Truecrypt Windows got corrupted, Cannot Mount or get any files back

Hello,

I have been up all night trying to figure this out and getting nowhere. So I have a laptop (Lenovo X61) with Truecrypt on it and Windows 7 X64 totally messed you. I get this error

"File: \Windows\system32\config\system. Status: 0xc000000f.
Info: Windows failed to load because the system registry file is missing, or corrupt."

Firstly, you should know that Truecrypt never fully encrypted the whole drive. It only got to about 65% and then found partitions that were bad and could not continue. The rescue disk that I had snapped in half and I cant use it.


I have tried everything and can't get any of my files back. I really need to get them back. Can anyone please help me?
I just need any software to read my files.

I tried Parted Magic went to Truecrypt click on all volumes one by one /dev/sda to /dev/sda1 to /dev/sda2 and nothing mounted. But a strange thing happens, if I don't click pre-boot authentication, I always get this error:
Wrong mount mode, incorrect keyfile(s) and/or password, or not a TrueCrypt Volume. EVEN when I type in the right password

and when I click pre-boot authentication
I always get this error but at least it works with my right password:

Error: The process of the encryption of the partition/drive had not been completed. It must be completed first.

Is there anyway to force this to mount? I would like to get the .iso for TrueCrypt off my drive (if it is there somewhere) or any files if possible. I really need my files!

I then tried the command line version with SystemRescueCD


I did this

mkdir /tmp/systmp

truecrypt -t -m ro,system --mount /dev/sda1

# when TC asks for the mount volume enter:

/tmp/systmp

Still get all the same errors above.



Is there anyway to get access to my files? I know the password to get pass the Truecrypt screen to get into the windows loading part. But then windows just crashes and I cant go further. Is there a way to make it boot from a CD after I pass the truecrypt boot lock screen? Please any help would be appreciated, I need my files for school ASAP!

 

Before you start, keep in mind that only 65% of your disk is encrypted. If any of your data resides in the other 35% then you might be able to recover some of it right now using data-recovery software. I would focus on using 'file carving' software that does not require a file system, such as Photorec.

OK, back to your main issue. I'm not sure if this will work or not, but you might want to try it:

1. Create (or borrow) a TrueCrypt rescue disk that was created on a different system, even an unencrypted system. For an unencrypted system, you don't actually have to encrypt it, but you do have to begin the process of setting up encryption, up to the point where the rescue disk (or the iso file) gets created. Then cancel the process before actually encrypting anything, as all you want is the disk.

Or, if you know somebody who already has an encrypted system, just borrow their rescue disk or ask them to create a copy. It's very easy to do this from within the TrueCrypt interface, or you can just make a copy of their truecrypt rescue disk.iso file and then burn your own disk.

2. Use this TC rescue disk to boot your system, and then choose the Decrypt option. It might be able to reverse your incomplete encryption and take you back to 0%, although it will be quite slow, like several hours or even days for a very large drive. (I have not tested your exact scenario and I'm not sure if it'll work or not, but it might.)

3. If you are able to decrypt the system then you can do whatever it takes to get your data off. Windows is apparently broken, but you should still be able to slave your disk to another PC or boot to another OS to copy off your files, etc.

Warning: Do NOT use the TC rescue disk that was created on a different system to restore the TC bootloader, the original Windows bootloader, or the Key Data. They will be wrong for your system and will only make things worse. Make extra sure that you do not use that disk to restore the Key Data or you will never be able to access your encrypted data again.

I hope this helps. Actually, I'm not sure how it'll go, as you're in pretty deep.

 

I will try this out ASAP. I woke up early to do this. I know the ISO for the rescue is on the disk so if I can just access it, I should be good to go... What software would you suggest for recovery... maybe it is on the 35%? Also, there is no way I can temp fix windows?

 

Although it would be preferable to use your own .iso, if it's stored within your encrypted system then you currently aren't able to access it and thus you will have to use one from a different PC. It'll still work for what I described, but heed my warnings and don't use it for anything else.

Note: It's not a good idea to leave an encrypted system in a partially-encrypted state. As you have discovered, the "mount without preboot authentication" command will not work unless the partition or disk is 100% encrypted.

I suggested PhotoRec, which comes with TestDisk. Data-carving software looks for known file signatures on the disk, so there are various limitations: Your file types must be supported by the program; fragmented files are often not fully recovered; and deleted files will sometimes be recovered even though you may not want them. File names are normally lost.

I don't know of any way to temporarily fix your installed copy of Windows. You can't boot into Windows because it's broken, and you can't access the OS partition from another PC or OS because your volume is only partially encrypted. You're gonna have to decrypt.

As for your TC rescue disk, I normally recommend that users create a backup disk, as well as storing a copy of the .iso file in a backup location. That way you can play frisbee (or whatever) with the disk and still be able to recover your system if, say, your dog accidentally snaps it in half. (Is that what happened? You didn't say, so I thought I'd make up a fun scenario. OK, come on boy, give me back the disk now, let go, gimme the disk, let go, come on, let go, let go dammit, oh no, it snapped! Bad dog!)

 

Jimic,
I have this exact issue. Did using the recovery disk from another system work?
Thanks