I've recovered a disk image from an otherwise healthy drive, which seems to not have a partition table any more. See this post on my efforts to recover the partition table using testdisk:
http://forum.cgsecurity.org/phpBB3/part ... t5214.html
Are these files evidence of something like CryptoLocker? Are they actually gpg ecrypted files, the file utility shows:
file *.gpg
f128093110.gpg: data
f184042821.gpg: data
f188446262.gpg: data
f238766711.gpg: DOS executable (COM)
f259167392.gpg: data
f270716979.gpg: DOS executable (COM)
f39858524.gpg: DOS executable (COM)
f93701561.gpg: data
Thanks.
PS: I'm using PhotoRec 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Version: 6.13
Compiler: GCC 4.6
Compilation date: 2012-01-17T14:04:23
ext2fs lib: 1.42.5, ntfs lib: 10:0:0, ewf lib: none, libjpeg: 80
OS: Linux, kernel 3.16.0-0.bpo.4-amd64 (#1 SMP Debian 3.16.7-ckt11-1~bpo70+1 (2015-06-08)) x86_64
PhotoRec produced several large .gpg files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Re: PhotoRec produced several large .gpg files
I have had a case like yours but it was a CCTV HDD.
I have used photorec to recover the date and it works fine until I found myself stuccoed with 189gb "gpg" file. I've tried every possible way to open it but nothing works!
Until I've decided to change the file extension from "gpg" to "mov" ==> I choose "mov", because I know cctv would only contain a media format with such big file.
Try to change the extension maybe it will work with you as well.
Best of luck,,
I have used photorec to recover the date and it works fine until I found myself stuccoed with 189gb "gpg" file. I've tried every possible way to open it but nothing works!
Until I've decided to change the file extension from "gpg" to "mov" ==> I choose "mov", because I know cctv would only contain a media format with such big file.
Try to change the extension maybe it will work with you as well.
Best of luck,,