Data Recovery Forums - Help & Discussions

pksa · Joined: 10 Sep 2008 Posts: 1

As many users I use encryption software to keep the most valuable files safely. The problem is when the encrypted file gets corrupted. That happened to me.

Precisely. I used TrueCrypt on my SUSE 10.0 to store some information in one encrypted container (in fact one file, I was not a separate partition). Additionally the encrypted file was saved with no extension on EXT3 partition.

One day the partition where the encrypted TrueCrypt file was located crushed. MBR was overwritten and partition information was lost. I tried a couple of tools that claim they can recover EXT3 partitions or files from corrupted EXT3 partitions. First I tried with testdisk and photorec then R-linux, Active Partition Recovery, Easeus Data Recovery Professional, On-track Easy Recovery Pro, Kernel Recovery for Linux and Stellar Phoenix Linux.

I couldn’t recover the entire partition.
I couldn’t recover the encrypted file as well (despite the fact that some other files were recovered).

It seems that these tools cope with files types they know. The list is impressive but is rather limited to typical txt, audio-video, lib ant other typical formats. I guess they don’t understand TrueCrypt files or get mad if the file is too large on the typical extension is faked.

I also tried “manual” repairs of that partition by searching the backup superblock and making the fsck.ext3 by using that superblock. But again – that recovered all the files but not the TrueCrypted volume.

Do you have any idea what I can else do for recovering the encrypted TrueCrypt file?
Do you know any data recovery software that recognize and cope with encrypted TrueCrypt file?
Do you have similar experience?

PS
The corupted partition was on the backup disk - don't ask what happend to the production drive.

HELP,
Thanks in advance.