Page 1 of 1

Qnap NAS - Lost *.GHO - True Crypt

Posted: Wed Aug 24, 2011 12:31 pm
by hushpeople
Hi guys,

I'm in deeeep sh*t.

I was setting up an Rsync and managed to delete a large TrueCrypt container called 'whatever.gho' (200GB ish).

As soon as I realised what had happened, around 1minute of deletion, I removed both RAID hard driver (x2) and now I'm using R-Linux for windows on one of the drives to find the *.gho.

The problem is, this file isn't in the know extensions list and once the scan is complete, my file isn't anywhere :(

What do you guys recommend I do? Is there another way / option I need to select?

:(

Re: Qnap NAS - Lost *.GHO - True Crypt

Posted: Thu Aug 25, 2011 2:58 am
by Alt
What was the RAID? RAID 0/1/5? And what is the file system? Ext3?
And if it was RAID 0/5, why did you remove the disks? Actually, I'd start searching for the file on the assembled RAID volume rather than on one of the disks.

Re: Qnap NAS - Lost *.GHO - True Crypt

Posted: Thu Aug 25, 2011 4:28 pm
by hushpeople
Its a Raid 1 / Mirror and yes I believe its Ext3.

I had two large *.gho files on a 1.5TB HDD. Photorec pics up a gho file but saves it as a massive 300GB :( And ofcourse it doesnt open :(

:(

Re: Qnap NAS - Lost *.GHO - True Crypt

Posted: Fri Aug 26, 2011 3:57 am
by Alt
The main problem is that truecrypt containers designed in a such way that they don't have any common patterns, so it's impossible to find them using file signatures. Actually, I can't say more without seeing the actual data on the disk.

Re: Qnap NAS - Lost *.GHO - True Crypt

Posted: Sat Aug 27, 2011 8:56 am
by hushpeople
So, I have no hope? :( :roll:

Re: Qnap NAS - Lost *.GHO - True Crypt

Posted: Sat Aug 27, 2011 10:32 am
by Alt
Unfortunately, I think so.

Lost TrueCrypt Container USB external 500GB

Posted: Wed Jun 20, 2012 6:22 am
by m8rt1n
I've read that you give to Truecryptcontainer no chance.
Nevertheless, I want to mention my case here, if there is a possibility at some point to save container.
My Truecryptcontainer is 500GB in a 596 GB external drive.
Everything broke after windows 7 installation / Quikformat. The container was opened.
I have the password and a key file.
With WinHex can I find the name of the drive 179 times. I see a lot of random data.
Data that is not the Truecryptcontainer is located, next, I was able to recover.
If there is anyone who can fix it, please contact with me.
As far as I understand it, it goes about finding the beginning and end of the random data to use the backup at the end of the random data to make a file from the hex and.

If there is interest, I described my case in the Forum
truecrypt (my name: martin567)
computerbase.de (German) (my name: m8rt1n)
Thank you
regards

Re: Lost TrueCrypt Container USB external 500GB

Posted: Thu Jun 21, 2012 8:55 am
by Alt
m8rt1n wrote:I've read that you give to Truecryptcontainer no chance.
Nevertheless, I want to mention my case here, if there is a possibility at some point to save container.
My Truecryptcontainer is 500GB in a 596 GB external drive.
Everything broke after windows 7 installation / Quikformat. The container was opened.
I have the password and a key file.
With WinHex can I find the name of the drive 179 times. I see a lot of random data.
Data that is not the Truecryptcontainer is located, next, I was able to recover.
If there is anyone who can fix it, please contact with me.
As far as I understand it, it goes about finding the beginning and end of the random data to use the backup at the end of the random data to make a file from the hex and.

If there is interest, I described my case in the Forum
truecrypt (my name: martin567)
computerbase.de (German) (my name: m8rt1n)
Thank you
regards
Yours is a quite different story - you've fond the container by analyzing the file system. In this case, yes, it's possible to recover a truecrypt container. The task above is different - finding a truecrypt container by searching its file signature, and there's no such in any truecrypt container.