cgsecurity.org

I deleted an encrypted file container with my research files - 400 GB - windows asked if it was a permanent delete and was answered yes.
The intention was to delete an older backup of the exact same file (4 months older).
Both the deleted file and the backup are on separate external hard drives - no writing of any kind is happening on them.
The deleted file was named xyz.pdf (the actual extension may be a .hc ? its a veracrypt file)
Ran photorec, then testdisk_win - nothing shows in the undelete log. Other files, including pdfs show up but not the 400 GB file.

Can anything be done about this?
Yes, its a bad way for me to start Christmas - but am hoping for a silver lining and something good to come out of this - Thanks!

Try TestDisk, Advanced, Undelete.
If it failed, you can try TestCrypt but it's designed to recover lost partition, not lost file. Write down the "partition" location but do not alter the partition table.
What are the results ?

Photorec appeared to ID a PDF file and was on it for a long time - that file was not recovered - probably because of size?
TestDisk -Undelete - 0 files identified for 'undelete'

Recuva Pro - identified an unrecoverable 0 byte pdf file with correct file name of deleted file

EaseUS identified the deleted file instantly as the first file on the list, with correct file name and file size of 400+ GB - paused the scan and recovered the file in around 2-3 hours, happy ending!

(Disk from which file was recovered was a SSD - just for clarity).

Not sure how TestDisk could be tweaked to have EaseUs like large file recovery capability with original file name?

Thanks!

DrJS wrote: 01 Jan 2020, 19:29 Photorec appeared to ID a PDF file and was on it for a long time - that file was not recovered - probably because of size?

Your encrypted Veracrypt file container does not contain any id.

(Disk from which file was recovered was a SSD - just for clarity).

The filesystem involved is important - not the disk type like HDD or SSD.