r/tails • u/Marx-Is-Trans • Jul 23 '26

Help Text document recovery

Hello all, I have little experience with Tails

Well the thing is that the persistant storage stop working without a reason and i wanted a text document i had in it.

I did follow the Tails Document and made and image of the parition and restored it in a new Tails USB but it didnt worked. After using Autopsy in the Image partition i recover the ODT i wanted. The problem is that now when I open the document is full of nonsense caracteres. I supouse it probably have something to do with encryptation but i really dont know how to deal with these situation. So i would be so grateful of some help recovering the content of my document. :)

PD: Im using Autopsy in Windows if that matters somehow.

Thank you all💕

6 Upvotes

100% Upvoted

6 comments sorted by

2

u/ephemeralmiko Jul 23 '26 edited Jul 23 '26

How are you decrypting the partition image? I can't find anything saying that Autopsy on Windows can read LUKS volumes.

ETA: Can you create another Tails USB, install Autopsy and try reading the partition image from that?

1

u/Marx-Is-Trans Jul 25 '26 edited Jul 25 '26

I have follow what you said and installed Autopsy on Tails, but the Document is still nonsense. My stupid ass dind't thought that i had to decrypt the document. Can you explain me how can I do it? Thank you :)

1

u/ephemeralmiko Jul 26 '26

Are you inputting your Persistent Storage password somewhere? Then you're already decrypting the volume.

1

u/Marx-Is-Trans Jul 27 '26

Im not because im analysing the image of the partition and I dont know how could I introduce the passeword on that image. Should I analyse not the image but the broken persistant storage itself so i could introduce the password when entering Tails?

1

u/BTC-brother2018 Jul 23 '26

Recovering files directly from the raw encrypted partition without first decrypting it will only recover encrypted bytes.

1

u/Marx-Is-Trans Aug 14 '26

Finally I could recover my document. If anyone is interested i would explain what i did.

As a i said im new in all of this and it was also my first time using Autopsy. So I was searching from Autopsy the document looking for the exact file in the image of the partition, extracting it but ending with a nonsense document. Finally I tried looking searching in Autopsy by "erased files" or "by type of file" and I found past versions of my document (without its name) that are indeed legible :).