TrueCrypt: No bootable partition found

Requesting help from dantz

Okay so here's the problem. I had Windows installed on one hard drive[#1]. I later installed Windows on another drive and then did a system encryption with TC[#2]. I then formatted and re-installed Windows on my original hard drive[#1]. The next time I tried to boot up the TC drive, the bootloader was still intact and the password still worked but apparently something happened to the filesystem(?).

I've tried a number of things, including Testdisk, chkdsk(which doesn't work because of a filesystem error), the TrueCrypt rescue disk, and various other attempts, nothing seems to work.

Yes, I do have a image backup but it's after the problem with Windows. I created an image before I did any further tampering though.

After checking out many help threads, and what dantz had to say on TrueCrypt issues it seems there's nothing I can do to restore the drive. Please tell me there's something I haven't tried that could work.

 

Apparently both hard disks were connected during the reinstallation of Windows on Drive1, and Windows decided to "fix" the second (encrypted) system drive, which Windows didn't recognize as being valid. This happens to a lot of users. You're supposed to disconnect all possible TrueCrypt volumes and drives before reinstalling Windows, and back up those that can't be disconnected.

However, I'm surprised that your TrueCrypt bootloader still works but the file system doesn't, as it's usually the other way around. There's obviously a lot more to the story than you have posted thus far.

Based on what you have written, I would try this:

Boot to Drive1 while Drive2 is connected

Open the TrueCrypt interface

click on "Select Device"

Find your encrypted system partition on the list of devices (probably HardDisk1, Partition1), click on it, and click "OK"

In the list of free drive letters, click on one of the free drive letters (any one, doesn't matter) that you wish to mount your volume to

Choose the "System: Mount without preboot authentication" command

Enter the password when prompted

If you got this far, hooray! Now try using Windows Explorer to browse through the contents of the drive letter that you used to mount the volume

If you can't browse the volume (for example, if Windows wants to format it), then you might need to explore the mounted volume using data-recovery software in order to find some of your lost files. (DON'T let Windows format the volume.)

 

Yeah, now I realize.

Yes, I can get this far and the drive mounts. But instead of Windows letting me browse the drive, it asks me to format. It even lets me check the properties of the drive in TC.

A few options though such as "Permanently decrypt system drive" results in "the system partition does not appear to be encrypted".

I've heard of SpinRite and GetDataBack, I haven't tried any recovery software yet but I have PhotoRec, EASEUS, and DiskInternals ready to be tried. I was wondering if SpinRite or GetDataBack were any different than the others.

 

I don't know that much about SpinRite, but I've never considered using it for these types of situations. Doesn't SpinRite focus more on hardware issues and recovering data from failing disk sectors etc.? I don't think that's the situation here. This is more of an accidental overwrite screwup.

I like to start with GetDataBack, even just the eval version, just to see if it can find anything, as it's pretty good with file system damage. If it can't find anything then the file system is worse off than hoped, in which case you might need to fall back on a data-carving program such as PhotoRec or File Scavenger. Data-carving programs don't need a working (or even a half-broken) file system. Instead, they search the drive (or the mounted volume, in your case) for known file headers and footers, which means that your file types have to be supported by the program or it won't be able to find them. Unfortunately, these programs also find a lot of deleted files, and they usually can't reassemble fragmented files.

There are a lot of other good data-recovery programs out there as well, and I'm by no means a data-recovery expert. My specialty is in helping users regain access to their TrueCrypt volumes, but once you're able to mount your volume and view some or all of your decrypted data (perhaps using WinHex or GetDataBack if necessary) then you reach the limits of my expertise. There are other guys out there who know a lot more about data-recovery procedures, and the methods are pretty much the same whether you're recovering data from a mounted TrueCrypt volume with a damaged file system or an unencrypted disk with a damaged file system. In fact, if you find a program that looks really promising but for some reason it doesn't work well with mounted TrueCrypt volumes then you can copy (or clone) the entire contents of your mounted volume to another location as plaintext, and then use the desired program to examine it.

 

Something I don't understand, how am I able to recover data if the drive was encrypted?

But anyway I tried EASEUS and it's showing me some files, so I guess I can at least make a partial recovery. I'll try the other software like GetDataBack and see if there's a performance difference.

Is there anything else you think I could try to restore the original Windows filesystem? Thanks for the help so far.

 

If you're using data-recovery software to explore the mounted TrueCrypt volume, using its assigned drive letter, then TrueCrypt's on-the-fly decryption is making your data visible to the data-recovery software.

However, if you're exploring other areas of the disk (not a mounted volume) and are finding data then that data is already in plaintext. Did you attempt to decrypt one of the drives? Or overwrite it with fresh data? Perhaps something like that occurred.

Incidentally, my focus is always on data recovery. If your interest is more towards getting your OS working without reinstalling it or restoring it from an image then some of our other forum members will probably be able to help you better than I could.

 

Yes I did attempt to decrypt but I did not receive confirmation that it was successful. I have it mounted also, so I'm not sure which is it. I'll perform some tests later on in my own time, to make sure it's encrypting properly.

It seems most, if not all, of the files are intact so I'm just going to go with file recovery and then redo what I was trying to do before the proper way (" You're supposed to disconnect all possible TrueCrypt volumes and drives before reinstalling Windows, and back up those that can't be disconnected. ")

Thanks again man, I appreciate it.