1

I've got a partition that is encrypted using VeraCrypt. I accidentally deleted some files and would like to recover them. The main problem is that tools like ntfsundelete require a device to work. But there is only a device inode like /dev/mapper/veracrypt1 as long as the device is mounted in VeraCrypt. I cannot access this device inode because it's "already opened exclusively", probably by VeraCrypt.

How can I undelete the files? The actual data should still be there... hopefully.

SeveQ
  • 141
  • 2
  • 10
  • 1
    why is this tagged ntfs? if this is on an ntfs filesystem... use windows. – Rinzwind Sep 15 '16 at 18:33
  • Related: https://veracrypt.codeplex.com/wikipage?title=FAQ – Elder Geek Sep 15 '16 at 18:35
  • 1
    @ElderGeek I'm not sure how this would help me. I don't have any problems mounting the VeraCrypt container/partition. I've accidentally deleted files that resided inside the container. – SeveQ Sep 15 '16 at 18:37
  • @Rinzwind It actually is a Windows partition, yes. I've resorted to Linux in a twinge of panic because all I could think of was to mount the device read only. Didn't think about that VeraCrypt can do that itself. Yes, I'll try it again on Windows and see if I can recover the files there. – SeveQ Sep 15 '16 at 18:40
  • I thought perhaps the developers of the software would be most likely to be able to answer your question. I apologize if you saw no value in that. – Elder Geek Sep 15 '16 at 18:42
  • @ElderGeek No need to apologize. I appreciate your effort. I'm just a little bit panicked right now... I have to apologize if my comment sounded a little rude. – SeveQ Sep 15 '16 at 19:00
  • Is the Veracrypt volume itself formatted in NTFS? That seems quite unlikely. – Andrea Lazzarotto Sep 17 '16 at 09:37
  • @AndreaLazzarotto The filesystem inside the container is in fact NTFS. Why is that unlikely? – SeveQ Sep 17 '16 at 11:47
  • Sorry, my bad. Anyway, make a dd image of the drive first: sudo dd if=/dev/mapper/veracrypt1 of=~/Desktop/copy.img – Andrea Lazzarotto Sep 17 '16 at 14:45
  • @AndreaLazzarotto I would if this wasn't a 4TB drive and by far the largest in the system... In the meantime I've given up on the remaining deleted files. I could restore some by means of a tool named Recuva. But 75% of the files are lost. I have to deal with it... Thanks for your effort, nevertheless! – SeveQ Sep 17 '16 at 20:56
  • As long as sudo something can read the device, you might as well use my software RecuperaBit on it: http://askubuntu.com/a/776317/271 – Andrea Lazzarotto Sep 17 '16 at 20:58
  • I'll try to remember that the next time I accidentally delete some files. I guess that it will inevitably happen... Hopefully not too soon. Thank you! @AndreaLazzarotto – SeveQ Sep 17 '16 at 21:38

1 Answers1

0

Unfortunately, I had to give up on the remaining deleted files. About 75% were irreversibly lost, no trace of them left on the volume. Not the end of the world, but still a nuisance. Anyway, some files could be restored by using a tool named Recuva. I can recommend it! Just pay attention to what you install alongside. It might come with some adware.

SeveQ
  • 141
  • 2
  • 10
  • "No trace of them on the volume" is based on what kind of analysis? – Andrea Lazzarotto Sep 18 '16 at 10:27
  • Deep scan of Recuva. I'm not sure how it works in detail. – SeveQ Sep 18 '16 at 10:30
  • That looks like a file carver. I would recommend running a full scan with RecuperaBit (or similar commercial tools like DMDE or Restorer Ultimate Pro) before saying "irreversibly lost". :P – Andrea Lazzarotto Sep 18 '16 at 12:00
  • Hmm... Not necessary anymore. I've already accepted that they are gone. They weren't that important that it would justify actually buying some commercial recovery tool. But for the next time that this happens, I'll try to memorize your advice. Thanks! – SeveQ Sep 18 '16 at 12:38
  • Sure, that's why I said either use the open source RecuperaBit or a commercial tool. :P Anyway keep in mind that you can accept your own answer after a while, or you can also decide to close your question if you feel so. – Andrea Lazzarotto Sep 18 '16 at 13:12