• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Does Encrypting/Decrypting a drive affect HD recovery?

B

Blue Knight

Gawd
Joined
Dec 2, 2000
Messages
699
Not sure if this belongs in the security or hard drive forum, but I think it has to do more with encrypting HDs so here goes.

Basically, the question in the title. If we have encrypted hard drives, and someone "deletes" a file, can I use my normal recovery software tools to "see" that file?

I know that the drive will have to be decrypted, either by performing a full disk or via some unlocking means, but that's the gist.

My guess is "no" because encrypting/decrypting just forces all the HD bits line up again with what they should be, even the "ghost" files...but I'm no expert.

The other wrinkle - not sure if this makes a difference, but this particular drive is HFS+ on OSX using FileVault. I recovered NTFS partitions that had McAfee Encryption, but I never did a "free space" check for deleted files.

Thanks in advance!
 
I just had an experience with this today with Symantec Endpoint Encryption. If you run the recovery software on a jump drive while booted in the OS, you may be able to recover the file. But as you said, if you decrypt the drive, it is doing a lot to that platter and may over-write the deleted file in the process.

Side note: Tell your users to stop being stupid and use the server to store anything important. Then they will have backups and shadow copies of everything.
 
Assuming block-by-block whole-disk encryption:
If you run the recovery on the disk while it's being decrypted live, it will work.
If you run the recovery after completely decrypting the disk, it will still work.

Why wouldn't it? It's the same filesystem.
 
Thanks for the replies.

That's what I thought - my only hesitation is that I'm not sure how "filevault" works and if it's exactly a block by block deal or some other method that apple uses.

Oh, and this isn't a stupid user... it's more someone who left on not so good terms. :eek:
 
You must log in or register to reply here.
Back
Top