Deleted truecrypt file with command "rm"

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read
Posts: 2
Joined: 08 Mar 2015, 10:37

Deleted truecrypt file with command "rm"

#1 Post by marek170356 »

Hello all!

First posting here!

I have two Macs: one Laptop one iMac - yes yes the 5K one :)

I am keeping both computers up to date with a shell script and the command "rsync" except some truecrypt files, which I need to sync manually. And one day the mischief happened: I deleted the new one on my laptop, instead the old one on my iMac with the command "rm" in the shell. I was expecting this error, since I have my iMac ...

I have still the (old) truecrypt file on my iMac. Consequently I know the "Name" of the lost file and the size (12GB). How to recover the deleted truecrypt file on my Laptop? I lost two weeks of work :-( Good News: in my Laptop is plenty of space left (923GB with used 338GB). Bad news: there is a small SSD for often used files (System etc). But I think the truecrypt file was on the harddisk ...

Any help?

Best greetings from Munich


User avatar
Site Admin
Posts: 5434
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France

Re: Deleted truecrypt file with command "rm"

#2 Post by cgrenier »

Truecrypt files have no signature. Truecrypt container can't be undelete.

Posts: 2
Joined: 08 Mar 2015, 10:37

Re: Deleted truecrypt file with command "rm"

#3 Post by marek170356 »

Thank you for your kind reply!

I thought perhaps, that the following procedure would be possible: Take the last binary lines of the old truecrypt file (Backup) with the command "tail" search the whole HD for this snippet. Once when found calc 12 GB back, or search the beginning of the binary file like before the ending. Save all this from beginning to end and save it ... In a truecrypt file there seems to be the headers at the end. They should be invariable.

I am only naive computer user and I am unable to describe it in good English, what I mean.

En tous les cas, Cher Christophe, j'admire infiniment vos connaissances extraordinaires!