11-02-2018, 11:13 AM
(11-01-2018, 07:20 PM)nn55 Wrote: Short story long, I've had a filesystem corrupted making me unable to recover any of the encrypted Veracrypt files located there. As Veracrypt doesn't have any plaintext headers, it's basically impossible to find the files without going through every block and try to decrypt the first 68 bytes (well, use the first 64 bytes as the salt and then try to decrypt the next four and see if it decrypts to VERA).
Actually this is more of a data-recovery/computer forensics question than a crypto question as far as I can tell. Depending on the filesystem in use, and the current state of the the filesystem remnants it may be possible to do a full recovery of the files in question.
I would think that taking the existing remnants of the filesystem into account would give you a much higher chance of success than the sector by sector brute-force attack you describe.
Your best bet would be to contact a data recovery professional, with extensive expertise in parsing damaged filesystems.
Good luck!