So, I did a thing - accidentally selected my 5TB external NTFS hard drive (encrypted with VeraCrypt) as the target for writing an ISO. The moment I noticed that “Impression” had switched the drive letter, I immediately killed the process. But yeah… damage done.

Now, the situation:

  • Currently shows up as:
    • 6 MB FAT
    • 4.3 GB
    • 2 TB unallocated
    • 2.6TB unallocated
  • The VeraCrypt volume obviously no longer mounts.
  • Drive was somewhat crucial - lots of structured data I’d really prefer to recover with the original file system intact.

I know chances are slim, especially with encrypted volumes, but has anyone had luck recovering from something like this? I’m open to commercial recovery tools or command-line wizardry. Would love to hear from anyone who’s been down this road.

Any thoughts or recommendations?

  • BombOmOm@lemmy.worldEnglish
    161·
    19 hours ago

    If you have your encryption key backed up, you have a chance to decrypt it still. It’s also possible, but unlikely, the key somehow survived the ISO write and it was written elsewhere on the drive, allowing the key to be recovered. I would only trust such with a professional. (There is basically a smaller encrypted section that your typed-in password decrypts, that section contains the encryption key the rest of the drive uses.)

    Honestly though, if you have your stuff backed up (you do have your stuff backed up elsewhere?!?), just restore from your backup and call this a loss.

    If you don’t have a backup, this was your wakeup call. Always have a backup going forward.

    • floo@retrolemmy.comEnglish
      7·
      19 hours ago

      Aren’t encryption keys, typically in the partition header? Wouldn’t that be one of the first things overwritten? Even if it was in the FAT or in the GYD, it would have been overwritten when a the ISO was written.