Corrupted Truecrypt Partition

Discussion in 'encryption problems' started by GRSam, Dec 20, 2014.

  1. GRSam

    GRSam Registered Member

    Joined:
    Dec 20, 2014
    Posts:
    5
    Hi Guys,

    I have accidentally formatted my encrypted external HD with Windows' quick format. I have read some articles that had helped me to learn how to restore the TC header and I have done it successfully. I have also mounted it perfectly.

    Here is the problem: When I mount it, TrueCrypt isn't showing my files. TrueCrypt creates another logical drive (with another letter) and I can't access my files. When I double click, Windows shows a message that the parameter is incorrect. I know that my files are still in there because today I executed a recovery program and I saw my all files in the HD, however I can't open the drive with Windows Explorer and access them :(

    When I open the physical drive on WinHex the program gives me the following message:
    This volume uses more than the maximum number of clusters supported (2^32).
    Warning: Unsupported FILE record size!
    Drive D: Cannot open "$MFT". Unexpected data at offset 3D435D879E32B400 and offset D2DAE4399C00, Res=1, Res2=1

    Here are some information extracted from WinHex as well:

    Truecrypt Size Volume Properties: 1000203573248
    Total Capacity: 932GB (1,000,203,835,392 bytes)
    Subtracted Number: 262144
    Bytes per sector: 512
    Physical disk: 2
    Used Space: 332TB

    These files are very important for me as well.

    Could you help please how to solve this problem?
    Any help will be appreciated.
    Thank you
     
  2. GRSam

    GRSam Registered Member

    Joined:
    Dec 20, 2014
    Posts:
    5
    I tried to open the physical drive on WinHex one more time and there was a new message:

    This volume uses more than the maximum number of clusters supported (2^32).
    Warning: Unsupported FILE record size!
    Cannot read from Drive D:. Sector 8,622,021,282,830,682 does not exist. Messages of this kind will not be displayed here again for the remainder of this session. ( 1:00123923 ) 1:00117A8E ( 1:0004E544 ) [ 1:0004E280 ] [ 1:0004E280 ] [ 1:0004E280 ] [ 1:0004E280 ] [ 1:0004E280 ] [ 1:0004E280 ] ( 1:0005118F ) ( 1:0004E544 ) [ 1:0004E280 ] [ 1:0004E280 ] [ 1:0004E280 ] [ 1:0004E280 ] ( 1:0005118F ) ( 1:000B0BAC ) ( 1:0005118F ) ( 1:000E4A15 ) ( 1:000DF15A ) ( 1:00120CE3 ) ( 1:00121744 ) ( 1:00122383 ) ( 1:0012333A ) ( 1:00123E50 ) ( 1:000BF5CC ) ( 1:000FA20C ) 1:000E6A03 1:000E7A40 ( 1:00120987 ) 1:000E8820 ( 1:00007E17 ) ( 1:000E5FBA ) [ 1:0004DB14 ] ( 1:000010A0 ) ( 1:0000122C ) [ 1:00001250 ] [ 1:000016A7 ] [ 1:000E86AB ] 1:00115551 [ 1:0003F02A ] 1:001159E3 1:0007C5D4 ( 1:0000122C ) [ 1:00001250 ] 1:00051933 1:00051C69 1:00051DC1 ( 1:00000DAA ) ( 1:00000E5A ) ( 1:000013CD ) [ 1:000013F6 ] ( 1:0014A3DC ) ( 1:000B9D1B ) 1:00058CDE 1:0008C221 ( 1:0005118F ) 1:00050948 ( 1:0014A335 ) ( 1:00145357 ) ( 1:001454E2 ) [ 1:001454FD ]
    Drive D: Cannot open "$MFT". Unexpected data at offset 3D435D879E32B400 and offset D2DAE4399C00, Res=1, Res2=1
     
  3. GRSam

    GRSam Registered Member

    Joined:
    Dec 20, 2014
    Posts:
    5
    Guys,

    I really need a help to solve this problem :/

    I've got good and bad news. I've recovered almost all files using the software "Recover my Files" after that I mounted the partition on TrueCrypt.

    The problem is: ten files were corrupted and I really need them because they're the most important for me.

    The software "Recovery my Files" also has showed me some files called "Recovered Partition Files". I believe that can recover the whole partition with this data, but don't know how. Is there anyone with enough knowledge to explain me how I can do it?

    Please, help-me !! :/
     

    Attached Files:

  4. GRSam

    GRSam Registered Member

    Joined:
    Dec 20, 2014
    Posts:
    5
    up !
     
  5. GRSam

    GRSam Registered Member

    Joined:
    Dec 20, 2014
    Posts:
    5
    It was posted almost two months ago and I didn't get any answer. This forum was a completely deception for me :( Lost important files
     
Loading...