Anyone use testdisk to recover a truecrypt partition (or any partition for that matter) ?

Discussion in 'encryption problems' started by chrome_sturmen, Aug 2, 2014.

Thread Status:
Not open for further replies.
  1. chrome_sturmen

    chrome_sturmen Registered Member

    Joined:
    Apr 29, 2006
    Posts:
    785
    Location:
    Sverige
    Hey folks:

    Well,
    I have a 3tb (storage, not system)harddrive, with 2 partitions : One 3gb unencrypted (regular) ntfs partition, and then a second 2.7 odd tb encrypted partition with truecrypt - so the disk had 2 partitions.

    Last night, truecrypt popped up a warning that said roughly "the truecrypt volume has been automatically unmounted (this can happen if an enclosure or a drive has gone bad)" etc etc..
    I put the drive in another enclosure - the drive shows up fine but is now just one big 3tb unallocated space, both partitions are "gone" and windows says I need to initialize the disk (something I won't do).



    I grabbed testdisk and started working with it - when I open testdisk, select the harddisk, then select EFI/GPT, then Advanced>File System Utilities, I get the following partition layout for the disk, which actually looks correct:
    The first partition = looks like the 2.7 tb truecrypt partition
    The second = looks like the regular 3gb ntfs partition I created after the truecrypt partition :
    (note that with the second partition highlighted which is the regular 3gb ntfs partition, I get the option to undelete the partition):

    utils.jpg

    whereas with the first partition highlighted which is the encrypted partition, I get no option to undelete (because it's not a standard filesystem i assume?):

    utils2.jpg

    When I run a scan on the disk (using the Intel/Pc partition type) I get the following scan results: that highlighted partition looks correct, it's the size of the one I created. The other 2 above it, I don't know what they are I never created them. The scan did not detect the 2.7 tb encrypted partition because I believe that scan type only detects ntfs/fat partitions:

    scan2.jpg

    I figure, I need to at least get the partition layout back to what it was when I encrypted that partition with truecrypt, if I ever want to get it mounted again, whether normally or with an embedded backup header. I'm wondering if I should undelete the 3gb ntfs partition that testdisk detected, as a start?

    Thoughts appreciated *puppy*o_O*puppy*
     
  2. chrome_sturmen

    chrome_sturmen Registered Member

    Joined:
    Apr 29, 2006
    Posts:
    785
    Location:
    Sverige
    Please disregard the mentioning of testdisk in the above post - I was able to recover the ntfs unencrypted partition using another program - it was recovered with the proper size, volume label intact, the files in it, and at the correct location on the hard-disk (end of the disk).

    [​IMG]

    Having recovered the ntfs partition at the proper location, leads me to think that the truecrypt partition at the beginning of the disk, may just be salvageable somehow - I haven't done any formatting to the disk (though obviously the partition tables got corrupted).

    Anyone know what I might try next? That raw partition is the correct size and in the same place as the truecrypt partition was, and since I haven't formatted, maybe there's something I can do yet.
    Thanks ;\
     

    Attached Files:

Loading...
Thread Status:
Not open for further replies.