Results 1 to 2 of 2

Thread: fatback: recovering deleted files from truecrypt encrypted usb flash drive

  1. #1
    Just burned his ISO
    Join Date
    Aug 2012
    Posts
    1

    Default fatback: recovering deleted files from truecrypt encrypted usb flash drive

    Hey all! I'm trying to learn several forensics tools that are included with BT5; in this particular instance I am playing with the file carving tool fatback.

    I have a USB flash drive that I have encrypted using truecrypt full disk encryption. I added some files and then deleted a couple of them after successfully mounting the drive in truecrypt.

    With the drive still mounted I tried to use the command 'fatback /dev/sdb1 -a -o ~/test' (~/test is a folder I created to save the recovered files)

    I was watching a youtube video illustrating this process and I performed the same steps as the commentator. The only difference between the two scenarios is that the USB drive on the video was formated using FAT16 (rather than FAT32 which my drive is) and the drive on the video was not encrypted.

    However when I ran the command I got an error that read:

    "No valid VBR found at offset 440722688
    Unable to read Volume Boot Record"

    I am wondering whether the fact that I have used full disk encryption might be causing this problem. If this is so, is there another tool that can be used specifically with full disk encrypted usb flash drives or another command formulation I should use?

    Thanks for your input : )
    n1ll0

  2. #2
    Senior Member
    Join Date
    Jul 2009
    Posts
    135

    Default Re: fatback: recovering deleted files from truecrypt encrypted usb flash drive

    fatback will work on the block device, the sdb1 partition in your case, which is encrypted. Because everything here is encryption, fatback will be unable to properly parse the fat32 partition structures and thus will be unable to function properly.

Similar Threads

  1. Restore deleted files
    By opaltchenov in forum Beginners Forum
    Replies: 1
    Last Post: 11-16-2010, 02:18 PM
  2. Replies: 3
    Last Post: 02-16-2009, 12:16 PM
  3. Replies: 2
    Last Post: 02-11-2009, 01:57 PM
  4. Recovering deleted partitions
    By cooper in forum OLD Newbie Area
    Replies: 4
    Last Post: 02-21-2008, 08:50 PM
  5. F*cking deleted my /etc files....
    By -~operator~- in forum OLD Newbie Area
    Replies: 20
    Last Post: 07-17-2007, 04:38 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •