![]() ![]() I use linux mint 20.2 and the file system of the encrypted vc-partition is ntfs.īefore i try to recover the partition (testdisk did not find it, gpt is broken, the beginning of the potential partition is overwritten with 00 etc) i would try to recover these containers. Yes, i used the embedded backup header to restore the volume header (Volume Tools / Restore Volume Header). Does anyone have a good „cfg“ which can find those containers? Which kind of data source should i chose? Which „device“ or file? I know the names of the containers and the approximate size. ![]() So now i wonder if/how autopsy can find and recover the containers. ![]() There are two more „devices“ which have the same size and content: I also tried to restore some files with photorec and this was successfull as well. I then examined the content of /tmp/.veracrypt_aux_mnt2/volume and i could see some pattern which indicate that the partition was encrypted successfully. The solution is to hide the access pattern, for example by using a write-only oblivious RAM. This is not secure against multi-snapshot adversaries, like those who can take multiple snapshots of your storage at different times. Veracrypt -t -filesystem=none -m=headerbak -k “” -pim=0 -protect-hidden=no /dev/loop11 This works like TrueCrypt hidden volumes, which are volumes created in the free space of volumes. After a bit of research i likely could encrypt the partition without mounting its files system (cause it is damaged) like that: But i think i found it and i have backups of all headers. I dont know what exactly happened to it but i lost the veracrypt partition. When mounting those volumes, you will need to select the file instead of device. This is done pretty much the same way as in the first example, but you select 'Create an encrypted file container' in the 'Create New Volume' dialogue. In short: i stored 1 truecrypt and 1 veracrypt container (or 2 truecrypt or 2 veracrypt containers) on a veracrypt-partition. Instead of using a drive, you can create an encrypted volume and a hidden volume within a file. ![]()
0 Comments
Leave a Reply. |