1

An encrypted Veracrypt volume on external hdd that is 1-pass wiped (full format) with the Windows format tool. Then some data was written after the format. According to my knowledge, with hex viewer the Veracrypt volume appears full of random data, except the header which I tried to recover using Veracrypt but failed. So for me to mount the volume and retrieve the data, the full past state of the drive must be recovered as a whole.

Is recovery possible in any way?

Improve this question
3
  • 2
    What do you want to recover then? Data prior to one-pass wipe is gone anyway.
    – Joep van Steen
    Commented Jun 13 at 11:05
  • 1
    The data is gone. I hope you realize that. If you wanted the data why did you format the HDD?
    – Ramhound
    Commented Jun 13 at 12:10
  • I was just reorganizing file picking the most important then after a period of time I realized that there was more files.
    – Life Long Learner
    Commented Jun 13 at 12:47

1 Answer 1

Reset to default
4

An encrypted Veracrypt volume on external hdd that is 1-pass wiped (full format) with the Windows format tool.

Windows full format is effectively a zero-fill. The previous data on the volume affected by the zero-fill is now unrecoverable. No documented cases of recovery of data overwritten by a single zero pass of zeros exist to my knowledge.

See: https://superuser.com/a/1845422/705502

Improve this answer
3
  • If the data was not encrypted, the situation might be different, but by performing a zero-fill on (encrypted) random data there is no possibility of any recovery of the data. Since you would not only have to decrypt the data, which is not impossible, you would also have to recover the data, which was wiped. I would agree data recovery is impossible Even if the data wasn't encrypted, in order to reverse the zero fill format, you would be stuck at trying to reconstruct the data. Which again due to the encrypted data is impossible.
    – Ramhound
    Commented Jun 13 at 15:59
  • As you are saying if the data wasn't encrypted how exactly can it be reconstructed while every physical bit on the magnetic hard disk is zero filled taking into account the scenario that the data wasn't encrypted ?
    – Life Long Learner
    Commented Jun 18 at 16:01
  • No, that's not what I'm saying.
    – Joep van Steen
    Commented Jun 18 at 19:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .