2

I recently made a big mistake of wiping my C drive that held my pgp key ring. Currently the key ring is the only way I can get access to an account with $300 of bitcoin. I've downloaded some recovery tools and went through the files but to be honest I'm not sure what to look for. What files should I be looking to recover and where would they have been before being deleted ?

All help is greatly appreciated as I'm hoping I don't lose access to this account.

OS: Windows 10 Package: Gpg4win 2.3.3 Key generated with GPA

user
  • 7,670
  • 2
  • 30
  • 54
Braden Whaley
  • 21
  • 1
  • 3
  • if the drive was _wiped_, you have no chance; recovery will cost more than $300... if the drive was merely _formatted_, you have a 90% chance at least of recovering it. look for the name of the file, or a literal search for known data inside that file. – dandavis May 05 '17 at 01:04
  • 2
    As per @dandavis comment it depends massively on exactly *how* the drive was "wiped", a secure wipe using something like DBAN will make it uneconomical to retrieve at the very least, a simple "format c:" however gives you a decent chance of recovery if nothing has been written over the sectors of the drive containing the key file. Assuming it *is* just a format then **stop using the drive right now** and have a read of this: https://superuser.com/questions/154687/accidentally-formatted-a-drive-with-an-important-pst-file-in-it-how-to-recover Good luck! – motosubatsu May 05 '17 at 10:46

1 Answers1

1

Since you are able to go through the files it sounds like you didn't low level wipe your drive and just need help identifing the secret key files among those your tools recovered. Your keyring will probably be in a directory called gnupg wherever your windows install stored personal application data and take the form either of a file called secring.gpg or a directory called private-keys-v1.d containing .key files.

Once you have that you should be able to import it into a fresh install.

William Hay
  • 592
  • 2
  • 10
  • The term "drive wiped" points to formatted drive or worse, your answer would be helpful _before_ drive wipe. – bradbury9 Sep 04 '18 at 08:57
  • 2
    The phrase "went through the files" implies that they're able to find files so it isn't a low level wipe just whacking a clean fs on top of the old one so file recovery tools can probably find at least some files. Updated my answer to make this assumption explicit. – William Hay Sep 04 '18 at 09:05