truecrypt volumes in a trashed filesystem

Using PhotoRec to recover lost data
Post Reply
Message
Author
ganooplusleenuchs
Posts: 2
Joined: 12 Sep 2013, 02:15

truecrypt volumes in a trashed filesystem

#1 Post by ganooplusleenuchs » 12 Sep 2013, 02:22

ive got a data drive which i managed to wipe out with a stray dd command, and subsequently lost most of the data on there, however ive managed to recover some with photorec thus far, but i had a couple of truecrypt file containers in there with no extension, just the filename.

im not entirely sure as to whether photorec can pull them back up, but if it can how will i spot them? will it automatically add a .tc extension to the files?

and before anyone asks, the filesystem is long gone, a 100mb iso made sure of that, so theres no chance of recovering them that way.

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 3697
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: truecrypt volumes in a trashed filesystem

#2 Post by cgrenier » 12 Sep 2013, 08:40

A Truecrypt volume is designed to be impossible to distinguish from random data. There is no clear text signature that can be use to recover it.

ganooplusleenuchs
Posts: 2
Joined: 12 Sep 2013, 02:15

Re: truecrypt volumes in a trashed filesystem

#3 Post by ganooplusleenuchs » 12 Sep 2013, 16:57

even the encrypted file containers? no identifiable info whatsoever?

i hear there are specialist tools that can identify possible volumes though, are they any good?

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests