DD on truecrypt volume

Discussion in 'encryption problems' started by vader01, Jul 18, 2014.

Thread Status:
Not open for further replies.
  1. vader01

    vader01 Registered Member

    Joined:
    Jul 18, 2014
    Posts:
    3
    Hi all,
    this is my 1st post here and it's a sad start to be honest.

    I have a 2048WD. it was all encrypted (entire disk) yesterday mister smart here was DDing a USB stick.
    It was the second time I was doing this, on the 1st time the WD wasn't connected to the stick was mounted as SDB.
    For the second time I had to connect the WD and retrieve an ISO to DD the stick again.
    I don't know why, but instead of fdisk -l I just went straight forward to DD on DSB, well turns out that this time SDB was the WD and the stick was at SDC.
    I realized the not blinking stick and ctrl+c immediately. Hoever it wrote some data, rename the disk and put some of the ISO files there.

    I panicked of course, and I retored the volume header on TC application (auto restore) and I passed from "worng password or truecrypt volume not found" to "hdiutil: attach failed - no mountable file systems"

    I am doing a partition schema recover with disk drill on my osx right now.

    This is just to ask, is there a hope for me?
    Have I lost it all?

    Please share your expertise.
    Thanks in advance,
    Cheers.
     
  2. vader01

    vader01 Registered Member

    Joined:
    Jul 18, 2014
    Posts:
    3
    2 more notes.
    I don't have any sort of backups (DUMB ME)
    I don't have any other 2TB device to DD a raw image from the WD.

    cheers
     
  3. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    1,034
    Location:
    Hawaii
    There's hope. You merely overwrote a portion of your volume. If you can still mount it then you should try running some data-recovery software to see what it can find. Make sure you use it to examine the mounted TrueCrypt volume, not merely the physical drive.

    Meanwhile, don't write anything to the drive. Don't use any of the various "repair" programs until you know what you are dealing with, as most of them will be of no use anyway. And please explain something: You said that the entire disk was encrypted, and yet you are apparently trying to recover a partition. Is this because the encrypted object was a partition, and not the entire disk? This makes a big difference in the direction of the recovery effort.
     
  4. vader01

    vader01 Registered Member

    Joined:
    Jul 18, 2014
    Posts:
    3
    Hi Dantz,
    Thank you for your reply.

    Well, at this point I can't mount it with TC.
    After the DD I was receiving the "wrong password or truecrypt volume not found" after the header restore on TC it started to popup the "hdiutil: ..." This is the message TC pops when I try to mount the volume.

    The ecryption was across the entire disk, disk was only eiditable after mounted on TC.

    What I am doing is, I am using this disk drill for osx that does not write any data to the disk, it search for wrong sectors and ask if one wants to restore it.
    It's a 24hrs process and is still running now.

    Until this moment it had not found nothing "correctable".
    I guess that's because entire disk is crypted.
    If I could mount the disk on TC, certainly a std undelete app would do the job!
    So what I really need is to restore the disk headers to make it mountable over TC.

    Do you see a chance?
    Thank you very much for your time.

    Kind regards.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.