Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Recover Deleted Encrypted Volume Question


  • Please log in to reply
6 replies to this topic

#1 chiiibill

chiiibill

  • Members
  • 178 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:20 PM

Posted 05 March 2018 - 04:16 PM

Bad month here. First corrupted flash drive, now accidental deletion of  multi-gig encrypted (Veracrypt) container on backup drive.

 

Was wondering what novice-friendly software people have had success with:

 

Was thinking of trying Stellar but also considering Recuva Pro, Disk Drill, EaseUS, MiniTool.

 

Any of them retain the original folder names? How does it read an encrypted volume?

 

Drive hasn't been used so should be available.

 

Is deep scan always recommended (5 hrs. here)?

 

I guess I should have asked first -can a deleted encrypted drive be recovered?

 

Thanks


Edited by chiiibill, 05 March 2018 - 04:48 PM.


BC AdBot (Login to Remove)

 


#2 JohnC_21

JohnC_21

  • Members
  • 24,448 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:20 PM

Posted 05 March 2018 - 04:50 PM

Testdisk can undelete files but as with any recovery software the file should be recovered to a different HDD. Do not recover back to the same drive. Testdisk does not require a deep scan either. Whatever you do, do not allow writes on the hard drive with the encrypted file. 

 

https://www.cgsecurity.org/wiki/Undelete_files_from_NTFS_with_TestDisk

 

Download Testdisk and unzip the file to the HDD you will be recovering the encrypted file to. Start Testdisk from that HDD. The recovery will default to the unzipped folder of Testdisk.



#3 chiiibill

chiiibill
  • Topic Starter

  • Members
  • 178 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:20 PM

Posted 05 March 2018 - 04:57 PM

Thanks for the reply!

 

 

Will try it tonight and provide feedback.



#4 JohnC_21

JohnC_21

  • Members
  • 24,448 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:20 PM

Posted 05 March 2018 - 05:10 PM

The new version may be different. It's been awhile but it may be List under the Advanced Menu instead of undelete.

 

Undelete is available under Advanced as well as List.


Edited by JohnC_21, 05 March 2018 - 05:13 PM.


#5 chiiibill

chiiibill
  • Topic Starter

  • Members
  • 178 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:20 PM

Posted 05 March 2018 - 09:06 PM

Ok, took a few minutes to get the hang of the command line, creating destination but figured it out.

 

Ran TestDisk, but only a fraction of the 60g were in destination folder. All the photo folders, application folders and most document folders did not. Not sure why.  Is Encryption an issue (if not, it would appear to be a way to bypass encryption).

 

Backup drive has not been used since delete. Any suggestions?

 

Thanks

 

EDIT: Being a novice, I'm not sure if relevant but the container, although only partially used, was a 1T -sized container on a 2T backup drive.


Edited by chiiibill, 05 March 2018 - 09:14 PM.


#6 JohnC_21

JohnC_21

  • Members
  • 24,448 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:20 PM

Posted 05 March 2018 - 09:16 PM

Because this is an encrypted volume recovery may be difficult. I believe the way Easeus and Minitools works during a scan is by checking for specific extensions and there headers. Because this is an encrypted container recovery may not be successful.

 

Did this container have a file extension attached to it? If yes you could use PhotoRec, part of Testdisk and select the extension it used in the file options screen. PhotoRec will pick up all files with the same extension in real time. The names will be generic but you will only need to select the one that is GBs in size. Otherwise I think your next step is to scan the drive with either Easeus or Minitools. 



#7 chiiibill

chiiibill
  • Topic Starter

  • Members
  • 178 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:20 PM

Posted 05 March 2018 - 09:56 PM

No extension.  Will try Easeus next.

 

Will keep TestDisk for future use, though.

 

Thanks






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users