Thomas

GNUPG (GPG) Secret Key (secring.gpg) Recovery

I have been trying to recover some of the data from my formatted partition these past days. Since the partition has been formatted I have given up on ever recovering the emails and other kinds of data with non-trivial file layouts. I have instead focused on recovering the secret key to my gnupg public key for one of my email addresses. By playing with hexdump on secring.gpg files gnupg generated for me I found that these always started with two octets (0x01, 0x95). I then made a simple scanner scanning the device (/dev/hda6 in this case) for these octets. Each time this header was located it was written out with the following bytes making a bunch of small files of 4000 bytes. I then wrote a bash script using a simple truncator program I wrote to actually run gpg --import on each of these candidates truncated to all lengths between 100 and 4000 bytes.

However, I was unable to recover anything :|. I had already filled around 2 gigs of the 16 gigs making up the partition and by doing that I might have owerwritten the key data, bollocks.