Forgot to backup an important Qube (passwords were in it)
I had important files in this Qube, and I simply forgot to back up this specific Qube. I then reinstalled QubesOS just to get a fresh start which I now realize was a horrible mistake. Is there any way that I could be able to get the information in that Qube back? After I reinstalled Qubesos and realized I did not backup said Qube, I immediately stopped using my computer and shut it down to try to mitigate any further overwritten damage to the disk.
Is there anything that can be done to recover the data? I understand if it is too late, but I was wondering if there was even a small possibility that my data could be recovered.
Yes, I’m sorry, I forgot to mention that. It is a 1TB HDD that had Luks encrypted + default lvm configuration. When I reinstalled QubesOS, I also kept it as LUKS and LVM
Ok, I understand, that sucks, I was hoping there would be a saving grace. Is there any way I could recover this Luks header with testdisk or other disk recovery program? I tried using test disk prior when I scanned the drive but it kept saying the file system was unrecoverable.
I’m no expert, but my understanding is that if you’ve already overwritten the disk sectors where the LUKS header was stored, it’s significantly less likely that the header data is recoverable. It might still be possible, but you might have a better chance of success contacting some kind of professional forensic data recovery service.
Also, since this is not a Qubes-specific problem, you might get more useful information by searching/asking in other places.
as it’s a HDD, you already wrote the new LUKS header on the old one. The header is physically placed in a specific area of the disk, when making a new LUKS volume it will create it at the exact same place.
On a SSD, it could be different as they do not necessarily reuse the same cells when storing data in the same area from the OS point of view (hence you can not trust a SSD when you use some “secure wiping” tools, overwriting the SSD entirely with random data is the only effective way to erase its content for sure)
If your data are very important, you could get in touch with recovery professional, it will cost a lot and you have no guarantee it will work
the question that is commonly asked at this point is “what is the value of the data”. if that is higher than hiring a data recovery company try it, but your chances are utterly slim.
Oh okay I see, I might try to post this question to another forum in a different community to see if they have different answers, but judging from what everyone has been saying, my data is gone and I’ll have to contact a professional. I guess I will see if I have any recent backups, thank you all of the help everyone.
