TrueCrypt Win7 RAW to NTFS

[pd00]

Hey Guys,

I found some threads in this Forum for the following issue but none of em could really show me how to get the next step.

First the problem. I have a SSD with my OS installed (Win 7 64bit). Yesterday I reinstalled windows 7 on this device. After this I wanted to mount my both fully encrypted 1.5TB HDDs to it. But suddenly just one was mounted. The other one moved from RAW to NTFS.

Oh my godness... after searching and searching of everything. I could restore the header of the HDD via TrueCrypt. Now the HDD moved from NTFS to RAW and I can mount it with TrueCrypt again. But ... windows doesn recognize the filesystem. Now I think there is a problem in the filesystem ... but I have no Idea how to fix it... right now (while writing this post) I make an image of the mounted volume with norton ghost which needs 3 hours...

So if you have any ideas for me to go ahead,... please tell me..
I hope I can fix the filesystem ... so that I can restore it completely.

best
pd

[pd00]

So the backup image of the mounted volume is done...

Also I found this Guide... do you think it is worth a try ?
http://pastebin.com/5nNTg3Y1

pd

[dantz]

Originally Posted by pd00

I have a SSD with my OS installed (Win 7 64bit). Yesterday I reinstalled windows 7 on this device. After this I wanted to mount my both fully encrypted 1.5TB HDDs to it. But suddenly just one was mounted. The other one moved from RAW to NTFS.

It sounds like your HDD was still connected when you reinstalled Win7, so Windows attempted to help you by 'fixing' the encrypted (and thus unrecognizable to Windows) drive to make it look like a normal drive. Thank you, Windows! Not. I only hope you didn't allow Windows to run a full format the drive, as that would be total and irreversible.

I suggest you spend some time viewing the TC forums, where you will soon discover that there are all sorts of similar pitfalls that you probably didn't know about. TC is actually a very dangerous program. The trick to using it safely is to always keep backups of your headers and your data, as well as learning what not to do (e.g. don't leave encrypted drives connected while reinstalling the OS, don't run any type of partitioning software while an encrypted partition is present, etc.)

Originally Posted by pd00

Also I found this Guide... do you think it is worth a try ?
http://pastebin.com/5nNTg3Y1

Yes, that procedure can be successful as long as the damage wasn't too severe. I prefer to run data-recovery programs on the unaltered drive first, but if you're in a hurry and don't mind taking on the extra risk then you can skip ahead and attempt to repair the boot sector and the file system by using testdisk followed by chkdsk, as described in the link.

[pd00]

Thank you for your answer.

First of all. I tried Testdisk with the settings in the link... but after the 8th I had the problem that after hours of Testdisk Search routine ... Testdisk just showed me this....

http://img521.imageshack.us/img521/7/11111222.jpg

Surprisingly PhotoRec could find within 2 minutes hundreds of mp3 on the mounted device... so I am still hoping that it is possible to fix the stuff.... any Idea what to do after this message of testdisk ?

[pd00]

after a few hours of search

GetDataBack found this result

http://imageshack.us/scaled/landing/526/222222sh.jpg

sadly after clicking NEXT... I just found some garbage files called $MBR oder $MBRMirr ...

any thoughts folks ?

[pd00]

And now we go ahead...

I retried GetDataBack with intense settings and now it found EVERYTHING... Name, Folder Hierarchy ... etc...

http://s14.directupload.net/images/121009/6o2lm2ir.jpg

Why is it impossible to just repair it.... I am really confused about that :-/

[dantz]

It's unrealistic to expect to get back all of your files if the MFT is damaged. Humpty Dumpty was in a similar situation, but I think you're a bit better off. Use photorec and other file-carving programs to recover as much as you can.