Able to mount the deleted TrueCrypt partition, but it is not dycripting properly

Discussion in 'encryption problems' started by AbdulMoeed Ammar, May 2, 2014.

Thread Status:
Not open for further replies.
  1. AbdulMoeed Ammar

    AbdulMoeed Ammar Registered Member

    Joined:
    May 2, 2014
    Posts:
    2
    Partition table on my external HDD got corrupted. The last partition of this HDD was encrypted using TC. I was able to recover other partitions, but not the encrypted one. So I created the partition in the remaining space using windows disk utility (Now I know that was a mistake).

    After a lot of effort I figured out that last 2MB of disk was not part of the newly created partition. So I changed the partition to include that and after that I am able to mount the partition from TC using embedded backup volume header.

    But after mounting with TC, there is only random data in the mounted disk (I checked quite thoroughly). Same is the case when I mount my hidden volume.

    Now I gather that this can be caused if the partition is not exactly at the same spot as it should be. But if TC is able to find the embedded backup volume headers, then the end point to the partition should be exactly right. Right?

    So building up from that, I thought I should be able to get the start point of the partition.

    After mounting my normal volume, I can get the Size of the volume from 'TrueCrypt Volume Properties' which in my case is '349973379072 bytes'.

    From Volume Format Specification http://www.truecrypt.org/docs/volume-format-specification, I can see that there should be extra space for 4 headers of 65536 bytes. So adding this to volume size I will get;

    349973379072 + (65536 * 4) = 349973641216

    Which I think should be the partition size.

    My HDD being 500 GB (500107861504 bytes), the partition should start at '500107861504 - 349973641216 = 150134220288' and go right till the end of the disk.

    But this is not working. So can please somebody tell me what I am missing here. Or put me on different path to get data from my Normal or Hidden Volume.
     
  2. AbdulMoeed Ammar

    AbdulMoeed Ammar Registered Member

    Joined:
    May 2, 2014
    Posts:
    2
    Never mind guys. There was in fact no problem with my understanding to calculation. I just made mistake in putting the values in partition table (was off by just one sector).

    Now Normal volume is working perfectly. There is some problem with hidden volume, but from WinHex I can see that data is being decrypted successfully, hopefully it will be easy to solve.

    Thanks anyways guys.
     
Loading...
Thread Status:
Not open for further replies.