cgsecurity.org

Hello everyone,

I have accidently deleted my kdbx file. Only tool which is able to find remnants of it is PhotoRec.
However when I enable all file types, app is not able to find my file, while selecting only kdb and kdbx, app is able to get file but it is huge in size and my disk is not sufficient for it.

Any workaround?

Thank you in advance.

Do not store new files on the source filesystem.

[...
PhotoRec doesn't know the correct filesize of kdb and kdnx files, so
it only stops the recovery when a new file is found. Try to keep more
file famillies enabled (ie. kdb, kdnx, jpg) ...]

Another possibility would be to extract it yourself manually with a hexadecimal editor, knowing what the beginning of a valid file looks like, and what size the wanted file was approximately.
But Photorec should be reserved for those special situations where files can no longer be recovered through the analysis of the filesystem. If it's still referenced within the filesystem, other tools should be able to recover it easily and efficiently, without parsing the whole partition, even if it was fragmented (with fragmented files, Photorec's recovery will be mediocre at best, and only very advanced “raw file carving” utilities are supposedly better at it). Of course each time a new file is written onto the same partition, the odds of a successful recovery dwindle a bit more...