Data Recovery and Disk Utilities Forum @R-TT

[quote="m8rt1n"]I've read that you give to Truecryptcontainer no chance.
Nevertheless, I want to mention my case here, if there is a possibility at some point to save container.
My Truecryptcontainer is 500GB in a 596 GB external drive.
Everything broke after windows 7 installation / Quikformat. The container was opened.
I have the password and a key file.
With WinHex can I find the name of the drive 179 times. I see a lot of random data.
Data that is not the Truecryptcontainer is located, next, I was able to recover.
If there is anyone who can fix it, please contact with me.
As far as I understand it, it goes about finding the beginning and end of the random data to use the backup at the end of the random data to make a file from the hex and.

If there is interest, I described my case in the Forum
truecrypt (my name: martin567)
computerbase.de (German) (my name: m8rt1n)
Thank you
regards[/quote]
Yours is a quite different story - you've fond the container by analyzing the file system. In this case, yes, it's possible to recover a truecrypt container. The task above is different - finding a truecrypt container by searching its file signature, and there's no such in any truecrypt container.

I've read that you give to Truecryptcontainer no chance.
Nevertheless, I want to mention my case here, if there is a possibility at some point to save container.
My Truecryptcontainer is 500GB in a 596 GB external drive.
Everything broke after windows 7 installation / Quikformat. The container was opened.
I have the password and a key file.
With WinHex can I find the name of the drive 179 times. I see a lot of random data.
Data that is not the Truecryptcontainer is located, next, I was able to recover.
If there is anyone who can fix it, please contact with me.
As far as I understand it, it goes about finding the beginning and end of the random data to use the backup at the end of the random data to make a file from the hex and.

If there is interest, I described my case in the Forum
truecrypt (my name: martin567)
computerbase.de (German) (my name: m8rt1n)
Thank you
regards

Unfortunately, I think so.

So, I have no hope? :( :roll:

The main problem is that truecrypt containers designed in a such way that they don't have any common patterns, so it's impossible to find them using file signatures. Actually, I can't say more without seeing the actual data on the disk.

Its a Raid 1 / Mirror and yes I believe its Ext3.

I had two large *.gho files on a 1.5TB HDD. Photorec pics up a gho file but saves it as a massive 300GB :( And ofcourse it doesnt open :(

:(

What was the RAID? RAID 0/1/5? And what is the file system? Ext3?
And if it was RAID 0/5, why did you remove the disks? Actually, I'd start searching for the file on the assembled RAID volume rather than on one of the disks.

Hi guys,

I'm in deeeep sh*t.

I was setting up an Rsync and managed to delete a large TrueCrypt container called 'whatever.gho' (200GB ish).

As soon as I realised what had happened, around 1minute of deletion, I removed both RAID hard driver (x2) and now I'm using R-Linux for windows on one of the drives to find the *.gho.

The problem is, this file isn't in the know extensions list and once the scan is complete, my file isn't anywhere :(

What do you guys recommend I do? Is there another way / option I need to select?

:(