It examines the disk (or other source) directly, looking for known file signatures, and then it attempts to recover whatever files it finds one by one.īe aware that your file types must be on Photorec's "supported file types" list, otherwise it will not find them. If that doesn't find anything then your file system may be too badly damaged for conventional data-recovery tools, in which case you will want to try Photorec (which comes with Testdisk, from CGSecurity). You can start out with the evaluation copy. I don't know how much of your original data remains, as you scrolled by too quickly for me to make anything out (which is just as well, as you posted it on YouTube. Is that what you see?Īnyway, at this point I suggest you use various data-recovery programs to explore the mounted volume on the hopes of recovering some of your data. However, if the partition was accidentally formatted then you will see some recognizable code and even recognizable words, plus some very large blocks of zeros. It will look like a solid block of gibberish from beginning to end. You won't see a single recognizable pattern in there, not even a large block of zeroes. An unmounted Truecrypt-encrypted partition normally looks like random data from start to finish. To confirm this theory, you can dismount the volume and then use a hex editor to examine the unmounted partition. And that's what I'm seeing at the beginning of your volume. If you accidentally format an unmounted partition-hosted TrueCrypt volume, and then you mount the volume (using the embedded backup header, as the original header would have been destroyed), and then you examine the volume using a hex editor, then you will see a lot of random data wherever the formatting code overwrote the volume. Perhaps there was an accidental format of the unmounted partition? Apparently an event occurred that overwrote a portion of the beginning of the volume. This shows that your volume is still decrypting properly, that it likely still contains some of your original data, and that it is behaving "normally" as far as TrueCrypt is concerned (aside from the fact that your volume header and the beginning of the volume have apparently been damaged). I see that you found a lot of zeros in the middle of the volume and some recognizable plaintext near the end of the volume.
0 kommentar(er)
