Hi guys Unfortunately I am one of those not so expert users that played around a bit with TC in the past and ended up with a flashdrive being stuck with the "error: incorrect volume size" issue. I thought the data was completely lost until I found this forum and saw the amazing work that you guys do. I browsed around, read and learnt already quite much but now I'm stuck in the Winhex phase where I try to construct a test file to check if my headers are still intact. I could use some tailor-made advise I'm afraid Some context: - TC 7.1 - outer and inner volume - I thought I encrypted a full 16gb usb-drive but I already learned that is probably was only a partition on that flashdrive. What worries me is that in Winhex I only see "UNREADABLESECTOR" and no partitions. https://s17.postimg.org/qcs6ud7hb/Win_Hex_-_Removable_medium_4.png Anyone who can advise me on how to proceed? @dantz saw you did some great work in the past. Care to help out one more Winhex/TC beginner? ;-D Thanks in advance guys!
I assume the image you posted is taken directly from your flash drive, and not from the test file that you created? If so, I'm not sure why Winhex is not reading your drive properly, but let's try to clarify what's going on before worrying about that. If you are getting the "incorrect volume size" when you try to mount your test file, this probably means that your test file is below the minimum size that TrueCrypt can recognize, which I believe is around 16 KB. If this is the case then you need to either 1) pad the end of the test file to make it larger or 2) the simpler solution: make another test file, and merely include more data after the header when you copy your test file from the flash drive. Take a few MB. And forgive me, but I'm quite rusty at this now. I haven't provided any TrueCrypt support in years and I've forgotten many of the details.
Hi @dantz Thanks for answering! Much appreciated! The screenshot is idd of the flash drive itself. I'm afraid I've not been able to create a test file yet. I've tried to select a block with some of the numbers I found in other posts but until now I failed. Can I deliver you any kind of info that will allow you to suggest offset numbers that I can use to create a test file? The "incorrect volume size" is the TC error message when I get when I try to mount the volume directly from the flash drive. I get it when trying to mount both the inner and outer volume (usage of both passwords).
OK, I will think about that, but for now I'd like to address your WinHex screenshot, as we need to be able to view the contents of your flash drive. You might be seeing UNREADABLESECTOR because you are running WinHex without Administrator privileges. Open WinHex by right-clicking on the exe or shortcut, then choose "Run as Administrator" Once WinHex opens, close all previously opened tabs Tools / Open Disk / under Physical Media, select your USB drive and click OK Create a new snapshot if prompted Did this make any difference? Are you now able to see the drive's partitioning style (i.e. MBR) and a list of the various objects (Start sectors, partitions, unpartitioned space, etc)?
Unfortunately (?) I get the same result after following the steps you indicated. "Het apparaat is niet klaar" is Dutch for "the device is not ready". https://s17.postimg.org/3wnpi9z73/screenshot.png
Hmmm, not good. How far does the UNREADABLE SECTOR message go? Can you scroll past it? Does it go clear to the end of the drive? Also, when you plug your flash drive in, does Windows say it needs to be formatted? (Don't format it, of course, although it is probably already too late). When you try to mount the volume in TrueCrypt, what exactly do you select? I know you start by clicking on Select Device, but after that does TrueCrypt list the flash drive as one of your removable disks, and below that does it list \Device\Harddisk#\Partition1 as one of your choices? (# is a number which varies based on how many disks you have). I think that TrueCrypt will display Partition1 as a choice even if it doesn't exist. Just to see what would happen, I tried deleting the partition from a blank USB flash drive and then attempted to mount the partition in TrueCrypt. I got the "incorrect volume size" error message, just as you did. This particular flash drive has never had a TrueCrypt volume on it. I will explain something here about how TrueCrypt works. No matter what type of TrueCrypt volume you have or where it is located, during the mounting process TrueCrypt is completely (and intentionally) blind. TrueCrypt has no idea whether or not there is actually a TrueCrypt volume present at the location that you specify. You can point it at any disk, partition or file and it will treat them all the same way. TrueCrypt will go to the starting location of the disk, partition or file that you selected and will run a quick validity check to ensure that the item exceeds the minimum size (around 16KB I think). If the disk, partition or file is too small then TrueCrypt will return the "incorrect volume size" error and stop all further processing. If the item is above the minimum size then TrueCrypt will copy the first 512 bytes into RAM and attempt to process it as though it were a valid volume header. If the header is valid and the password is correct then it will go on to mount (decrypt) the volume. You never got close to that step because your partition does not appear to exist. I am guessing that TrueCrypt sees its size as zero. Things are not looking very promising. Just to confirm that you are using WinHex correctly, I suggest you try opening a different flash drive just to make sure that it looks normal and does not display the UNREADABLE SECTOR messages that you are seeing.
Too bad :-( The UNREADABLESECTOR message goes through to the bottom. Very consistently. When I (try to) mount it in TC it get the following options: https://s17.postimg.org/rpfed42kf/2017-12-16_09_27_17-_True_Crypt.png So you are right about the suggestion of a partition 1. And when opening another flash drive I have indeed a whole other pattern and no UNREADABLESECTOR messages. So I guess this is the end? :-/
Well, not entirely. I'm not the type of guy who gives up easily. I suspect that all of your data is still on the flash drive and it has merely become inaccessible. Maybe there is a fault in the circuitry. Possibly the memory board could be accessed another way. It might be an intermittent problem that you will recover from at some point. And it might even be a software problem. I'm no flash drive expert, but I do know that I can't help you with TrueCrypt right now, as we can't even see your encrypted data. I would be asking: What happened? Did the drive suddenly stop working for no obvious reason? Did it go thorough the laundry? Did you run some type of rescue software on it that accidentally destroyed the partitioning scheme? (Think about this carefully, as this is a real possibility). In that case then it might be possible to perform a software-based repair, but in the process you will have to be very careful not to overwrite your headers or your backup headers or you will never be able to decrypt your data. (Unless you have saved backup headers?) Sorry I can't be of more use here. Good luck!
