Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

There are ways to restore files, deleted from the system by default, I'm not sure about the way they work but I guess thet read content, that has not been overwritten. On the other hand, there are programs (e.g. TrueCrypt), that encrypt disks, claiming that it wouldn't be possible to tell apart random data and file contents on such a disk without a password. Therefore I think that files, deleted from such disks can't be restored. Is that correct?

I know one way to find out would be to try it, but there is a possibility, that I would just pick the wrong restoring software. Moreover, I'm more interested in theorethical explanation why it would/wouldn't be possible. Thanks

share|improve this question

migrated from stackoverflow.com Dec 30 '10 at 1:16

This question came from our site for professional and enthusiast programmers.

1 Answer 1

That depends on the program and algorithm used.

As far as TrueCrypt is concerned, when the correct passphrase is entered, it seems to show the encrypted partition as a standard partition, formatted with whatever filesystem you used there - so while the partition is decrypted, you should be able to use the usual file recovery methods on it. If the file deleted was on a FAT/FAT32 partition (encrypted through TC), it should be recoverable; other FS types are more tricky.

Of course, without the correct passphrase, the disk/container will look like noise to any program, so you can't do the recovery without actually opening the disk with the respective decryption program.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.