# Can't recover files from a truecrypt volume



## abishekjabes (Jul 14, 2013)

Hi,i have an external hard disk and i have partitioned it.i have encrypted an entire volume with true crypt.now accidentally i deleted an file from it.
to recover i used stellar phoenix pro.but it would simply show nothing.it is unable to recover the file inside a true crypt volume.Please help.


----------



## Fjandr (Sep 26, 2012)

The file management is handled by the OS as normal when the encrypted volume is opened. If you are unable to get a program to find the sectors belonging to the file, it was likely overwritten by another file.

You can try another tool, such as the following: Kickass Undelete | Free System Administration software downloads at SourceForge.net


----------



## Wand3r3r (Sep 17, 2010)

To my knowledge file recovery software can not work with an encrypted volume. Reason is simple: it can't decrypt the encryption. Reading blocks is useless.

As long as the true crypt volume is not marked as removable recycle bin should still be working and your deleted file would be there.

TrueCrypt - Volume Mounted as Removable Medium


----------



## Fjandr (Sep 26, 2012)

It works the same on encrypted volumes as it does on non-encrypted volumes as long as you can decrypt the volume.


----------



## Wand3r3r (Sep 17, 2010)

But that's the point. You have to decrypt the volume first. This is why stellar phoenix didn't see anything.

After all the whole point of encrypting a volume is so if out of your physical control nobody can get the info. Even if they use software like a undelete utility


----------



## Fjandr (Sep 26, 2012)

He didn't say anything about being unable to access the volume, only that he deleted a file. Two very different things.


----------



## Wand3r3r (Sep 17, 2010)

Sorry but I am not following you. 

A file has been deleted on an encrypted volume. You can not use file recovery software on a encrypted volume. It you wanted to be successful doing so you would need to unencrypt the entire volume to be able to read at the block level to recover a deleted file.


----------



## Fjandr (Sep 26, 2012)

You can do that with most disk encryption software. The actual filesystem is managed by the OS just like normal volumes. Once it's decrypted, the exact same mechanisms are used to recover a deleted file on the encrypted volume as are used on an unencrypted volume. The OS doesn't know the difference once the volume is open. I'm not aware of any disk encryption software that is able to prevent normal file recovery operations if the volume can be successfully decrypted.


----------



## Wand3r3r (Sep 17, 2010)

That would be correct. The problem abishekjabes ran into is he didn't decrypt the volume first before trying the file recovery software. This is the point I have made since post #3


----------



## Fjandr (Sep 26, 2012)

Where in the first post does it say anything about being able to not decrypt the volume? You can't delete a file from an encrypted volume.


----------



## Wand3r3r (Sep 17, 2010)

OP never decrypted the volume which is why the recovery software didn't work. That was exactly the point I was making.

TrueCrypt - Removing Encryption
http://www.rationallyparanoid.com/articles/truecrypt-sleuth.pdf

It has been awhile since I used truecrypt but I recall being able to delete files while encrypted.

From the second link

"Once the copying is completed we will unmount the volume and close TrueCrypt to confirm that everything was
written to the volume and encrypted.
We will now take our second image. We mount the volume again but this time to the Y: drive (this is done simply
to distinguish each of our steps) and take another image using dd:
Once this is done, we proceed to delete the Text Files folder by holding the shift key while pressing the delete key on the keyboard:"

You will note no mention of decrypting the volume before deleting files. Next paragraph down mentions decrypting the volume to check for the deleted files.

But all this is a moot point since we appear to have lost the OP. Oh well....


----------



## Fjandr (Sep 26, 2012)

An OS can't see an unmounted Truecrypt drive at all, so it's not possible to delete a file from it or use undelete software on it unless the volume is decrypted.

I know this because I currently have an encrypted drive.

It is indeed a moot point at this moment though, unless the OP reappears. :smile:


----------

