Which brings me to the initial question: If an area on an SSD is overwritten, is there any way to recover the overwritten data? I know that simple overwriting is permanent as the cells will get different charges and the previous charges are gone (in contrast to magnetic hard drives where traces of the previous magnetization remain).īut: May it be possible that the concerned cells were not overwritten at all and marked as not to be used by the SSD’s wear leveling? Is it possible to read those cells and retrieve the previous data? And if so, to reconstruct the overwritten data blocks that were comprised of these cells?Īny help or insight is greatly appreciated. Alas, a dd clone of the whole SSD revealed just zeros at 128MB. I had hoped that the area of the partition would just be marked as empty but the actual data would still be there. So many, in fact, that my header at 128MB is also gone. Problem 2: macOS decided to overwrite the beginning and the end of the drive with zeros. The GPT ist stored at the beginning of the drive (and a backup copy at the end) and no further data is written. Since my header was stored at 128MB, it should be fine.
When initializing a GPT drive, macOS creates a 200MB EFI partition followed by a standard partition using the rest of the drive. The backup VeraCrypt header is, therefore, gone. Problem 1: GPT drives store a copy of the GPT at the end of the drive as backup. A copy of the header is stored at the end of the partition as a backup. VeraCrypt stores the header with the master key at the beginning of the encrypted partition. I deleted the SSD when I accidentally initialized it as a GPT drive in macOS. The remainder ist filled with one partition that was encrypted. Hence, there is a 128MB EFI partition at the beginning of the SSD.
It was initialized as a GPT drive under Windows 7. I used VeraCrypt to encrypt a complete SSD. Is it possible to recover the VeraCrypt headers? I accidentally used macOS to format an SSD that was encrypted with VeraCrypt.
0 kommentar(er)
