HDD GURU FORUMS
http://forum.hddguru.com/

Searching for a hex string on encrypted drive
http://forum.hddguru.com/viewtopic.php?f=10&t=44123
Page 1 of 1

Author:  califauna [ February 23rd, 2024, 4:52 ]
Post subject:  Searching for a hex string on encrypted drive

Hi,
I recently lost some data after a reinstall of Windows.

The lost files are Google chrome session files. In chrome the session files have no signature, as far as I know, so I'm thinking to scan the raw data of the drive for a hex string which I know will be in the files I'm looking for. The old files contained the ANSI "perplexity". I know this ANSI string hex will be in there because I created a new session using tabs I know were open in the old session files I'm looking for, then inspecting the hex of those files.

The problem is the files would have been encrypted. I've got the old Windows EFS encryption key installed on my new system but as I understand it, the string I'm looking for will be encrypted as it's not part of a file as far as the current OS sees it, it's just binary data on the drive not part of a file any more.

How can I find out the encrypted hex string I need to search for?

Page 1 of 1 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/