justlower
Newbie | Редактировать | Профиль | Сообщение | Цитировать | Сообщить модератору
Hey guys, i need your help.
I want to restore an deleted container from an USB drive. I found DcsFV tool but can't figure it out. I created another small container to do a test , copied it to a USB drive and run DcsFV tool.. here is the config <code>
<DcsFV>
<
!-- Modes of search: Authorize, Regions -->
<SearchType>ops </SearchType>
<!-- List of media and sector ranges to scan
Scenario in the example:
Disk was double decrypted with wrong header
=> The following actions specified
1. encrypt the disk twice with "wrong" header to restore data
2. save data to new file
3. check statistics lavel for saved data
4. try real header decrypt
-->
<Medias>
<Media>
<Path>\\.\PhysicalDrive2</Path>
<BlockSize>512</BlockSize>
<! -- begin block (0 - by default) -->
<Begin>0</Begin>
<!-- end block (last block of path - by default) -->
<End>31457280</End>
<Operations>
<Operation>
<Action>Authorize</Action>
<!-- Skip authorize if statistics do not detect encryption -->
<SkipByStatLevel>0</SkipByStatLevel>
<!-- List of logins to try on each sector of medias -- >
<Logins>
<Login>
<Password>password1</Password>
<Pim>0</Pim>
<!-- Hash name or ID. case sensitive. 0 - try all -->
<Hash>0</Hash>
<!-- 1 - means boot header try -->
<Boot>1</Boot>
<!-- 1 - means trucrypt header try -->
< TcMode>1</TcMode>
</Login>
</Logins>
<!-- Statistics configuration to skip sector not encrypted -->
<StatLevels>
<!-- minimum of "1" bits in block -->
<Bits1> 0</Bits1>
<!-- minimum of "0" bits in block -->
<Bits0>0</Bits0>
<!-- minimum of transitions "0<->1" bits in block -->
<BitsT >0</BitsT>
<!
<!-- deviation of the average distance -->
<MarkovChainDeviation>0</MarkovChainDeviation>
</StatLevels>
</Operation>
</Operations>
</Media>
</Medias>
</DcsFV>
</code>
I tried every possible config combination but the tool does not find the header. Tried with DCS-2017_03_28 and DcsFV_03 , no luck. Please help!
|
