Diskpart cleaned Veracrypt partition

Discussion in 'encryption problems' started by Mycroft Holmes, Apr 27, 2015.

  1. Mycroft Holmes

    Mycroft Holmes Registered Member

    Joined:
    Apr 27, 2015
    Posts:
    1
    I have a 2TB External Hard drive, with 2 partitions. The first one is 50 MB (actually ~48.5MB) UDF containing setup files for veracrypt and truecrypt, and keyfiles. The second partition is a Veracrypt-encrypted partition of size 1.8TB, which was quick formatted by Veracrypt. The drive was GUID -based, and the first partition was made an OEM partition using Diskpart and the second one an EFI partition in order to prevent accidental formatting by the system. However, a sudden accidental right click has pasted this script in diskpart and ran it before I could halt it. Diskpart doesn't even ask for confirmation before cleaning a drive.

    Code:

    select disk 0
    clean
    convert gpt
    create partition primary size=300
    format quick fs=ntfs label="Windows RE tools"
    assign letter="T"

    The new partition has a 300MB partition called Windows RE tools, and the rest is unallocated. I made a partition out of the unallocated space without formatting, hence it's a RAW partition, but Veracrypt couldn't open it. The disk containing the backup of the data crashed last week and I had sent it to RMA. Hence I'm left with no backups.

    I have opened the disk using WINHEX and I have seen the contents of the 50MB UDF partition, the keyfiles and the setup files. They are intact. Then there is a whole lot of gibberish, which I believe is the Veracrypt partition. And at the end of the disk there are thousands of zeroes, which I believe is there because the partition was quick formatted with Veracrypt. Now, could anyone tell me how to recover data from the Veracrypt partition? Perhaps using the alternate header? Is it at all possible? Any help would be highly appreciated.

    One more thing, the drive was brand new and was zero filled prior to the creation of the UDF and the Veracrypt partition, if that helps.
     
Loading...