Data recovery from ext HD unplugged while writing

[myfault]

Hi everybody,
i am Sergio from Spain and i have a very big problem i couldn't solve during the past 5 days, i hope someone here is kind and skilled enough to help me.

One month ago i was backing up some Virtualbox .vdi files from my laptop to my external NTFS formatted hard disk, in a linux Mint liveCD environment.
After a while the progress bar was showing 100% complete and disappeared, i could see the files in my external hard disk file manager window so i thought the copy process was finished and i stupidly immediately unplugged the USB cable of my external HD.

Some days ago i needed those .vdi files to restore one of my Virtualbox virtual machines but when i plugged my old USB external HD i couldn't find any off the .vdi files, they were all gone.

The laptop with the original .vdi files has been formatted, rewrited and overwrited many times so i think it's impossible to recover something from that one, i can only hope the data i need has been written on the external hard drive before i unplugged, and that i can somehow recover from that one.

I don't need to recover all the data, i am only interested in a small but very important .dat file that was saved inside one of those big size .vdi virtualbox virtual machine.

I run a deep scan with photorec and copied everything it could recover on a new hard drive, apparently there are traces of .vdi files but those are corrupted and badly fragmented and i cannot mount them on a Virtualbox machine anymore so i think i should change approach.

Any ideas?

[jermy]

Open the file(s) in hex check if they are really .vdi files or just garbage (only contains the name)

[colanco]

It may be another problem ....

SMART report ??

Try to clone the drive and then scan the copy with rstudio / DEMS

[myfault]

There is another problem, not only the .vdi files are fragmentated but i also had the linux OS home directory encrypted, so now i have to recover a .dat file that was saved in an encrypted linux home installed on a .vdi Virtualbox virtual machine.

I've done a small script that is able to open in hex all the files recovered with photorec and scan them in search of a specific "text" that i know was contained inside the .dat file i want, but the problem with this approach is that the .dat file was encrypted in the linux home directory so i'm not getting any result searching for this "text".

Amongst the files recovered with photorec there are a lot of files with *.eCryptfs extension, i remember the password i used to login ubuntu but how do i use that to decrypt those files? And is this possible to decrypt those files even if they are all fragmentated?

Once those are decrypted it will be easy for me to find the .dat.

[MindMergepk]

i think encryption is big problem, because even if you manage to extract a broken/over written vdi file, you can't further search unless it is run in virtual environment.

Otherwise, a manual approach may give you a broken or partial vdi file.

good luck.

[myfault]

i think encryption is big problem, because even if you manage to extract a broken/over written vdi file, you can't further search unless it is run in virtual environment.

Otherwise, a manual approach may give you a broken or partial vdi file.

good luck.

It's a mess, i've just found out that the login password is not enough to decrypt those files and that i need to recover the wrapped-passphrase file first.
This file was also stored int he encrypted home and i cannot find it amongst the photorec recovered files.

[myfault]

I noticed wrapped-passphrase hex is always 58 byte and start with 3A 02. An idea would be scanning the whole hard drive for this pattern but it's 800 GB of data and i think that pattern could be repeated more then 1M times, any idea on how to improve the search?

[myfault]

Today i successfully recovered the MOUNT passphrase, it has not been easy .
I used that passphrase and the ecryptfs-recover-private command to decrypt and mount all the .ecryptfs files that photorec recovered, those are more then 110k files.
I could successfully open and scan only 20k of those files but what i am looking for was not there unfortunately.
When i try to open the other files i get "error opening file: input/output error", how can i solve this problem?

[myfault]

I can't open those file even with Ghex!
How could it be that i can't even read the hex of those files?
Shouldn't be any file representable in hex?
I'm lost.