0

I accidentally removed some files from my Ubuntu's Desktop directory. I'd like to recover them if possible. Immediately following the deletion, I copied my sda3 partition to an iso file on a different hard drive using dd. This partition is encrypted with luks, but I know the password and can mount the partition.

What software, if any, can walk a luks encrypted partition and flag files that may have been removed?

4
  • I'd give TestDisk a try (see here for its long list of supported file systems). As you're speaking of ext4, you're probably running Linux: most distros have it in their repos by the name testdisk. // Btw: Good thinking immediately creating a disk image, that will have increased your chances of recovery a lot!
    – Izzy
    Jul 26, 2021 at 17:48
  • Thank you vmuch. I just looked at testdisk and it looks as though it specializes in lost partitions. My partition isn't lost; just some files on it are. Loosk like it says Undelete files from FAT, exFAT, NTFS and ext2 filesystem Copy files from deleted FAT, exFAT, NTFS and ext2/ext3/ext4 partitions. That second line is very confusing. Jul 26, 2021 at 18:23
  • I've used it in the past to recover files from a broken disk. IIRC it had also an option to scan for deleted files. Said partition was formatted ext4 as well. Just give it a try and play a bit with it (as I rarely need it, it always takes multiple tries until I find the correct "path of actions").
    – Izzy
    Jul 27, 2021 at 20:00
  • 1
    I now have actual experience with photorec, extundelete, and testdisk. All marvelous pieces of software. I'll post an answer to my own question as well as steps to use them each with a luks-encrypted drive partitioned with Ubuntu LVM. Unfortunately a lot of my videos are corrupted, but the file sizes appear to be correct, so they may still be saveable with other software. Jul 28, 2021 at 17:29

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.