Can't mount encrypted flash drive: file system issues?

Discussion in 'encryption problems' started by truecrypter, Jul 23, 2014.

  1. truecrypter

    truecrypter Registered Member

    Joined:
    Jan 24, 2014
    Posts:
    8
    Hi all,

    I have a flash drive that was encrypted with truecrypt that seems to have been corrupted at one point. I am running OSX 10.9.2. It does not mount, but instead displays the error "hdiutil failed: no mountable file systems."

    When I set the option "File system: Do Not Mount" I can successfully mount the drive, but obviously can't read any data. What steps should I take next? I have cloned the drive to another that I can experiment on.

    TC
     
  2. truecrypter

    truecrypter Registered Member

    Joined:
    Jan 24, 2014
    Posts:
    8
    So I have opened the drive in HexFiend after mounting the drive (but not mounting the file system) and it doesn't seem like the data is decrypted. Any help?
     
  3. truecrypter

    truecrypter Registered Member

    Joined:
    Jan 24, 2014
    Posts:
    8
    Anyone? Any first steps to try?
     
  4. truecrypter

    truecrypter Registered Member

    Joined:
    Jan 24, 2014
    Posts:
    8
    Raising this from the dead, as I'm trying to recover this data again. Any ideas?
     
  5. oliverjia

    oliverjia Registered Member

    Joined:
    Jul 21, 2005
    Posts:
    1,517
    Mount the flash drive, then use data recovery software such as Runtime Getmydataback and Recuvva to get your lost data. Might be data table corruption.
     
  6. truecrypter

    truecrypter Registered Member

    Joined:
    Jan 24, 2014
    Posts:
    8
    Thanks!

    Again, raising this from the dead because I made some more progress. I mounted the drive but not the file system and set it as read only, and used dd make a copy the (presumably unencrypted?) data. I also tried running some file recovery software on the mounted (container, not file system) drive, recovering some FILE00X.SWF files (where X represents a number). However, these files don't seem to be anything real, although their sizes matched approximately what I remembered was on the drive. I also ran photorec on the copied drive and that recovered some corrupted .jpg files: again, nothing I could open. Am I approaching the problem correctly? What might be my best path to recovery?

    I have a suspicion this all came as the result of the original USB drive being improperly ejected. The fact that it decrypts gives me hope, but was I correct in dd-ing the mounted, decrypted drive and then attempting the recovery process on that?
     
    Last edited: Jul 2, 2016
  7. truecrypter

    truecrypter Registered Member

    Joined:
    Jan 24, 2014
    Posts:
    8
    More information: I opened the drive in Winhex and now see that it doesn't look like TC is actually decrypting anything, even though the password is being accepted and it's mounting the drive (not the file system, however). This would explain the lack of a file system, and points to something on the encryption side as the cause. Anyone know what would cause the password to be accepted and the drive fail to be decrypted?

    Also, one final piece of information after reading about this issue for a while: I started having this issue shortly after upgrading my system from OSX 10.6.8 to I believe 10.9. I've seen some people mention the incompatability of MacFUSE with later operating systems so I'm wondering if that was related to the issue. (I did not perform the upgrade while the USB drive was plugged in, I only figured it out later)
     
    Last edited: Jul 2, 2016
  8. boredog

    boredog Registered Member

    Joined:
    Feb 1, 2015
    Posts:
    1,171
    Last edited: Jul 3, 2016
  9. truecrypter

    truecrypter Registered Member

    Joined:
    Jan 24, 2014
    Posts:
    8
    Hahaha, yep. I figured the data wasn't going anywhere, and I get motivated to try and recover it about every year or so... If I could figure out why the password is being accepted but the drive doesn't seem to be being decrypted, that would be a first good step.
     
  10. boredog

    boredog Registered Member

    Joined:
    Feb 1, 2015
    Posts:
    1,171
  11. boredog

    boredog Registered Member

    Joined:
    Feb 1, 2015
    Posts:
    1,171
  12. truecrypter

    truecrypter Registered Member

    Joined:
    Jan 24, 2014
    Posts:
    8
    7.1a

    I knew about the developers ending support at 7.2, but it didn't really affect my decision to keep using it. Since the audit was successful, it's actually now the most secure option out there (since it's the only encryption option that's actually been audited)
     
  13. boredog

    boredog Registered Member

    Joined:
    Feb 1, 2015
    Posts:
    1,171
    well hope to see you back again next year :D
     
Loading...