Delete the Volume? Sure! NO I WAIT I MEANT DRIVE LETT-

Discussion in 'encryption problems' started by whyamisostupid, Feb 17, 2014.

Thread Status:
Not open for further replies.
  1. whyamisostupid

    whyamisostupid Registered Member

    Joined:
    Feb 17, 2014
    Posts:
    5
    Here it goes..

    Deleted volume on truecrypt partition (maybe not a partition but whole drive, windows asked to reformat drive whenever clicking on it before I hid the drive letter), header starts 32256 (if the header is what's letting truecrypt accept my password and then mounting said winhex export file), haven't done anything since accidentally deleting the volume, Hexview http://imgur.com/ydvyjwv 'Disk structure is corrupted and unreadable' message when I try to access it, may be normal

    WinHex drive shows two parts:
    http://imgur.com/Yitbh6o

    1.5MB file starts with some text next to hex about GRUB loading, .75TB is similar but states Invalid Partition Table and missing OS, may at one point have resized partition temporarily to host a copy of XP - I believe that was the case and worked fine, but may have been on another HDD- memory's spotty on that.

    Worked after installing windows on new ssd, just not until accidentally deleting volume instead of deleting the drive letter.
     
    Last edited: Feb 20, 2014
  2. whyamisostupid

    whyamisostupid Registered Member

    Joined:
    Feb 17, 2014
    Posts:
    5
    ninjaedit
     
    Last edited: Feb 20, 2014
  3. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    991
    Location:
    Hawaii
    I'll try to look over your problem soon. Too busy right now to do anything, sorry.
     
  4. whyamisostupid

    whyamisostupid Registered Member

    Joined:
    Feb 17, 2014
    Posts:
    5
    Thanks man - I reorganized the info for you now that I've had a bit to settle :)

    Friday I'll have a HDD to copy to and will update if my current attempt isn't working out, not much to do till then I reckon. Appreciate the time
     
    Last edited: Feb 20, 2014
  5. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    991
    Location:
    Hawaii
    What OS are you running?

    Your situation sounds pretty straightforward. You lost the partition definition for a partition that begins at offset 32256 decimal (a standard location for partitions created by Windows XP and certain other OS's.)

    It also sounds like you've already created a working test file, which is great news.

    At this point I think you're in much the same situation as fk21, so I suggest you read my recent post in his thread describing his options. Your options are pretty much the same, although you would want to define your block's starting point at offset 32256 (decimal).

    Yes, the images that you posted are normal and expected. Your first image displays a lot of UNREADABLESECTOR messages at the edge of "known space", as I call it, but this always happens when you scroll past the actual data-containing portion of a test file. And the good part, in case you hadn't realized its significance, is the large block of zeros which immediately precedes the unreadable sectors. This is a really good sign, as it demonstrates that your lost partition's data is decrypting properly, so there's nothing wrong with your header or its placement.

    Save your test file, as it contains a valuable backup copy of your TrueCrypt volume header. You might need it during the recovery procedures.
     
  6. whyamisostupid

    whyamisostupid Registered Member

    Joined:
    Feb 17, 2014
    Posts:
    5
    i tried option 1 :eek:
     
  7. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    991
    Location:
    Hawaii
    What was the outcome?
     
  8. whyamisostupid

    whyamisostupid Registered Member

    Joined:
    Feb 17, 2014
    Posts:
    5
    Didn't work

    Knew I shouldn't have when I tried it :)

    Option 2- worked: knew we were good after seeing the drive space. New drive has every file safe and sound, just as clean and smooth as I thought it would :D Chkdsk thanks you too

    HDD I was using as a main that's being replaced with my new SSD just started squeaking right now, was an '05 actually, been using it as a main now for ages ha and was also my dad's before he passed in 07, give me some way to send the faceplate of it to you of it as a token of gratitude :)

    Of course, others reading - do the second option. Actually took me a short 3 hours and it was all set :) Almost formatted my drive with Option 1, I was taking it slow so I saw it, but it's very, very easy to miss (I worked as a bench tech and have been using PCs since I was 3 :p so yep)
     
    Last edited: Feb 21, 2014
Loading...
Thread Status:
Not open for further replies.