[arch-general] archlinux ext4 recovery file versioning

[Alex Theotokatos]

On 04/17/2017 11:12 PM, Maykel Franco via arch-general wrote:
> El 17 abr. 2017 10:09 p. m., "Alex Theotokatos via arch-general" <
> arch-general at archlinux.org> escribió:
>
> On 04/17/2017 09:31 PM, Maykel Franco via arch-general wrote:
>
>> Hi, I have a server in archlinux with samba. I have windows client in my
>> house with mapped folder but a Trojan has entered and encrypted all files
>> included server archlinux...
>>
>> Archlinux has formated with ext4.
>>
>> Would it be possible to recover unencrypted files?
>>
> Maybe testdisk with photorec might help. Good luck...
>
>
>
> With testisk os posible recovery original files without encrypt?
It will not unlock the encrypted files, but photorec will swap all the 
disk and can recover some files that 'theoretically' was deleted or tmp 
files.
Maybe, during encryption the files moved on some parental folder and 
then deleted. i think photorec might help here.
You can start with testdisk and see what is deleted and not.