0

I recently formatted my hard drive in order to install an Ubuntu/Windows dual boot system.

Of course, I made a backup to an external HDD of my Ubuntu home folder (had been using Ubuntu for the last couple of years) using rsync but yesterday I found out that a VeraCrypt volume (no extension) showed a 0 kb file size on my external HDD (I guess something went wrong with rsync and I missed it) so I went and used Photorec with no filetype option to try and recover that file with no success.

So my question is this, how do I define a file size range for the recovery program being Photorec, Foremost or Scalpel as well as a "no extension" option? I do remember the VeraCrypt volume to be between 30-50 GB.

0

Programs like Photorec are reading a media block by block, sector by sector. They are looking for filetype specific signatures and try to collect all blocks regarding to a guessed file.

A VeraCrypt volume consits of a lot of sectors, not mandatory continuous sectors, on the harddisk. All data, including the header / signature, of the container are encrypted and as a result of a well working encryption the data is totaly random. So there is nothing known Photorec can look for or recognize as a part of a VeraCrypt container.

To rescue a lost VeraCrypt container in a manner as Photorec it does, you need a program doing it the way Photorec does but involing your encryption keys in the process. So the program can decrypt each sector of data and look on it if the decrypted result makes any kind of sense and may be the header or another part of a VeraCrypt container.

This would be a very time consuming process and, as far as I know, there is no rescue program publicly available doing it this way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.