Encrypted (TrueCrypt) Raid 1 External Recovery Help

[dantz]

OK, use WinHex to compare the first sector of your successful (mountable) test file with the first sector of your new partition (at offset 1048576 decimal). They are supposed to be identical.

(In my previous post, I said hexadecimal by mistake. Edited)

[FortyTwo]

FYI, when I go to offset 1048576 (decimal) there is no data. However, I can see data beginning at offset 1049088.

[dantz]

Originally Posted by FortyTwo

FYI, when I go to offset 1048576 (decimal) there is no data. However, I can see data beginning at offset 1049088.

Well, that's unexpected. Somehow the first sector of your partition (which also happens to be the most important portion of TrueCrypt's volume header) got zeroed out. I wonder how? I'll have to play around with DiskPart to see if I figure out how that might have happened. Anyway, here's a way to fix it:

(Before performing the following steps, did you already try to mount the volume using the embedded backup header? It might just work. Try that first, and if you get the "incorrect pw or not a TC volume" prompt then continue below):

1. In WinHex, open the physical drive

2. If necessary, click once in the Offset column to get into Decimal mode (it's a toggle, so each time you click there you switch between hex and decimal mode)

3. You need to make sure your new partition begins at offset 1048576 decimal. In WinHex, click once on the partition name. (It should be listed in the browser window, right above the data.) See if this takes you to offset 1048576. If so then close WinHex and then go on to Step 4, otherwise stop here and report back.

4. In TrueCrypt, back up the header of your mountable test file using TrueCrypt's "Volume Tools", "Backup Volume Header" feature.

5. Restore the header to your new partition using TrueCrypt's "Volume Tools", "Restore Volume Header", "From an external backup file".

6. See if you can mount the partition-hosted volume now. Hope this works! The above steps are not guaranteed to be perfect, so be careful. If something doesn't seem right then stop and let me know.

[FortyTwo]

You sir (or ma'am), are a genius, a hero and deserve more thanks than I can give! I honestly can't believe it! All data accounted for (approx 500GB)!

I ended up abandoning the external casing. The whole reason I bought it was so I could password protect my data. When that failed (thanks WesternDigital), I decided to utilize TrueCrypt. I now just have the TB drive installed within my system. I figure that I can secure it with disk permissions if I wish. If I get brave again, I will try creating and encrypting a partition within the drive within my system. WinHex is a great product. Thank you so much for all your help, I am so grateful for your time and knowledge. I'm also sorry for the gaps between posts.

[dantz]

I've been away for a week and just got back. Congratulations on recovering your data! This puts you in the very lucky and very small minority of users who have actually been able to recover from a TrueCrypt-related disaster.

For all other TC users who may be reading this thread, I highly recommend that you back up both your data and your encryption headers before something like this happens to you. You might not be so lucky.