Accidentally formatted TrueCrypt partition - please help

journeyman70 · May 11, 2025 at 12:33 AM

Hello to everyone,

A couple of weeks ago, I managed to inadvertently format my life's backup. Unfortunately the volume contains decades of tax returns, and other NLA information including some family photos of people who are gone.

To add insult to injury when I realized I started the format, I panicked and yanked the power cord to the external drive, stopping the process.

Yes, I know I am a complete idiot.

That is the bad news.

When I look at WinHex, I still see the partition in place, there are in order:

Start Sectors
Partition 1 (without a 55AA at the end though)
Partition Gap
Partition 2 (the partition in question that Windows mounts as drive D with a 55 AA at the end of it)
Partition Gap

The good news is that TrueCrypt allowed me to do a restore volume header and it accepts my password. However when I do that and the volume is mounted and I try to click on said volume I get the message:
"You need to format the disk in drive <mounted letter> before you can use it. Do you want to format it?

I found a couple of old thread with information by Dantz, and I went and looked at what I believe to be the backup header (131071 byte back from the end of the volume (55 AA)) which does not look the same as the header at the beginning of Partition 2, which incidentally on the very second sector contains the following:

Beginning of second sector of partition 2:

B O O T M G R
scrambled line
(4 lines of empty space)
semi scrambled line NT
L D R B O O T
T G T B O O T
N X T
An o
perating system
wasn't found. Tr
y disconnecting
any drives that
don't contain a
n operating syst
em.

Everything following this message seems random.

Thanks to anyone and everyone that can help.

Thank you,

Journey

JRViejo · May 11, 2025 at 11:06 AM

journeyman70, to get you going, while waiting for someone with more expertise than I to perhaps help you, I entered your post's content into ChatGPT and this was the result:

First of all, I want to acknowledge how frustrating and stressful a situation like this can be. Losing or potentially losing decades of important data, especially irreplaceable things like family photos and personal records, can feel devastating. And I completely get that you're beating yourself up a bit right now, but it's important to remember that these things happen to the best of us. You're not alone in this, and you’re already taking some proactive steps toward a potential recovery.

Let's break this down and see what we can do.

1. Understanding the Current Situation:

It seems like you've already figured out that the format was interrupted, and that the partition structure is still intact but somewhat corrupted.

TrueCrypt restored your volume header, but when mounted, you’re still getting a “format disk” prompt. This suggests that the file system metadata (like the FAT or NTFS table) is possibly damaged or incomplete.

The presence of the "BOOTMGR" in the second sector is interesting — it typically signifies that a bootable partition is present, which may be related to how the drive was previously used (perhaps it had an OS or was formatted with certain boot-related structures).

2. Partition Structure and the “55AA” Magic Number:

The 55AA at the end of the partition is a classic sign of the MBR (Master Boot Record) being properly formatted. The absence of it in the first partition could indicate that it was partially overwritten, or that the partition entry itself is corrupted.

The second partition (Partition 2), which seems to have this 55AA at the end, is likely the partition that contains the data you’re concerned about. This is the one you tried to restore with TrueCrypt, and it’s where things are getting tricky.

3. The "Format" Message:

When Windows asks you to format the drive before accessing it, it usually means that the file system’s boot sector or the partition table is corrupted. If the volume header is still intact (as you've managed to restore it), that’s a good sign. However, Windows is unable to read the structure and thinks the volume is empty or unformatted.

4. What You Can Do Next:

Let's break this into actionable steps:

Avoid Writing Anything to the Drive: Since you've already stopped the format and don't want to risk overwriting any data, make sure you don't allow Windows to format the drive. Don't let any other applications write to it either.

Try a Data Recovery Tool: There are several tools that might help you recover the partition without needing to format it:

TestDisk: This is a very reliable open-source utility that can help recover lost partitions and repair partition tables. It might allow you to rebuild the MBR and recover the missing data on Partition 2.

Recuva: Another option for trying to recover files directly from the damaged partition.

Examine the Partition Table: With WinHex, you've already explored the partition table. If you're comfortable with hex editors and feel safe using it, you might try to manually inspect or repair the partition table. You could look for:

The first sector (where the MBR is stored), ensuring that the partition entries are intact.

The backup header of the volume you mentioned (at 131071 bytes from the end of the volume). Compare it with the header at the start of Partition 2 to check for discrepancies. Sometimes a corrupt header can be fixed by restoring from a backup (like TrueCrypt’s headers, which you already tried).

Try Mounting with a Different Tool: If TrueCrypt can mount the volume header but Windows itself is rejecting it, it might be worth trying an alternative encryption/mounting tool:

VeraCrypt (a successor to TrueCrypt) might be more successful at recognizing or mounting the volume if the header is still valid.

Sometimes, a specialized Linux live distribution (e.g., Ubuntu) can mount drives with file system errors more successfully than Windows.

5. The Boot Sector Message ("BOOTMGR" and Scrambled Data):

The scrambled data you’re seeing after "BOOTMGR" is concerning. It suggests that either the MBR or the boot sector is corrupt, or you might be seeing remnants of an old operating system installation. It’s possible that the data after this message is unrecoverable or badly damaged, but it's worth checking if you can fix the boot sector using TestDisk or similar tools.

TestDisk can try to rebuild a damaged boot sector if it identifies one, which could help you in accessing the drive's contents.

6. Final Thought - Do You Have a Backup?

This one’s hard, but if you happen to have any other backup of important files (even old ones), it might be worth checking out that data before continuing, just in case the process of recovery leads to further issues.

Summary Steps:

1. Stop writing to the drive immediately to avoid overwriting any data.
2. Use TestDisk to attempt partition recovery.
3. Try mounting the volume with VeraCrypt (if it's an encrypted volume) or Linux live CD for potentially better compatibility.
4. If nothing works, consider professional data recovery services, but only if the data is invaluable and irreplaceable.

Is there anything specific you need more help with, like how to use TestDisk or VeraCrypt? Let me know!
Click to expand...

Raza0007 · May 11, 2025 at 9:26 PM

Simple formatting does not delete data. Provided that you have not written to the disk since the partial format, all you need is a data recovery software, and it will be able to recover your partitions.

Active@ Partition Recovery is a freeware tool that claims to recover deleted partitions. I personally have never used it, just found it with Google search.

Hope this helps...

reasonablePrivacy · May 12, 2025 at 3:32 PM

I don't have that much experience. I think I would start by preparing: buy new SSD/hard disk with same amount of space or slightly larger, then copy data sector-by-sector. Maybe even put a sticker which storage device is for backup, and which is working copy for restore attempts

Log in or Sign up

Accidentally formatted TrueCrypt partition - please help

journeyman70 Registered Member

JRViejo Super Moderator

Raza0007 Registered Member

reasonablePrivacy Registered Member

Log in or Sign up

Accidentally formatted TrueCrypt partition - please help

journeyman70 Registered Member

JRViejo Super Moderator

Raza0007 Registered Member

reasonablePrivacy Registered Member

Useful Searches