Looks like I've found Truecrypt header at end of (corrupted TC) Volume. How to continue (properly)?

Discussion in 'encryption problems' started by WNH, Oct 24, 2014.

  1. WNH

    WNH Registered Member

    Joined:
    Oct 24, 2014
    Posts:
    3
    Hi all,

    Some days ago my 64GB Sandisk Extreme USB, which was fully encrypted with TC, suddenly failed at work :(. No idea why. The drive only showed "Extreme" in system tray, no Drive-letter anymore.

    Back home I wanted to look at the drive with Windows 8's Disk Management, however before I knew it was initialized, not a good move from me. Last days I've been looking at a lot of posts at this forum to find a solution, however without success.... until today.

    In this thread Dantz explained about "the embedded backup header, which begins 131,072 bytes (128K) back from the end of the volume". All other attempts up to now to retreive the embedded header did fail and couldn't be mounted in TC (after defining block to new file using Hexwin).

    Today I went to the end of the volume where the random data did change into 00's (at offset 64016220159). From there I:
    - went 131,072 back;
    - went 1 forward;
    - defined a block from offset 64016089088 up to and including 64016220159 (i.e. 131,072 bytes);
    - copied this block into a new file and tried to mount into TC, which today did work :)

    In the next step I've made and saved a Backup of the Volume Header (using the TC tools).

    I like to know if my steps are right and what I should do now to get my data properly back (if possible). Dantz is explaining some methodes in this and this posts. Before I make other (stupid) errors I like to have your advise(s). I'm curious for example if I can use the TC "Restore Volume Header" tool, using the fiel I saved. And how can I verify the saved file is indeed correct for using.?

    Ps.1. The beginning of the Volume shows data from offset 0-511. Then from offset 512-32767 only 00's are shown. From 32768 random data starts. At 1048576-1049087 again 00's are shown, followed by a lot of random data. From 1081344-1081855 again 00's. From 1081856 the random data starts again.


    Ps.2. I'm using TC 7.1a
     
  2. WNH

    WNH Registered Member

    Joined:
    Oct 24, 2014
    Posts:
    3
    Update:

    Part 2 of post "https://www.wilderssecurity.com/threads/truecrypt-missing-partition-table.336671/" worked, so file was mounted using my password. In the TC main screen, Volume Properties the Size of the volume is showing 64015941632 bytes.

    Step 3 failed, since I only can see UNREADABLESECTOR displayed.

    Ps.3. I've created a sector by sector backup using Acronis True Image. Will that be fine?
     
Loading...