Help - Truecrypt

Supervisor

Administrator
Joined
Apr 27, 2015
Messages
1,738
Points
295
Location
Germany
I deleted some file from within a truecrypt containter.
In theory, this file should be in the recycle bin right now.. however - it is not.
I did not close the truecrypt container since.

My question is: where did this file go? I cannot find it anymore.. I NEED IT!
Recovery software did not recognize my truecrypt container, so I cannot search for it that way.. any ideas?

Thx
 

rofl cake

Well-Known Member
Joined
May 25, 2015
Messages
204
Points
108
I haven't personally played around with truecrypt that much in the sense of data recovery. However I found some interesting topics online that Might benefit your search.
I just recovered the two 10gb containers completely intact after buying licensed WinHex (it was hell). After reading your post I looked in the $RECYCLE.BIN directory
source
Other Suggestions:
Basically, your Truecrypt behaves like a real harddrive, in a harddrive. So your "container" can be seen as a disk platter in a real harddrive. When you delete a file, windows will write exactly the same thing (deleting the file index from the file table) to the TC disk driver, as it would write to a "real" harddrive. Truecrypt does not know whats stored in a container, all it does is act as a encryption/decryption filter between a "virtual" disk drive and the container file.

Thus, you can run normal file-recovery Tools on the VIRTUAL truecrypt disk drive. Note that some file recovery Tools will be "allergic" to non-physical drives, but then just try Another tool.
source

Software that people have had success with:
WinHex: Computer Forensics & Data Recovery Software,Hex Editor & Disk Editor
NTFS Undelete: Recover deleted files
 

Top