• 2 Posts
  • 28 Comments
Joined 4 months ago
cake
Cake day: February 21st, 2024

help-circle













  • The way you recover data from a totally dead drive is use a program that scans every byte and looks for structures in the data that look like files e.g. a jpeg will have a header followed by some blocks of content. In an encrypted drive everything looks like random data.

    Even if you have the key, you can’t begin searching through the data until it’s decrypted, and the kind of error that makes it so your drive won’t mount normally is likely to get in the way of decrypting normally as well.



  • The NTFS one is a Samsung EVO 860 1TB. The ext4 is a cheapo generic brand 256GB.

    I’ve got an AMD 5950X CPU. The motherboard is Aorus X570 Elite. Not sure about the SATA controller except it’s whatever comes with that motherboard.

    In my searching I found something about Ubuntu changing ntfs and ext4 drivers, but I’m not sure if that’s a change between 20.04 and 22.04 or an earlier one. Also the fact that it’s both drives makes me think it’s probably something else going on.

    What I do know is something weird is going on, and my googling so far hasn’t gotten me any good results (just things about not being able to mount drives in the first place, or mounting drives as read only, neither of which are this situation).





  • The malicious code wasn’t in the source code people typically read (the GitHub repo) but was in the code people typically build for official releases (the tarball). It was also hidden in files that are supposed to be used for testing, which get run as part of the official building process.