Replies: 1 comment
-
|
The decryption key for the blocks is usually stored inside the inode of the matching file. If the inode's data is zeroed (the easiest and fastest way to delete the file), then the decryption key is lost. Since the key is purely random, there's no way to recover it, or even narrow down the options, if it is lost. The very nature of encryption makes bruteforcing the key impractical. That's even if you had a decent hint for the block's contents that you could use to verify a successful decryption. Don't get me wrong, I'm also interested if it's possible to recover files deleted from an fscrypt partition. I just don't believe it is. |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Hello @SlugFiller and everyone
I hope you're doing good
I see your script already differenciates logical blocks that have a physical one related to them , and setoptions for that physical block to be decrypted.
So it means we do know which physical blocks have nothing, no options, isn't there something to do with them?
Beta Was this translation helpful? Give feedback.
All reactions