Thus said Anon Loli on Thu, 27 Jun 2024 04:12:57 -0000: > No kidding? The 1st few people made it sound like it's going to be > relatively easy :(
I don't think anyone said it was going to be easy, only that your primary focus should be simply to get a good copy of the raw unencrypted partition while it was still available using simple techniques as quickly as possible. If you have obtained it, your next goal should be to figure out now what to do with it. As I understand it, you wrote 74MB of garbage at the front of that partition. This will have undoubtedly destroyed filesystem metadata and some other data. Can the filesystem be "recreated" in the first 74MB as just empty filesystem space while leaving the rest of the existing data and filesystem in tact? I don't know the answer to that. Maybe there is someone with more FFS experience that does. Presumably you know the exact size of the partition and so could at least recreate an empty filesystem using newfs with the same parameters. Could it possible to then stich in or reattach chunks of data into this from your copy? Again, I don't know. Who does? Any work you do at recovery should be done on yet another copy of the same data so that you can keep one "master" copy around just in case. Some tools for recovering files can be found in packages like sleuthkit and testdisk. There may be others of which I'm unaware. Andy
