Encryption/HDD Q

This may differ depending on the method of encryption(I assume), so I'll use XP for this example. Let's say I have an important folder on my C:/ drive which contains several hundred megs of data that I have encrypted...but something happens and I delete that partition.

Can you still use that space on the drive? If so, would using data recovery software on that slack be able to recover that data or would it still be encrypted?

KG

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

Kaminsky

You deleted the C: drive and you want something back off it ? oook!

Will be tricky but I don't think it's impossible. The more I think of it theoretically, it's certainly doable.

A partition is just another logical separation of those blocks on the disk. Nothing physically happens to the disk when you partition it. The main drive table that kicks in before the seperate partition indexes kick in, looks after the indexes or the partitions themselves, if that makes sense.

Theoretically, you should be able to put that disk on the secondary drive channel, put another disk in the primary to become the new C: and the once you have built that up in XP, put on some software that will discover the lost partition. Remeber, doing this on the same disk will be fatal especially due to the size of the XP install which will pretty much wipe out everything on there before.

Whether it's encrypted or not. The first problem is to get it back so XP can see it. If it can see it unencrypted, it will be able to see it encrypted. The files / directories being encrypted is kind of irrelevent really. Just one more layer of challenge. Getting to see those directories and files in the first place is going to be the really tricky bit.

I doubt very much you are the first to do this ever so try looking around google.

Three main problems in order of business.
1) Access the partition again.
2) Access the folder and files again.
3) Work on opening the encrypted files.

seuss_ssues

Encrypting data doesnt do anything special to the harddrive. It just merely stores it in an unreadable format. Deleting an encrypted partition is no different than deleting a non encrypted partition.

Data recovery:
Well data recovery is an interesting topic. Depending on whats happened to your drive it may or may not be able to recover the information. If you were to delete the partition and then turn right around you can probably recover it. If you delete the partition, repartition it, and then use it for a month it is not likely that it can be recovered.

When you "delete" something from the hard drive its not erasing it. Rather its marking those disk sectors as "empty" and ready for use. Now if those sectors havent been written to the information can be "recovered."

KGhaleon

Maybe my post was confusing.

I'm not doing anything in particular with this, I was just curious to know if encryption changes anything on the drive and if you could get around the encryption with data recovery software. I figure the data is still encrypted regardless.

KG