Re: [dm-crypt] Data recovery

[Arno Wagner <arno@wagner.name>]

Hi Nico,

On Sun, Oct 09, 2011 at 07:17:31PM +0200, Nico Gevers wrote:
> Hi Arno
> 
> Thanks for the help. I'll consider the data lost and move on.
> 
> Incidentally, is there any way to recover deleted files from an encrypted
> drive. eg, you delete some files (and empty the trash), and then recover
> them afterwards. I know there are tools available, but I'm not sure i they
> would work on an encrypted drive (while mounted of course). Will encrypting
> a drive remove all possibilities of undelete?

This will behave exactly the same as with a non-encrypted device.
The encryption layer just translates the raw encrypted device into 
a raw non-encrypted device, which for all intents and purposes 
(except performance) can be treated the same as a non-encrypted
device. 

The filesystem sits on top of that and difficulty-level of
recovering deleted files depends on the filesystem used.
For example, with ext2/3 it is pretty difficult, but you
may find fragments easily if you know what you are looking 
for. With FAT is is generally easy. BTRFS, XFS, ZFS, etc.
I have no idea.

Arno
-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier