Discussions on using the professional data recovery program R-STUDIO for RAID re-construction, NAS recovery, and recovery of various disk and volume managers: Windows storage spaces, Apple volumes, and Linux Logical Volume Manager.
-
hushpeople
- Posts: 3
- Joined: Wed Aug 24, 2011 12:18 pm
Post
by hushpeople » Wed Aug 24, 2011 12:31 pm
Hi guys,
I'm in deeeep sh*t.
I was setting up an Rsync and managed to delete a large TrueCrypt container called 'whatever.gho' (200GB ish).
As soon as I realised what had happened, around 1minute of deletion, I removed both RAID hard driver (x2) and now I'm using R-Linux for windows on one of the drives to find the *.gho.
The problem is, this file isn't in the know extensions list and once the scan is complete, my file isn't anywhere
What do you guys recommend I do? Is there another way / option I need to select?
-
Alt
- Site Moderator
- Posts: 2970
- Joined: Tue Nov 11, 2008 2:13 pm
-
Contact:
Post
by Alt » Thu Aug 25, 2011 2:58 am
What was the RAID? RAID 0/1/5? And what is the file system? Ext3?
And if it was RAID 0/5, why did you remove the disks? Actually, I'd start searching for the file on the assembled RAID volume rather than on one of the disks.
-
hushpeople
- Posts: 3
- Joined: Wed Aug 24, 2011 12:18 pm
Post
by hushpeople » Thu Aug 25, 2011 4:28 pm
Its a Raid 1 / Mirror and yes I believe its Ext3.
I had two large *.gho files on a 1.5TB HDD. Photorec pics up a gho file but saves it as a massive 300GB
And ofcourse it doesnt open
-
Alt
- Site Moderator
- Posts: 2970
- Joined: Tue Nov 11, 2008 2:13 pm
-
Contact:
Post
by Alt » Fri Aug 26, 2011 3:57 am
The main problem is that truecrypt containers designed in a such way that they don't have any common patterns, so it's impossible to find them using file signatures. Actually, I can't say more without seeing the actual data on the disk.
-
Alt
- Site Moderator
- Posts: 2970
- Joined: Tue Nov 11, 2008 2:13 pm
-
Contact:
Post
by Alt » Sat Aug 27, 2011 10:32 am
Unfortunately, I think so.
-
m8rt1n
- Posts: 1
- Joined: Wed Jun 20, 2012 5:59 am
Post
by m8rt1n » Wed Jun 20, 2012 6:22 am
I've read that you give to Truecryptcontainer no chance.
Nevertheless, I want to mention my case here, if there is a possibility at some point to save container.
My Truecryptcontainer is 500GB in a 596 GB external drive.
Everything broke after windows 7 installation / Quikformat. The container was opened.
I have the password and a key file.
With WinHex can I find the name of the drive 179 times. I see a lot of random data.
Data that is not the Truecryptcontainer is located, next, I was able to recover.
If there is anyone who can fix it, please contact with me.
As far as I understand it, it goes about finding the beginning and end of the random data to use the backup at the end of the random data to make a file from the hex and.
If there is interest, I described my case in the Forum
truecrypt (my name: martin567)
computerbase.de (German) (my name: m8rt1n)
Thank you
regards
-
Alt
- Site Moderator
- Posts: 2970
- Joined: Tue Nov 11, 2008 2:13 pm
-
Contact:
Post
by Alt » Thu Jun 21, 2012 8:55 am
m8rt1n wrote:I've read that you give to Truecryptcontainer no chance.
Nevertheless, I want to mention my case here, if there is a possibility at some point to save container.
My Truecryptcontainer is 500GB in a 596 GB external drive.
Everything broke after windows 7 installation / Quikformat. The container was opened.
I have the password and a key file.
With WinHex can I find the name of the drive 179 times. I see a lot of random data.
Data that is not the Truecryptcontainer is located, next, I was able to recover.
If there is anyone who can fix it, please contact with me.
As far as I understand it, it goes about finding the beginning and end of the random data to use the backup at the end of the random data to make a file from the hex and.
If there is interest, I described my case in the Forum
truecrypt (my name: martin567)
computerbase.de (German) (my name: m8rt1n)
Thank you
regards
Yours is a quite different story - you've fond the container by analyzing the file system. In this case, yes, it's possible to recover a truecrypt container. The task above is different - finding a truecrypt container by searching its file signature, and there's no such in any truecrypt container.
