering them that way.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: truecrypt volumes in a trashed filesystem

#2 Post by cgrenier »

A Truecrypt volume is designed to be impossible to distinguish from random data. There is no clear text signature that can be use to recover it.

ganooplusleenuchs
Posts: 2
Joined: 12 Sep 2013, 02:15

Re: truecrypt volumes in a trashed filesystem

#3 Post by ganooplusleenuchs »

even the encrypted file containers? no identifiable info whatsoever?

i hear there are specialist tools that can identify possible volumes though, are they any good?

Locked