Hi all, I have a flash drive that was encrypted with truecrypt that seems to have been corrupted at one point. I am running OSX 10.9.2. It does not mount, but instead displays the error "hdiutil failed: no mountable file systems." When I set the option "File system: Do Not Mount" I can successfully mount the drive, but obviously can't read any data. What steps should I take next? I have cloned the drive to another that I can experiment on. TC
So I have opened the drive in HexFiend after mounting the drive (but not mounting the file system) and it doesn't seem like the data is decrypted. Any help?
Mount the flash drive, then use data recovery software such as Runtime Getmydataback and Recuvva to get your lost data. Might be data table corruption.
Thanks! Again, raising this from the dead because I made some more progress. I mounted the drive but not the file system and set it as read only, and used dd make a copy the (presumably unencrypted?) data. I also tried running some file recovery software on the mounted (container, not file system) drive, recovering some FILE00X.SWF files (where X represents a number). However, these files don't seem to be anything real, although their sizes matched approximately what I remembered was on the drive. I also ran photorec on the copied drive and that recovered some corrupted .jpg files: again, nothing I could open. Am I approaching the problem correctly? What might be my best path to recovery? I have a suspicion this all came as the result of the original USB drive being improperly ejected. The fact that it decrypts gives me hope, but was I correct in dd-ing the mounted, decrypted drive and then attempting the recovery process on that?
More information: I opened the drive in Winhex and now see that it doesn't look like TC is actually decrypting anything, even though the password is being accepted and it's mounting the drive (not the file system, however). This would explain the lack of a file system, and points to something on the encryption side as the cause. Anyone know what would cause the password to be accepted and the drive fail to be decrypted? Also, one final piece of information after reading about this issue for a while: I started having this issue shortly after upgrading my system from OSX 10.6.8 to I believe 10.9. I've seen some people mention the incompatability of MacFUSE with later operating systems so I'm wondering if that was related to the issue. (I did not perform the upgrade while the USB drive was plugged in, I only figured it out later)
is this the same usb stick you been trying to decrypt for the past two years? now that is determination!!!!! https://discussions.apple.com/thread/3827411?start=0&tstart=0
Hahaha, yep. I figured the data wasn't going anywhere, and I get motivated to try and recover it about every year or so... If I could figure out why the password is being accepted but the drive doesn't seem to be being decrypted, that would be a first good step.
what version of truecrypt are you using? and here is some info from grc in case you may have missed it. https://www.grc.com/misc/truecrypt/truecrypt.htm
nother couple sites.. 7.1a is the last known working version https://www.reddit.com/r/AskNetsec/...t_open_truecrypt_with_current_version_of_os/? http://stackoverflow.com/questions/20782416/truecrypt-on-mac-os-x-10-9
7.1a I knew about the developers ending support at 7.2, but it didn't really affect my decision to keep using it. Since the audit was successful, it's actually now the most secure option out there (since it's the only encryption option that's actually been audited)
Any help from anyone here? I still haven't found a solution to my "hdiutil failed: no mountable file systems" issue. Where in the chain is the failure given that TC knows I entered in the right password, but then doesn't decrypt the data or mount the filesystem?
Have you tried asking the veracrypt devs? They forked truecrypt so they probably know more about it than most.