0

I have accidentally deleted an encrypted folder and clear the recycle bin. I have the certificate of which I encrypted the folder with.

Using conventional software such as Recuva, I was not allowed to recover the files. I see them listed, however when attempting to recover them, Recuva says they are encrypted.

enter image description here

How would I go by recovering deleted encrypted files, WITH the encryption certificate?

migrated from security.stackexchange.com Feb 14 '16 at 16:32

This question came from our site for information security professionals.

  • Can't Recuva recover the encrypted file as-is, and let you decrypt it later? I think TestDisk could (if it's a supported filesystem). But you should stop writing to the drive at all (windows/swap included), it's possible the next write could overwrite your wanted (currently deleted) files. Or does Recuva mean the files have already been overwritten & it can't recover them; the fact they're encrypted is just a coincidence. – Xen2050 Feb 14 '16 at 16:41
  • @Xen2050 it is not a coincidence and a matter of a property tag. It happened to all the encrypted files. I am trying TestDisk, to recover as is. – Omar Chehab Feb 14 '16 at 16:44
  • That's weird then, I'd imagine a recovery program like Recuva should just try & recover the files, whatever they are... or maybe it can't tell where one file ends & the next begins, it can't recognize their headers or magic bits or something – Xen2050 Feb 14 '16 at 16:49
  • @Xen2050 TestDisk was able to retrieve a whole bunch of files, a chunk is missing though, and a chunk is corrupt. Anything I can do to partially read the corrupt files? – Omar Chehab Feb 15 '16 at 3:26
  • That depends on your encryption program, ones like pgp/gpg usually zip files first, so small corruption could be magnified too. – Xen2050 Feb 15 '16 at 12:59
0

A certificate is a signed data structure which contains a public key, i.e. the public key that is used to encrypt the data. You cannot decrypt the the data with the public key. You need the corresponding private key to decrypt the data. The certificate is often stored with ciphertext if just to identify the private key.

Sometimes the name "certificate" is also used to indicate a certificate / private key pair. Especially Microsoft has been doing this in their .NET programming interfaces, where a certificate may be accompanied by a private key. In that case you probably need some kind of password to retrieve the private key. If that's not available you probably just have the certificate with the public key - and thus out of luck.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.