Accidentally deleted Truecrypt partition

wilder7500 · Jan 16, 2014

dantz said:

That's a Windows thing, not TrueCrypt's doing. I think you can just right-click on the drive (in Windows Explorer) and click Properties, then type in a new name for the mounted volume.

Well, that's most of it, but you could make more than one header backup and store them in separate locations. You could write down your password and store it somewhere safe and offsite (if you dare). You could have more than one backup drive and alternate your backups between the two drives, just in case one of them fails or gets screwed up during a backup. That sort of thing.
Click to expand...

Yes, it seems you can just change drive letters and labels as you please without affecting the encryption, cool. Everything is fine now, thanks dantz for you help. Your detailed explanations is what made it so effective.

dantz · Jan 16, 2014

Great! Glad I could help. Congratulations on getting your data back.

ptmoy2 · Jul 16, 2014

dantz said: ↑

Probably.

Most partition recovery tools will be unable to help, since encrypted partitions don't have any recognizable signatures for them to work with. If you had a backup copy of the partition table that would be quite helpful.

It should also be possible to use a hex editor such as WinHex to go to the very end of the first partition, then go one byte farther to pick up the beginning of the second partition (assuming no partition gaps, that is). This location can be tested for the presence of the TrueCrypt header (which is always located at the very beginning of the partition) by using a combination of WinHex and TrueCrypt, as described in several of my previous posts. The technique would have to be adapted to your situation, but the basics are pretty much the same.

Once the header has been confirmed, it's merely a matter of using WinHex to create a large file that contains the entire contents of your lost partition, and then mounting the file in TrueCrypt.

Many details have been excluded because my brain is still on break, but to answer your question: Yes, I think so.
Click to expand...

Hi Dantz,

Thanks for posting these useful instructions. I have a very similar but slightly different situation than the original poster of this thread. I have a hard drive with 3 partitions. The first 2 are regular NTFS partitions, and the 3rd is a truecrypt partition. I deleted the 2nd and 3rd partitions, so now win7 disk manager shows the 1st partition and unallocated space for remainder of disk. How do I modify your instructions to recover the 3rd (i.e., truecrypt partition)? I don't care about the 2nd partition.

Thanks in advance.

kayceegeek · Nov 28, 2014

dantz said: ↑

8. Press "Ctrl+End" to go to the end of the partition. (The partition probably ends with "55 AA". Let me know if it doesn't.)

9. In the information pane on the side of the screen, note down the "Physical Sector No." that your cursor is now in. Try right-clicking on that number and then using WinHex to copy that particular entry.
Click to expand...

I am in a similar mess as this. Our sysadmin formatted the C drive of a laptop with a single harddrive containing 3 partitions and re-installed Windows. This has rendered partition 3 as unusable and the remaining drive is seen as free space (all 200+ GB of it). I am trying to follow the guide above but I am unable to get the sector numbers in WinHex. Additionally for me, partition 3 is not getting mount on truecrypt since the OS partition was wiped out by the admin. How do I go about:

1) Recovering partition 3 which says incorrect password or not an encrypted volume.
2) Recover data from the 200+GB partition that shows up as free space in Windows.

http://i.imgur.com/2gBhohK.png

ajsenh · Dec 11, 2014

Hello, i have a big problem, i lost lots of work data in TC volume/file i have it on usb then for one friend i was making win boot usb and i put win tool to create the boot usb on my usb and not on the new one...so i lost all of the data in my usb they win usb dvd format the usb and add the win system files on it....
So please dose anyone know is it possible to make backup on that because it is life important to me ...usb it is 16GB TC volume/file was 14Gb and i it was added to the usb new data ~1Gb...btw is it possible to bring it back something or some part of it?!

TNX a lot!

vikas9420 · Oct 12, 2017

dantz ,I am stuck at step 13 when I try to put next sector number it doesn't go anywhere (physical sector "976769023" , I am trying to put "976769024".
Also , the navigation pop up has only one option logical sector .
Note that partition doesn't end with "55 AA"
https://i.imgur.com/TIv4BBE.png

https://i.imgur.com/TIv4BBE.png

John Pristine · Feb 20, 2018

dantz said: ↑

OK, I'm back.

You can use WinHex and TrueCrypt to test for the presence of the TC header at the beginning of what used to be Partition 2. If you're able to successfully locate the header then you can use WinHex to recover the entire partition by selecting all of its data and saving it as a file.

The first thing is to locate the starting offset of your lost partition. We'll start out by assuming (or hoping) that the second partition used to be located immediately behind the first partition, with no partition gap (unallocated space) between them.

Note: If the procedure I've written below doesn't work for you, or if you'd prefer a much simpler approach, then another way to go would be to restore the MBR and Track 0 from your most recent backup. This would be very quick and easy, and it would probably work, but it's also a bit riskier than the method I've proposed.

The risk comes in because many backup/restore programs will actually redefine the partition boundaries during a restore (thus giving the user the option of shrinking/expanding them, etc.), which is the one thing that you don't want to have happen, especially since your lost partition is now in unallocated space and thus is very vulnerable to being "messed" with. Maybe that wouldn't happen if all you did was restore the MBR and Track 0, but unfortunately I have no way of knowing that. Ironically, I'd want to make a good sector-by-sector backup of the current system before attempting it.

Of course, the big advantage of the above-mentioned method is that it's very quick and it doesn't require you to purchase a licensed copy of WinHex. So if you don't mind taking on the added risk and you want to try solving this thing quickly and easily then be my guest (and please let me know how it turns out).

Otherwise, the following is the "longer, safer, more expensive and considerably more cumbersome" approach:

Note: The following isn't the full procedure. It's a test to see if the full procedure will work. All of the steps in this post can be accomplished using the free Evaluation copy of WinHex. However, that version isn't able to save large files, so you will need to obtain a licensed copy before you can perform the actual partition recovery. I will post those steps only if you are able to successfully perform this procedure first.

I suggest you start out with the evaluation version of WinHex in order to see if we are on the right track. There's no point in your buying a full copy if this won't work for you.

OK, here are the steps:

1. Open WinHex

2. Options: Edit Mode

3. Ensure that you are in Read-Only mode. Change it if necessary.

4. Tools: Open Disk

5. Select the Physical Media that represents your data drive containing the lost partition, then click OK

WinHex should open the selected disk. There should be a tab that identifies your disk (it probably says "Hard Disk 1"). Below that is the WinHex "directory browser", which lists that disk's existing partitions and other structures. Below that is the actual data in bytes (displayed row-by-row as both hex and text).

We want to place your cursor one byte after the end of Partition 1, but there isn't a direct way to do that, so we need to use a roundabout method:

6. Double-click on "Partition 1" to open that partition in a separate tab.

Note that WinHex now displays two tabs. The second tab might say "Hard disk 2, P1" or something like that. The contents (files, folders etc.) of Partition 1 should now be displayed in the data area.

The "hex" and "text" columns are displayed below the directory browser. There should be 16 column headings (0 through 15) above the hex. (If you see columns 0 through F then you're in hexadecimal mode, in which case some of these instructions will not work as written. If this is the case then click once in the Offset column to switch back to decimal display.)

7. Click once somewhere in the "hex" column to place your cursor there.

8. Press "Ctrl+End" to go to the end of the partition. (The partition probably ends with "55 AA". Let me know if it doesn't.)

9. In the information pane on the side of the screen, note down the "Physical Sector No." that your cursor is now in. Try right-clicking on that number and then using WinHex to copy that particular entry.

10. Click on the "Hard Disk 1" tab to switch back to your entire disk.

11. Navigation: Go to Sector

12. Paste the Physical Sector number that you just obtained into the "Sector" box.

13. Edit the number by adding one sector. (For example, change "51199154" into "51199155").

14. Click "OK"

Your cursor should now be exactly where we want it to be, one byte past the end of the previous sector and partition. You should be looking at totally random data (the first 512 bytes of the TrueCrypt header). If you can see any obvious patterns (such as long strings of zeros like this: "00 00 00 00 00") or any recognizable words in the text column (such as "NTFS") then you're likely in the wrong place, in which case stop here and post your results.

Now we want to select a block of data that begins at this offset and extends forward roughly 20KB, and save it as a file (for testing purposes), as follows:

15. Edit: Define Block:

16. Under "Beginning", click on the dropdown and select "Current Position". Note that WinHex displays the exact starting offset in the left-hand box.

17. Copy the number from the "Beginning" box and paste it into the left-hand "End" box, so that both boxes contain the same number.

18. In the "End" box, edit the number by adding approximately 20,000 to it. I usually just count in five digits from the right, and increase that number by 2. (For example, 57675623360 becomes 57675643360). Then click OK.

If you got it right, the "Size:" number in the bottom right corner of the screen should now be showing 20001, or very close to that. (It doesn't have to be exact, just reasonably close. We're just trying to exceed the minimum allowable size of a TrueCrypt volume so it won't trigger an automatic error message when we mount the volume.)

19. Edit: Copy Block: Into new file

20. Select a location that has room for a 20KB file, give the file a reasonable name (such as "HeaderTest1.tc") and then click Save. (The .tc extension is optional).

20. Close WinHex

21. Open TrueCrypt

22. Click on Select File, then locate and select the test file that you just created, then try to mount the volume. (i.e. assign a drive letter, click on Mount, supply the password and click OK).

All we want here is for your password to be accepted. If your password goes through without any complaint and if the test volume actually "mounts" to the drive letter that you selected, and if you don't see the "Incorrect password or not a TrueCrypt volume" message, then you're good! You've located and copied the intact TrueCrypt header, which also marks the beginning of the lost partition, and that's all we needed to accomplish. The mounted test volume is just a tiny fragment of your lost volume, so it will not contain a working file system or be searchable by Windows Explorer.

If the above test was successful then the next step will be recovering the entire partition by performing a much larger version of what you just did.

However, if you're stuck on the "incorrect password or not a TrueCrypt volume" message then we missed the target and will have to go back and reconsider our approach.

OK, That's enough for now. Were you able to make it this far?

PS: I can't guarantee that everything above was written with 100% accuracy and I apologize for any errors that may have crept in. Hopefully you'll be able to figure it out. Let me know if anything seems unclear.
Click to expand...

Hi DANTZ, please help me to discover STEP 13
13. Edit the number by adding one sector. (For example, change "51199154" into "51199155").
What number I am supposed to entry here?
My problem is: I had in WINDOWS XP a external HARDDISK, I crypted full disk with TRUECRYP but accidentally I marked it as deleted, I only marked it as deleted in Disk Admin Tool (Windows XP), but I never made a format, I am thinking it was only one bit changed of value, ACTIVE -> DELETED, but the disk is still with data, If I tried classical solutions, all of them assumeed to recover a disk (not crypted) and to put together parts of files, but in my case, I have no parts of files, I have only 1 disk marked as deleted by accident, PLEASE HELPME.

John Pristine · May 11, 2018

Hi Dantz!

Maybe you are the only man who can help me, I did following.

Using Windows XP, using an external HDD, 128GB, I created a full container disk with TRUE CRYPT 6, then by "mistake" in Computer Management, Disk Mangement, I made a right click "Delete Partition" on this disk (the wrong one), when I realized it was too late, but I never formated the disk, so I belive, there is still my info, I tried the steps you mention here but I stopped in Step # 14, ¿could you please help me? let me know if may send you some snaps?

Thanks a lot man!

Log in or Sign up

Accidentally deleted Truecrypt partition

wilder7500 Registered Member

dantz Registered Member

ptmoy2 Registered Member

kayceegeek Registered Member

ajsenh Registered Member

vikas9420 Registered Member

John Pristine Registered Member

John Pristine Registered Member

Log in or Sign up

Accidentally deleted Truecrypt partition

wilder7500 Registered Member

dantz Registered Member

ptmoy2 Registered Member

kayceegeek Registered Member

ajsenh Registered Member

vikas9420 Registered Member

John Pristine Registered Member

John Pristine Registered Member

Useful Searches