0

I wanted to encrypt my drives with Veracrypt, but I didn't know that it will first format the hard drive, so I canceled the progress of encryption normally.

How can I recover my files?

I have used the most popular file recovery software like easeus data recovery or iboysoft datarecovery or recuva.

None of this software found anything.

3
  • But how far did it get? How long did you let format run? Commented Jun 22, 2021 at 10:55
  • Try these utilities.
    – harrymc
    Commented Jun 22, 2021 at 11:01
  • @joepvansteen about 15%, i mean 15% of encryption. Not the format. It formats first, then it starts encrypting. So i think the format was completed. Commented Jun 22, 2021 at 11:11

1 Answer 1

0

Depends on how far process was allowed to go.

For many file systems, most and most important file system structures are relatively close towards the start of the drive. So that means if first 15% of a the drive gets overwritten (by zeros, or by encrypted data), these are lost + every bit of actual data within this area. Overwritten data can not be recovered.

Normally we have two methods for logical data recovery:

  1. File system based recovery where we discover as much file system meta as we can and try to re-create a virtual file system from that. If successful we can recover files complete with original file name and folder structure.

  2. File carving, where we look for 'magic bytes' that can help us determine the possible start of a file. For example, we can scan the drive for JPEG files by scanning cluster or sector boundaries for 0cFFD8FF. We can recover files this way, not file names or folder structures.

Again, if 15% of the drive is overwritten file system based recovery is probably not an option. File carving is, PhotoRec is a free file carver. I only recommend it when carving is the only remaining option.

Important Note: If the drive is an SSD or so called SMR hard drive, data may be trimmed. In that case any end user file recovery software is useless. Trimming drives return zeros for trimmed blocks mostly.

If data is vital a lab may be able to recover the data still. It depends on specific drive model. In this case remove the drive from power! As long as the drive receives power it can actually erase trimmed data, making it truly unrecoverable.

3
  • My sotrage type is Adata SSD SU630. Is there any chance yet? Any software you can recommend? Commented Jun 22, 2021 at 11:28
  • I suspect drive is trimmed. No software will help. Commented Jun 22, 2021 at 11:37
  • Thanks anyway :( Commented Jun 22, 2021 at 12:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .