Jump to content
CCleaner Community Forums
Sign in to follow this  
tonyp12

file cluster(s) overwritten (0) is it stll gone? ethereum account keystore file

Recommended Posts

Filename: UTC--2017-12-15T05-23-06.593317100Z--cfebf89f6fcea755ebba061b25a0db398a592055

Path: C:\?

Size: 491 bytes (491)

 

State: Unrecoverable

Creation time: 12/15/2017 00:23

 

Comment: This file is overwritten with "C:\pagefile.sys"

1 file cluster(s) overwritten (0)

1 cluster(s) allocated at offset 7864679

Share this post


Link to post
Share on other sites

It's as it says. The deleted file's one data cluster has been overwritten with another file, so is unrecoverable by any means.

Share this post


Link to post
Share on other sites

Not really true, what does "overwritten (0)" mean?

After a day of trying I used Recuva's Scan Contents... and searched for {"address":
it said it was inside the 17GB pagefile that the new win10 installation is using, I had set it to that size as 6 graphics cards needs it
Recovered it (just copy and save really), used windows cmd FIND "cfebf89f6fcea755ebba061b25a0db398a592055" K:pagefile.sys
As I could not look for strings that have " in them, maybe with escape char? so I could not look for 
{"address": again.
and bingo, ready to copy and paste back the whole ciphertext back in to Mist Ethereum wallet.

The dot in file name is what separates the name and type, so I recreated those for the file, just in case.

Share this post


Link to post
Share on other sites

What's not quite true?

Overwritten (0) means that the cluster at offset 0 in the cluster list for this file (i.e. the first and only cluster) has been overwritten.

I assume that you have now recovered your data by another means.

Share this post


Link to post
Share on other sites

But the text string was actually still there, unless some shadow text of it was in a second location, but I never copy/pasted/deleted that file.
Recuva's Scan Contents... found the file the text was in, in was the same file Recuva said had overwritten it, I recovered it by using windows FIND.

So here is a new recommended feature for Recuva: recover crypto currency accounts.
Scan that harddrive just for known beginning text of encrypted privatekey strings, don't care about if it's still a file.

Share this post


Link to post
Share on other sites

Well, I'm glad you managed to recover your data, as far as I can tell you found it within the pagefile. That's a lucky find, I would say.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
Sign in to follow this  

×
×
  • Create New...