cgsecurity.org

Well, not actually that. I have made it a habit to always encrypt my data on all drives, and have never had a problem before with it, but I got sideswiped. I have a minimal security concern, but just to be safe, I use veracrypt to ensure if the laptop is stolen, etc. no one can get at the data, at least not easily.

Because my needs in this regard are minimal, I just store a couple of key files on a USB Stick, and typically use one small USB stick as a key for each larger drive of data. The USB stick stores the identifier I use to recognize the correlating hard drive and the veracrypt key files I use to decrypt that drive.

I back them up, but this time, for the first time, I screwed up. I figured I would use linux dot files and store them in the .cache directory, to make them less conspicuous. When I went to back them up the way I normally do, it did not copy the dot files directory and the dot files contained therein. It only backed up my identifier file, and I had been doing it so long, I did not check to ensure they were backed up properly.

The key files were in the .cache directory and named .scache, .tcache, .ucache. All are dot files are stored within a dot file directory. They are quite small, so I was hoping I could get them back, because my simple backup method did not back up the key files in this case, because they were hidden and cp did not copy the hidden directories (I had no need to be tricky with it, so I kick myself for that. Just thought a hidden file would be better and more secure. Now it is secure from me. LOL)

So, the backup was made, but the key files did not get copied to the backup. I later reused the key usb stick thinking the backup secure and because I was short one usb stick. I reformatted the USB stick with the keys on it and then when I went to get my key files from the backup, I realized my error.

Testdisk does not show the key files. It shows something like _CACHE_ and finds some tx? files, but I have no idea how to locate the key files within the quagmire of files photorec recovers.

Is there a way to recover veracrypt key files from a reformatted USB stick?

If not, it was my undoing trying to be more secure for no particular reason. LOL.

Thank you.

Veracrypt key files are probably the same ones as those from Truecrypt.
Obviously they don't contain a fingerprint and won't be found using Photorec.

As you did not describe the deletion process in detail I can only give you the advice to use a commercial recovery tool that is working on the remains of your file system. Depending on the way you formatted the stick such a tool might be able to show you file names.

I had the key files saved on a USB stick independent of the hard drive. I had just introduced the new hard drive to the system. I tried to back up the key files but used cp, which did not copy the files because they were dot files. .cache/.rcache for example. I did not use Truecrypt at all, it was TestDisk that showed one file as _CACHE_. I apologize, that was a typo on my part. I did NOT use truecrypt.

However, the file _CACHE_ that appears in Testdisk does not appear to be anything useful, and there is only one reference to it in TestDisk when I have multiple key files.

i deleted them accidentally by reformatting the USB Stick (thinking I had a sufficient backup) to FAT32. Of course, that deleted all the files, but I was hoping to recover the key files if possible, or all the data on the new hard drive is lost ,and I had not yet had the opportunity to back up the new drive, which I intended to mirror.

You mention commercial recovery, and I am unsure what commercial recovery would recover such files. What commercial product might recover veracrypt generated key files stored as .cache/.rcache (in other words, a key stored as a hidden file in a hidden directory).

Thank you much for your response.

I mentioned Truecrypt because I don't have experience with Veracrypt but Veracrypt is a Truecrypt fork.

Your key file is not supposed to be recognizable unless you used some ordinary file of another file type as key file.
Therefore no recovery software will recognize it based upon its content. If you knew the length of your file, you could try to guess that file when looking at recovered files by Photorec. Unfortunately there is no guarantee that the file will be found nor that it will be recovered with its original length.

Therefore you need another recovery solution that provides you with file names if they are left over from your formatting operation.
You would search your keyfiles by file name then.