Deleted truecrypt file with command "rm"

Using TestDisk to undelete files
Post Reply
Message
Author
marek170356
Posts: 2
Joined: 08 Mar 2015, 10:37

Deleted truecrypt file with command "rm"

#1 Post by marek170356 » 08 Mar 2015, 10:58

Hello all!

First posting here!

I have two Macs: one Laptop one iMac - yes yes the 5K one :)

I am keeping both computers up to date with a shell script and the command "rsync" except some truecrypt files, which I need to sync manually. And one day the mischief happened: I deleted the new one on my laptop, instead the old one on my iMac with the command "rm" in the shell. I was expecting this error, since I have my iMac ...

I have still the (old) truecrypt file on my iMac. Consequently I know the "Name" of the lost file and the size (12GB). How to recover the deleted truecrypt file on my Laptop? I lost two weeks of work :-( Good News: in my Laptop is plenty of space left (923GB with used 338GB). Bad news: there is a small SSD for often used files (System etc). But I think the truecrypt file was on the harddisk ...

Any help?


Best greetings from Munich


marek

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 3497
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Deleted truecrypt file with command "rm"

#2 Post by cgrenier » 09 Mar 2015, 07:52

Truecrypt files have no signature. Truecrypt container can't be undelete.
Sorry

marek170356
Posts: 2
Joined: 08 Mar 2015, 10:37

Re: Deleted truecrypt file with command "rm"

#3 Post by marek170356 » 10 Mar 2015, 07:00

Thank you for your kind reply!

I thought perhaps, that the following procedure would be possible: Take the last binary lines of the old truecrypt file (Backup) with the command "tail" search the whole HD for this snippet. Once when found calc 12 GB back, or search the beginning of the binary file like before the ending. Save all this from beginning to end and save it ... In a truecrypt file there seems to be the headers at the end. They should be invariable.

I am only naive computer user and I am unable to describe it in good English, what I mean.

En tous les cas, Cher Christophe, j'admire infiniment vos connaissances extraordinaires!

marek

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests