Can files deleted on an ecnrypted drive be restored?

Question

There are ways to restore files, deleted from the system by default, I'm not sure about the way they work but I guess thet read content, that has not been overwritten. On the other hand, there are programs (e.g. TrueCrypt), that encrypt disks, claiming that it wouldn't be possible to tell apart random data and file contents on such a disk without a password. Therefore I think that files, deleted from such disks can't be restored. Is that correct?

I know one way to find out would be to try it, but there is a possibility, that I would just pick the wrong restoring software. Moreover, I'm more interested in theorethical explanation why it would/wouldn't be possible. Thanks

Answer 1

That depends on the program and algorithm used.

As far as TrueCrypt is concerned, when the correct passphrase is entered, it seems to show the encrypted partition as a standard partition, formatted with whatever filesystem you used there - so while the partition is decrypted, you should be able to use the usual file recovery methods on it. If the file deleted was on a FAT/FAT32 partition (encrypted through TC), it should be recoverable; other FS types are more tricky.

Of course, without the correct passphrase, the disk/container will look like noise to any program, so you can't do the recovery without actually opening the disk with the respective decryption program.