Encrypted File Recovery

[garin94]

Hey all, basically my friend has a problem.
There was a file on her D drive which was being mounted with Truecrypt to her U drive. The PC then got imaged (wiped C and D in the process) and the file didn't get backed up because it was running in the background even though truecrypt was closed.
Now, only the old file (when she first received the file) can be found but is obviously missing work.
She has a working key. Any suggestions?
Thanks

[peterb]

depends on how the d drive was wiped. It it was securely eiped (ie, every location over written) then no chance.

Otherwise conventionsal file recovery methods may work, given that the contents cannot be seen.. However, partial recovery may not be enough, but you would need to understand how the encryption algorithm works.

I'm surprised the imzging didn't image the open file, unless the new data was added after the file was imaged, but before it was removed.

Good luck.

[garin94]

The D drive was wiped securely I believe. The file typically should have been consistently backed up on the server but as she NEVER shuts down, just locks/logs off, then it may not have recognized it as an updated file, therefore not backed up. Although, she must have shut it off once since September but who knows..

I think I'm going to try the software GetDataBack but slim chance, thanks anyway though.

[watercooled]

Don't waste your money, if it, or even the TC volume header and its backup, were overwritten, you've precisely no chance of getting it back.

You may have a chance of some recovery if the drive *wasn't* overwritten, and the file remains at least partially intact, but you'd be best off trying some free software first, like PhotoRec.

When trying to recover data, always make a clone of the problem drive and work only on the clone, to avoid causing further damage to any existing data during the recovery process.

[adonismark]

The problem you are facing while a file on her D drive which was being mounted with Truecrypt to her U drive because program file was running in the background even though truecrypt was closed, but you are don’t worry, you are trying import to Amrev data recovery software. So you have to first repair those drives using Data Recovery Software and then proceed importing.

Good Luck!!

[CharlieWoodhou]

However, partial recovery may not be enough, but you would need to understand how the encryption algorithm works.