Accident with Truecrypt non-system partition, possible to recover?

Discussion in 'encryption problems' started by ShanLou, May 16, 2013.

Thread Status:
Not open for further replies.
  1. ShanLou

    ShanLou Registered Member

    Joined:
    May 16, 2013
    Posts:
    2
    Hi. I think I'm shock right now. :D I wish someone could help me...

    What happened:
    I was reinstalling OS (windows [noparse]:cool:[/noparse] and i had to do it about 10 times, because I had to figure out how to repartition with MBR and not with GPT, which TC does not support. At last I successed, but at some point, the Windows installation didn't create a system partition to my OS-SSD, instead it did that to one of my truecrypted hard drive! (Lesson learned, allways remove any other HDDs). So when I tried to mount it in TC, it said that "the volume header is corrupted"-thing. Now in Windows, it is shown as empty NTFS drive, disk size is 931GB and used space is 226MB (there is no visible files).

    Is there any possibilities for getting my files back? :(


    Edit: Okay I've been reading other threads for instructions and now I have cloned the drive and managed to mount it using embedded header. Shows as empty drive in Windows but I'm using GetDataBack for NTFS to see what I could recover at this point. I downloaded WinHex but don't know how to use it in this situation or should I even.
     
    Last edited: May 17, 2013
  2. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    1,034
    Location:
    Hawaii
    You're doing just what I would have suggested. Is GetDataBack finding any of your data, or at least some recognizable filenames? If not, try PhotoRec. You don't need to use WinHex at this point.
     
  3. garry35

    garry35 Registered Member

    Joined:
    Jan 20, 2009
    Posts:
    480
    i would be seriously concerned if it was possible to recover under ANY circumstances
     
  4. ShanLou

    ShanLou Registered Member

    Joined:
    May 16, 2013
    Posts:
    2
    I don't know what options to choose with GetDataBack...

    Well I just unticked "quick search" from MFT options and now it started to find my mp3's at least... But it shows "size=0" for every file.. And it finds thousands of BMP's but that's weird because I don't have those that much in my drive... :doubt:

    http://i39.tinypic.com/1q5wg7.jpg


    edit: YES!! I think it found almost all my lost files! I'll try a couple of other programs before I start the copying process...
     
    Last edited: May 21, 2013
  5. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    1,034
    Location:
    Hawaii
    Congratulations, you're one of the lucky ones.
     
  6. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    1,034
    Location:
    Hawaii
    In situations like this, as long as the encrypted data (or some of it) remains on the drive, the encryption header (or a backup) is still intact and the user is able to supply the correct password (and keyfiles, if used), then there will almost always be the possibility of recovering some data, although sometimes it can be extremely difficult.

    It's not like the OP is attempting to crack the encryption scheme or anything like that.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.