How do I go about calculating the offset from the numbers given by testcrypt analyzer result

Discussion in 'encryption problems' started by satro, Jan 2, 2017.

  1. satro

    satro Registered Member

    Joined:
    Dec 18, 2016
    Posts:
    7
    Location:
    US
    I have used testcrypt to find my lost truecrypt partition and it has and has mounted it. Now I want to restore the partition by utilizing the method described in https://www.wilderssecurity.com/threads/truecrypt-missing-partition-table.336671/ but take a look at the numbers testcrypt is giving me in attached screenshot and please tell me how. I've tried each of the group of digits between the strokes which involves using winhex to define a block that starts with the numbers from Normal Header column but they all don't mount. Then later I've reasoned that I should try to multiply them by 512 thereby trying 32*512, 33*512, 2185*512 and so on but when I copy the defined block into a file nothing works. Here's what I do, giving an example of the first number in the Normal Header column of testcrypt's analyzer result. 0*512=0 then I go to winhex define block, start block 0, end block 200000 and copy to file. Truecrypt fails to mount. Tried the same with the second number after the stroke at testcrypt analyzer which is 32 so that 32*512= 16384 then start block = 16384 end block= 216384 etc. but they so don't mount. What is the exact header offset in my case, or should I divide 0 by 32 then by 33 since it's 0/32/33? Since I am not good in mathematics and more so hexadecimals, I have tried reading http://thestarman.pcministry.com/asm/mbr/DriveOffsets.htm but I don't seem to register that. Also it seems there's nowhere in the testcrypt forums and documentation that touches on the analyzer result Normal Header columns, it's contents and their meanings. Your help is appreciated
     

    Attached Files:

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.