Anyone use testdisk to recover a truecrypt partition (or any partition for that matter) ?

Discussion in 'encryption problems' started by chrome_sturmen, Aug 2, 2014.

Thread Status:
Not open for further replies.
  1. chrome_sturmen

    chrome_sturmen Registered Member

    Joined:
    Apr 29, 2006
    Posts:
    875
    Location:
    Sverige
    Hey folks:

    Well,
    I have a 3tb (storage, not system)harddrive, with 2 partitions : One 3gb unencrypted (regular) ntfs partition, and then a second 2.7 odd tb encrypted partition with truecrypt - so the disk had 2 partitions.

    Last night, truecrypt popped up a warning that said roughly "the truecrypt volume has been automatically unmounted (this can happen if an enclosure or a drive has gone bad)" etc etc..
    I put the drive in another enclosure - the drive shows up fine but is now just one big 3tb unallocated space, both partitions are "gone" and windows says I need to initialize the disk (something I won't do).



    I grabbed testdisk and started working with it - when I open testdisk, select the harddisk, then select EFI/GPT, then Advanced>File System Utilities, I get the following partition layout for the disk, which actually looks correct:
    The first partition = looks like the 2.7 tb truecrypt partition
    The second = looks like the regular 3gb ntfs partition I created after the truecrypt partition :
    (note that with the second partition highlighted which is the regular 3gb ntfs partition, I get the option to undelete the partition):

    utils.jpg

    whereas with the first partition highlighted which is the encrypted partition, I get no option to undelete (because it's not a standard filesystem i assume?):

    utils2.jpg

    When I run a scan on the disk (using the Intel/Pc partition type) I get the following scan results: that highlighted partition looks correct, it's the size of the one I created. The other 2 above it, I don't know what they are I never created them. The scan did not detect the 2.7 tb encrypted partition because I believe that scan type only detects ntfs/fat partitions:

    scan2.jpg

    I figure, I need to at least get the partition layout back to what it was when I encrypted that partition with truecrypt, if I ever want to get it mounted again, whether normally or with an embedded backup header. I'm wondering if I should undelete the 3gb ntfs partition that testdisk detected, as a start?

    Thoughts appreciated *puppy*o_O*puppy*
     
  2. chrome_sturmen

    chrome_sturmen Registered Member

    Joined:
    Apr 29, 2006
    Posts:
    875
    Location:
    Sverige
    Please disregard the mentioning of testdisk in the above post - I was able to recover the ntfs unencrypted partition using another program - it was recovered with the proper size, volume label intact, the files in it, and at the correct location on the hard-disk (end of the disk).

    [​IMG]

    Having recovered the ntfs partition at the proper location, leads me to think that the truecrypt partition at the beginning of the disk, may just be salvageable somehow - I haven't done any formatting to the disk (though obviously the partition tables got corrupted).

    Anyone know what I might try next? That raw partition is the correct size and in the same place as the truecrypt partition was, and since I haven't formatted, maybe there's something I can do yet.
    Thanks ;\
     

    Attached Files:

Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.