cgsecurity.org

Hello everyone. I have a dual boot laptop with Windows 10 and Manjaro Linux. On Manjaro Linux I used the GNOME Disks tool to encrypt a Sandisk 128 gb USB stick. I accidentally formatted this USB stick on Windows 10 (while trying to clean the keyboard).

I installed TestDisk on Manjaro and tried PhotoRec first as most of the files I want to recover are pictures. I specified the recovery path on my home/desktop and not on the USB stick. It didn't work. I only recovered a "report.xml" file a ".luks" file and a ".swf" file.

I tried TestDisk next which is kinda overwhelming. I am not very tech savvy and English is not my main language. The steps I did were:

1. Run and pressed enter.
3. Selected the SanDisk usb stick and pressed proceed.
4. Selected as hinted and then enter.
5. Selected and hit enter.
6. Selected and hit enter. I waited for a few mins for the utility to analyze the cylinders as shown in the above picture: [/img].
7. When the process was done it found a Primary bootable Linux partition. I presssed enter to continue. [/img].
8. I did a deeper search and waited. [/img].
9. When the deeper search ended I was presented with 2 deleted partitions. A Linux one which I am guessing its the partition containing the encryption(password) and a HPFS - NTFS partition which I assume contains the actual pictures. [/img].

How do I proceed from here guys? I am kinda stuck as I dont understand what to do next.

Sorry for the long post and thanks in advance for your help.

You have to decrypt your stick first. Recovery software including Testdisk and Photorec can only work on readible media.

How can I decrypt the USB stick? Its empty. It was formatted. I can open it without asking for a password or something.

Do you have a LUKS header-backup?

Your header might have been destroyed by the format operation.

viewtopic.php?p=30640#p30640

Unfortunately I don't have a LUKS header-backup.

What did you encrypt?
The whole stick or the partition on the stick (assuming there was not more than one partition)?

Its been years but I think I encrypted the whole USB stick.

In this case recovery is impossible.

Please show the first sector of your USB-stick by copying it into a file named "mbr.bin" p.e..

Replace the content of the [] marked areas in the command below, you might have to use the sudo command:
Post the command you used and try to upload this binary file here or link it from the forum.