Discussions on using the professional data recovery program R-STUDIO for RAID re-construction, NAS recovery, and recovery of various disk and volume managers: Windows storage spaces, Apple volumes, and Linux Logical Volume Manager.
I was setting up an Rsync and managed to delete a large TrueCrypt container called 'whatever.gho' (200GB ish).
As soon as I realised what had happened, around 1minute of deletion, I removed both RAID hard driver (x2) and now I'm using R-Linux for windows on one of the drives to find the *.gho.
The problem is, this file isn't in the know extensions list and once the scan is complete, my file isn't anywhere
What do you guys recommend I do? Is there another way / option I need to select?
What was the RAID? RAID 0/1/5? And what is the file system? Ext3?
And if it was RAID 0/5, why did you remove the disks? Actually, I'd start searching for the file on the assembled RAID volume rather than on one of the disks.
The main problem is that truecrypt containers designed in a such way that they don't have any common patterns, so it's impossible to find them using file signatures. Actually, I can't say more without seeing the actual data on the disk.
I've read that you give to Truecryptcontainer no chance.
Nevertheless, I want to mention my case here, if there is a possibility at some point to save container.
My Truecryptcontainer is 500GB in a 596 GB external drive.
Everything broke after windows 7 installation / Quikformat. The container was opened.
I have the password and a key file.
With WinHex can I find the name of the drive 179 times. I see a lot of random data.
Data that is not the Truecryptcontainer is located, next, I was able to recover.
If there is anyone who can fix it, please contact with me.
As far as I understand it, it goes about finding the beginning and end of the random data to use the backup at the end of the random data to make a file from the hex and.
If there is interest, I described my case in the Forum
truecrypt (my name: martin567)
computerbase.de (German) (my name: m8rt1n)
Thank you
regards
m8rt1n wrote:I've read that you give to Truecryptcontainer no chance.
Nevertheless, I want to mention my case here, if there is a possibility at some point to save container.
My Truecryptcontainer is 500GB in a 596 GB external drive.
Everything broke after windows 7 installation / Quikformat. The container was opened.
I have the password and a key file.
With WinHex can I find the name of the drive 179 times. I see a lot of random data.
Data that is not the Truecryptcontainer is located, next, I was able to recover.
If there is anyone who can fix it, please contact with me.
As far as I understand it, it goes about finding the beginning and end of the random data to use the backup at the end of the random data to make a file from the hex and.
If there is interest, I described my case in the Forum
truecrypt (my name: martin567)
computerbase.de (German) (my name: m8rt1n)
Thank you
regards
Yours is a quite different story - you've fond the container by analyzing the file system. In this case, yes, it's possible to recover a truecrypt container. The task above is different - finding a truecrypt container by searching its file signature, and there's no such in any truecrypt container.
