Qnap NAS - Lost *.GHO - True Crypt

Discussions on using the professional data recovery program R-STUDIO for RAID re-construction, NAS recovery, and recovery of various disk and volume managers: Windows storage spaces, Apple volumes, and Linux Logical Volume Manager.
hushpeople
Posts: 3
Joined: Wed Aug 24, 2011 12:18 pm

Qnap NAS - Lost *.GHO - True Crypt

Post by hushpeople » Wed Aug 24, 2011 12:31 pm

Hi guys,

I'm in deeeep sh*t.

I was setting up an Rsync and managed to delete a large TrueCrypt container called 'whatever.gho' (200GB ish).

As soon as I realised what had happened, around 1minute of deletion, I removed both RAID hard driver (x2) and now I'm using R-Linux for windows on one of the drives to find the *.gho.

The problem is, this file isn't in the know extensions list and once the scan is complete, my file isn't anywhere :(

What do you guys recommend I do? Is there another way / option I need to select?

:(

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Qnap NAS - Lost *.GHO - True Crypt

Post by Alt » Thu Aug 25, 2011 2:58 am

What was the RAID? RAID 0/1/5? And what is the file system? Ext3?
And if it was RAID 0/5, why did you remove the disks? Actually, I'd start searching for the file on the assembled RAID volume rather than on one of the disks.

hushpeople
Posts: 3
Joined: Wed Aug 24, 2011 12:18 pm

Re: Qnap NAS - Lost *.GHO - True Crypt

Post by hushpeople » Thu Aug 25, 2011 4:28 pm

Its a Raid 1 / Mirror and yes I believe its Ext3.

I had two large *.gho files on a 1.5TB HDD. Photorec pics up a gho file but saves it as a massive 300GB :( And ofcourse it doesnt open :(

:(

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Qnap NAS - Lost *.GHO - True Crypt

Post by Alt » Fri Aug 26, 2011 3:57 am

The main problem is that truecrypt containers designed in a such way that they don't have any common patterns, so it's impossible to find them using file signatures. Actually, I can't say more without seeing the actual data on the disk.

hushpeople
Posts: 3
Joined: Wed Aug 24, 2011 12:18 pm

Re: Qnap NAS - Lost *.GHO - True Crypt

Post by hushpeople » Sat Aug 27, 2011 8:56 am

So, I have no hope? :( :roll:

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Qnap NAS - Lost *.GHO - True Crypt

Post by Alt » Sat Aug 27, 2011 10:32 am

Unfortunately, I think so.

m8rt1n
Posts: 1
Joined: Wed Jun 20, 2012 5:59 am

Lost TrueCrypt Container USB external 500GB

Post by m8rt1n » Wed Jun 20, 2012 6:22 am

I've read that you give to Truecryptcontainer no chance.
Nevertheless, I want to mention my case here, if there is a possibility at some point to save container.
My Truecryptcontainer is 500GB in a 596 GB external drive.
Everything broke after windows 7 installation / Quikformat. The container was opened.
I have the password and a key file.
With WinHex can I find the name of the drive 179 times. I see a lot of random data.
Data that is not the Truecryptcontainer is located, next, I was able to recover.
If there is anyone who can fix it, please contact with me.
As far as I understand it, it goes about finding the beginning and end of the random data to use the backup at the end of the random data to make a file from the hex and.

If there is interest, I described my case in the Forum
truecrypt (my name: martin567)
computerbase.de (German) (my name: m8rt1n)
Thank you
regards

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Lost TrueCrypt Container USB external 500GB

Post by Alt » Thu Jun 21, 2012 8:55 am

m8rt1n wrote:I've read that you give to Truecryptcontainer no chance.
Nevertheless, I want to mention my case here, if there is a possibility at some point to save container.
My Truecryptcontainer is 500GB in a 596 GB external drive.
Everything broke after windows 7 installation / Quikformat. The container was opened.
I have the password and a key file.
With WinHex can I find the name of the drive 179 times. I see a lot of random data.
Data that is not the Truecryptcontainer is located, next, I was able to recover.
If there is anyone who can fix it, please contact with me.
As far as I understand it, it goes about finding the beginning and end of the random data to use the backup at the end of the random data to make a file from the hex and.

If there is interest, I described my case in the Forum
truecrypt (my name: martin567)
computerbase.de (German) (my name: m8rt1n)
Thank you
regards
Yours is a quite different story - you've fond the container by analyzing the file system. In this case, yes, it's possible to recover a truecrypt container. The task above is different - finding a truecrypt container by searching its file signature, and there's no such in any truecrypt container.

Post Reply