1

I've got a partition that is encrypted using VeraCrypt. I accidentally deleted some files and would like to recover them. The main problem is that tools like ntfsundelete require a device to work. But there is only a device inode like /dev/mapper/veracrypt1 as long as the device is mounted in VeraCrypt. I cannot access this device inode because it's "already opened exclusively", probably by VeraCrypt.

How can I undelete the files? The actual data should still be there... hopefully.

12
  • 1
    why is this tagged ntfs? if this is on an ntfs filesystem... use windows.
    – Rinzwind
    Sep 15, 2016 at 18:33
  • Related: veracrypt.codeplex.com/wikipage?title=FAQ
    – Elder Geek
    Sep 15, 2016 at 18:35
  • 1
    @ElderGeek I'm not sure how this would help me. I don't have any problems mounting the VeraCrypt container/partition. I've accidentally deleted files that resided inside the container.
    – SeveQ
    Sep 15, 2016 at 18:37
  • @Rinzwind It actually is a Windows partition, yes. I've resorted to Linux in a twinge of panic because all I could think of was to mount the device read only. Didn't think about that VeraCrypt can do that itself. Yes, I'll try it again on Windows and see if I can recover the files there.
    – SeveQ
    Sep 15, 2016 at 18:40
  • I thought perhaps the developers of the software would be most likely to be able to answer your question. I apologize if you saw no value in that.
    – Elder Geek
    Sep 15, 2016 at 18:42

1 Answer 1

0

Unfortunately, I had to give up on the remaining deleted files. About 75% were irreversibly lost, no trace of them left on the volume. Not the end of the world, but still a nuisance. Anyway, some files could be restored by using a tool named Recuva. I can recommend it! Just pay attention to what you install alongside. It might come with some adware.

5
  • "No trace of them on the volume" is based on what kind of analysis? Sep 18, 2016 at 10:27
  • Deep scan of Recuva. I'm not sure how it works in detail.
    – SeveQ
    Sep 18, 2016 at 10:30
  • That looks like a file carver. I would recommend running a full scan with RecuperaBit (or similar commercial tools like DMDE or Restorer Ultimate Pro) before saying "irreversibly lost". :P Sep 18, 2016 at 12:00
  • Hmm... Not necessary anymore. I've already accepted that they are gone. They weren't that important that it would justify actually buying some commercial recovery tool. But for the next time that this happens, I'll try to memorize your advice. Thanks!
    – SeveQ
    Sep 18, 2016 at 12:38
  • Sure, that's why I said either use the open source RecuperaBit or a commercial tool. :P Anyway keep in mind that you can accept your own answer after a while, or you can also decide to close your question if you feel so. Sep 18, 2016 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.