Inaccessable TrueCrypt Drive

Discussion in 'encryption problems' started by Gremlins, Sep 1, 2013.

Thread Status:
Not open for further replies.
  1. Gremlins

    Gremlins Registered Member

    Joined:
    Sep 1, 2013
    Posts:
    2
    Location:
    Sweden
    Hi!

    I decided to reinstall Windows 7 x64 on a new 120GB SSD Drive some days ago and the first thing i wanted to do after installing Windows was to get TrueCrypt working with all my encrypted harddrives (i've got 6 encrypted drives, plus my systemdisk)
    Anyway, TrueCrypt just kept saying i typed a wrong password (when trying to mount one of my 1TB harddrives which i always mount as D:\

    So i thought ok, let's switch back to my other 60GB SSD systemdrive which Windows and TrueCrypt was already installed on and see if i got the same message from TrueCrypt but i still got the same message about the wrong password.
    I then managed to get it mounted by ticking "Use backup header embedded in volume if available" under "Mount Options"
    But when i try to access the drive in Windows it keeps tellning me it's inaccessable and asks me if i want to format the drive.

    I tried to use the inbuilt feature "Check filesystem" in TrueCrypt, but it just tells me that the drive is a RAW disk and can't be run, but Windows Disk Management says it's a NTFS drive.


    Im not sure why this has happend, but when i tried to use GetDataBack for NTFS the only files it finds seems to be some kind of Windows bootfiles, like the ones in the hidden 100MB partition Windows creates when installing Windows.
    So one thought is that the Windows installation somehow screwed up my 1TB harddrive and installed that 100MB partition to my drive. Now, how's that possible?!

    The timestamps of the "systemfiles" GetDataBack finds on the drive is the same time as when i installed Windows on my new SSD drive.

    Here's what GetDataBack finds. I've also tried other softwares with the same result and the only software which restored some of my files on that drive was "photorec_win.exe" included in TestDisk, but the filenames was all wrong and all files was not really sorted in any folders so it would have been a mess to get all files in order.

    https://app.box.com/s/8ttpvwab0r8qhffe3nol

    Im out of ideas what to do now, i've tried different recovery softwares and scanned the drive for 5h on each software without any luck.

    The drive was formated and fully encrypted.

    Properties of the drive:
    https://app.box.com/s/2anw08tqpn5y4cm7uzdq

    Any help is appreciated!
    Thanks!

    // Tomas
     
    Last edited: Sep 1, 2013
  2. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    991
    Location:
    Hawaii
    This situation frequently occurs when you install Windows while an encrypted disk or (in your case) an encrypted partition remains connected to the system. Windows sees the partition but doesn't recognize its contents (because the partition is fully encrypted from beginning to end), so it thinks that the partition is corrupted and decides to "fix" it. This typically overwrites the TrueCrypt volume header and possibly more.

    Another possibility is that Windows decides to use what it considers to be unused, available space (your encrypted partition or disk) to write its boot files, the system reserved partition, etc. The embedded backup header will often still work in this case because it's located at the far end of the partition, which Windows usually doesn't get to. But the encrypted volume's file system will be wrecked because of the large overwrite.

    You're "supposed to know" that you should disconnect all encrypted devices and partitions before installing or upgrading Windows. Alternatively, edit the partition table to indicate that your encrypted partitions have a partition type that is not supported by Windows, such as Linux. Then Windows will usually leave it alone. OK, now you know.

    By the way, I think you're using GetDataBack and possibly your other data-recovery software incorrectly. The Windows files that you're finding would have been written to the disk as ordinary plaintext. Thus, they should not be readable within your mounted volume. (Within the mounted volume they will appear to be random data.) Thus, I do not think you're viewing the correct volume with GetDataBack.

    First you should use TrueCrypt to mount the volume to the drive letter of your choice, using the embedded backup header if that's all that works, then open GetDataBack and select the logical volume that uses that same drive letter.
     
  3. Gremlins

    Gremlins Registered Member

    Joined:
    Sep 1, 2013
    Posts:
    2
    Location:
    Sweden
    Thanks for your reply.
    I actually got all my files back using GetDataBack, i had to tick "Search for deleted files" so i got all files back and safely back it up.

    Now i've got a much bigger problem.
    I have disconnected ALL encrypted drives, reinstalled Windows on my new 120GB SSD, installed all drivers for my computer, all windows updates and finally TrueCrypt.

    I shut down my computer and reconnected all drives, and booted up Windows.
    Now after Windows finds all harddrives and installs the needed drivers for them, they all, except the D:\ (which was screwed earlier) and I:\ got inaccessable..... what the??

    What is happening?? I had all drives disconnected during the installation.
    Is it impossible to install Windows without screwing up all encrypted disks?
    Im kinda tired of this now as i finally got all files back from D:\ and now E: F: G: H: is inaccessable.... :(

    UPDATE: It seems like E: F: G: H: all had assigned drive lettes, after i removed all assigned drive letters i could mount them as usual again. :)
     
    Last edited: Sep 3, 2013
  4. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    991
    Location:
    Hawaii
    I don't know quite what happened there, but congratulations for figuring it out!
     
Loading...
Thread Status:
Not open for further replies.