Recovering deleted Truecrypt container?

Discussion in 'privacy technology' started by jagomai, Apr 5, 2008.

Thread Status:
Not open for further replies.
  1. jagomai

    jagomai Registered Member

    Joined:
    Apr 5, 2008
    Posts:
    1
    Hey all,

    I've accidentally deleted a Truecrypt container.

    I've successfully recovered it, and I can mount it with the correct password (only).
    However, the contents of the file is garbled junk...

    I've tried to recover it with different free and professional recovery programs, and all yield the same result..

    Anybody have an idea? Is it impossible to recover a deleted Truecrypt container?
     
  2. n8chavez

    n8chavez Registered Member

    Joined:
    Jul 19, 2003
    Posts:
    2,305
    Location:
    Location Unknown
    I believe it is, yes. Sorry, but I think you're SOL on this one.

    My guess would be that you haven't successfully restored the file then, else there would be no issue. That does me that it might be possible. But given that you've tried more than ore recovery product, like I said, I don't think it's possible.

    Just as a word of advice, next time you should try creating a TC partition, that way this cannot happen again.
     
  3. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    994
    Location:
    Hawaii
    Yes, you can definitely recover a TrueCrypt container, often intact. It's merely a file, like any other. If a container file is deleted and is subsequently recovered before it becomes overwritten then there is often no damage at all.

    You mentioned that you can use your password to mount the volume, and this tells me that the volume header is intact. This is a very good start. However, it sounds as though the container file may have been partially overwritten while it was in free space, possibly damaging the filesystem. Another possibility is that the file was already fragmented when you deleted it, and you may not have recovered all the fragments.

    You say the contents is "garbled junk". Please indicate what program you are using to view the contents. (A hex editor?) Also, what data recovery tools have you tried? Many have reported good results using GetDataBack by runtime.org.
     
Loading...
Thread Status:
Not open for further replies.