Re: [Bug-ddrescue] fill-mode vs luks encryption

[Scott Dwyer]

On 6/5/2014 11:30 PM, Atom Smasher wrote:
> on other failing drives i've used the "fill mode" to identify files 
> that haven't been completely recovered, but this disk is encrypted 
> (with luks). because the drive is encrypted, filling the un-recovered 
> parts of the image with a string will NOT put that string in the 
> files, after the image is decrypted.
>
> before i spend too much time on it, does anyone have any tips or ideas 
> for identifying which files are missing some of their bits?
I am assuming that you are used to using the find/grep method. Check out 
this link for more ideas that may work in your case, assuming the file 
system is mountable:
http://tim.purewhite.id.au/2011/04/disk-recovery-which-files-are-damaged/

The one that is likely to work the best in your case would be the one 
using MD5 checksums. The idea is to make a list of all the files MD5 
checksums, then use the fill mode to change the bad sectors, then make 
another list of the checksums and compare the lists. Because the disk is 
encrypted you won't be able to find a specific pattern like you say, but 
this method looks for differences in the files themselves which won't 
care what the pattern is.

I have never personally used that method, but I am sure others have.

Scott