I just tried to mount an encrypted partition I store on an SD card.
It has always worked fine, but today when I navigate through to the folder which contains my files, I see a list of files and folders with all sorts of characters in the filenames, the dates modified range from 1988 - 2107, the filetype is again random characters.
The file sizes are as expected so I am hoping my data is still there somewhere!
An example of a filename is: ¡.~:_ðAÑ.j·c
I have no idea what's happened. Can anyone suggest anything to get my files back? Shout if you need any more info about anything to help with a diagnosis.
Oct 1, 2015 at 5:38 PM
Edited Oct 1, 2015 at 5:39 PM
Did your one of your systems get compromised with malware or ransomware?
The following is information I kept from the TrueCrypt forum member Dan who is the expert in recovery with encryption.
If your volume's file system has been damaged such that your operating system can't find any files then you have to deal with that issue separately. The job becomes one of data recovery.
I'll sketch out a approximate procedure you might want to follow:
- Make a sector-by-sector backup image of the damaged partition.
- Restore the image to another disk.
- Mount the copy of the volume.
- Use various data-recovery tools such as GetDataBack, R-Studio, Photorec, TestDisk etc. in read only mode on the mounted volume in order to recover as much data as possible without altering the volume.
- Use file system repair tools (which write to disk) such as TestDisk, chkdsk etc. to try to repair the volume's broken file system on the hopes of recovering more data.
- When you've recovered all that you can, mount and format your original volume and copy your recovered data back into the original volume.
Skip steps 1, 2 and 3 if your data is not that important and you are willing to accept more risk.
Some users even skip step 4 and jump right into repairing the file system, but be warned that you can sometimes do more harm than good and you might recover less data that way.