Help Wanted: Accidentally modified TrueCrypt container

Discussion in 'encryption problems' started by macnoel235, Feb 1, 2014.

Thread Status:
Not open for further replies.
  1. macnoel235

    macnoel235 Registered Member

    Joined:
    Feb 1, 2014
    Posts:
    2
    Curiousity killed the cat, I know I was being dumb, no need to tell me that T_T.

    Here's my story: (This is in a seconday internal 3TB drive, my primary is ssd)
    I have a 200GB Truecrypt container (most of the 200GB is reserved for a hidden container). I opened the container with Microsoft Word, and to my surprise, Word was able to open it and displayed a blank document. I typed in the letter 's' in that word document and saved it (ctrl-s). The container then showed a size of a little over 10KB. I panicked and deleted the 's' and saved again, stupidly hoping that would revert the file to its original state. Nope, the file is now 10KB in size.

    I'm too afraid to do anything else. Is there any way to recover the ~200GB of data that is lost? Thanks in advance.

    Edit: and no, Windows file history thing won't work because the feature was not "on" for my drive. ]:
     
    Last edited: Feb 1, 2014
  2. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    991
    Location:
    Hawaii
    Oh, it's most likely possible, but it won't be fun and it might not be complete. Recovering lost file-hosted containers can be tricky because of the difficulty of finding the exact endpoints of the lost file, plus if the file was fragmented then the recovery becomes much more difficult.

    I've participated in several recent threads on this topic. The general approach is to use a hex editor (I prefer WinHex, but you can use a freeware hex editor if you like) to locate the lost file's assumed starting point, then select and copy a small block of raw data from that spot and test it for the presence of the TC header, and then (if the test was successful) copy a much larger block of data and save it as a TrueCrypt-mountable file.

    I don't have time to go into detail right now, but that's the general overview. Sometimes it works and sometimes it doesn't. Various difficulties may arise.
     
  3. macnoel235

    macnoel235 Registered Member

    Joined:
    Feb 1, 2014
    Posts:
    2
    Thank you for your reply dantz. I've been reading some posts on this forum before posting and I always see you helping others. Much appreciated.

    I've never heard of anybody else modifying their TC container the way I did. Does it not matter? Should I follow the instructions you gave on this thread: https://www.wilderssecurity.com/showthread.php?t=355513 and https://www.wilderssecurity.com/showthread.php?t=357357 ? Are there any steps that I need to take that are unique to my situation? I've never used WinHex before, but I'm willing to learn ><".
     
  4. zapjb

    zapjb Registered Member

    Joined:
    Nov 15, 2005
    Posts:
    3,518
    Location:
    USA - Back in a real State in time for a real Pres
    nm.........................................
     
Loading...
Thread Status:
Not open for further replies.