2

Hello people I have a really big problem that I need help with. Yesterday i installed parrot OS home edition with full disk encryption ( I have the pass phrase) onto my 1TB external HDD which has a lot of sentimental photos and videos of family and friends. I did this by mistake as I have an identical HDD I use to play around with different operating systems. Is there any way I can recover the data? My wife is absolutely fuming about it. Please help me guys. Thank you.

Joseph
  • 21
  • Do you remember the pass phrase, or at least part, or some idea of its form. So that millions of similar phrases could be tried? – ctrl-alt-delor Mar 03 '20 at 18:07
  • 1
    @ctrl-alt-delor As also detailed by frostschutz in the second answer, usage of the passphrase, or even accessing the drive other than Read-Only, would be counterproductive, if any recovery is to be attempted. The OP is out of luck, except maybe if he skipped the pre-encryption wipe, or partitioned only part of the drive. – Alex Stragies Mar 03 '20 at 18:36
  • 1
    Do you remember how long did it take to perform the installation? Was it a matter of hours, or mere minutes? – LSerni Mar 03 '20 at 19:18
  • @AlexStragies I though that the OP had encrypted the data, but if they wrote over it. That is another story. – ctrl-alt-delor Mar 03 '20 at 22:05
  • Thanks for the support everyone. The installation didn't take hours but it wasn't lightening fast either it took about 20 minutes. I'm using a program called rem recover to search for lost partitions. It's taken 3 hours and is at 88% right now. I hope to god this works but if not I will try frostschutz advice on using photorec and searching for any old SD cards. I'll post the output of fdisk -l also. Thank you for your time people. – Joseph Mar 03 '20 at 22:21

2 Answers2

2

Yes, most likely. Sorry to be the bearer of bad news. Buy flowers.

Part of what makes FDE-Full Disk Encryption a good crypto solution is the fact, that before the new filesystem(s) and their date are written encrypted onto the drive during the installation, the installer will "prime" the disk (or the allocated portion of it) with random data, so that a potential future attacker cannot gain knowledge through infering something from the allocated sectors, because after priming the data "looks" just like the empty space.

If you had selected only a portion of the disk to use/encrypt by parrot, then you might have gotten lucky, but with the information you gave above, the verdict looks clear. BUT, to be sure, edit the output of fdisk -l into your post.

Alex Stragies
  • 6,016
1

Have I lost my sentimental data

Probably. Maybe. Who knows.

It depends on how much was overwritten; that's everything in case it did a pre-encryption wipe (which you'd probably know as it'd take a while) and, well, not everything otherwise.

Unfortunately, not everything is probably still quite a lot...

Just run photorec on it and see what happens. If it wasn't fully overwritten, chances are good to find some intact photos. Larger files like videos have a much higher chance to be partially corrupted. Again it depends what was written and where.

I have the pass phrase

If you're looking for data that was there before the encryption happened, that passphrase is useless and you should never use it, and never write to the drive.

Make your recovery attempts read-only.

In addition, photos and videos must have come from somewhere. Maybe you can still find copies left on SD cards and other media where you might have stored them in the past. So extend your recovery efforts to all storage medias around you and buy a new drive to store recovered data on.

And in future, keep backups of data you don't want to lose. Drives just die one day to the next and then it's all gone too. Professional data recovery is expensive and isn't always able to help, either.

frostschutz
  • 48,978
  • Does Parrot OS have an option to skip/cancel the pre-encryption-wipe? Debian has it, but It may not be exposed, even if Parrot is Debian-based. And the OP would have remembered skipping/canceling it, and added that info to the post (hopefully) – Alex Stragies Mar 03 '20 at 18:32