MBR/parition table corrupt, lost truecrypt partition

Hi all,

After some considerable searching around, it seems this is the place to post with hopefully getting some help with a problem I'm having with one of my drives. It's a 1TB USB drive which has never given me any issues in the past, but today decided to die on me.

The drive was partitioned into 1 Primary partition, then partition 2 was entirely taken up by truecrypt. I have the header saved for that partition.

However now the MBR/partition table on that disk has completely busted. Windows sees it as a blank drive and keeps asking me to replace MBR (not done so yet) and when I try to open up the disk in winhex I get

Code:

Cannot read from Sector 0...1 of Seagate Backup+ SL. Data error (cyclic redundancy check).
Data error (cyclic redundancy check).
Data error (cyclic redundancy check).
Data error (cyclic redundancy check).
Data error (cyclic redundancy check).
Data error (cyclic redundancy check).
Cannot read from Sector 1...4 of Seagate Backup+ SL. Data error (cyclic redundancy check).
Data error (cyclic redundancy check).
Cannot read from Sector 0...2 of Seagate Backup+ SL. Data error (cyclic redundancy check).
Cannot read from Sector 0...1 of Seagate Backup+ SL. Data error (cyclic redundancy check).
Cannot read from Sector 0...1 of Seagate Backup+ SL. Data error (cyclic redundancy check).
Cannot read from Sector 0...1 of Seagate Backup+ SL. Data error (cyclic redundancy check).
Data error (cyclic redundancy check).
Data error (cyclic redundancy check).
Data error (cyclic redundancy check).
Data error (cyclic redundancy check).
Data error (cyclic redundancy check).
Cannot read from Sector 1...4 of Seagate Backup+ SL. Data error (cyclic redundancy check).
Data error (cyclic redundancy check).

Then it just shows "UNREADABLESECTOR" repeated in winhex.

Now I've tried testdisk from a gparted live CD and again, that just failed to read the drive (kept complaining about unable to read sectors from /dev/sde). So I'm at a loss as to what I can do? I don't know exactly what the size of the previous partitions were to recreate, is there any way to "scan" the disk at all, looking for where the previous TC partition started and dump it all to a file?

Any advice gratefully appreciated

OS : Win8

 

On my Linux and WinXP drives way back in the middle of the previous decade, I saved the MBR/partition tables on both disks in separate files, one for each on my Linux hard drive.. It saved my butt at least once when I suffered the same problem as you on my WinXP disk.

Although you did a similar save for your Truecrypt partition, forgetting to do the same for your MBR/partition has resulted in your current situation, and not having a full backup for your drive. If and when you can recover it, when everything is back in working order, I recommend the first thing you do is to back it up on a separate drive (if you don't have one, then get one).

I am not sure if there is a way to recover the MBR table, but there may be a forensic tool that is able to do that. There may be a way to reset the MBR from a Linux CD/USB that works from RAM, but I don't know what it would do to your data, i.e. if it would still be intact.

-- Tom

 

I'm getting a little closer now, in WinHex It seems to have found some partition information so must be some MBR issue. It shows my starting sector of "unaprtitioned space" (which is what it should show as) so now just hopefully need to create a copy of everything from there onwards. Should I be able to mount that as a file in TC?

 

Hi Carl, sorry to hear about your problem.

Just out of curiosity did you create a rescue disc when prompted during the encryption process and remember the password?

Iv'e always done this when encrypting a drive boot up or other and i know a rescue backup is stored also on the encrypted drive during the process, but if you can't read the drive then a rescue disk IMHO is the only recourse.

Regards, Ian.

 

Hi Ian,

Alas I did not create a rescue disk, just a backup of the headers, but I think the drive is physically busted at the start as any attempt to read the early sectors on the drive are fruitless so not sure a rescue disk would help anyway.

Just got to hope I can now read the sectors the TC partition is on and somehow get that onto another disk.

 

Hi carljones,

If, in fact, you backed up the headers to the hard drive, how did you back them up?

If you did it in a certain way, you might be able to restore them with a Line Linux CD/USB with operates from RAM, then then you could possible use the dd command (as root) to rewrite the headers.

Let me know before you do anything, and do tell how you backed them up - with what command, or other technique.

-- Tom