messed up restoring header ?

Discussion in 'encryption problems' started by lainiwakura, Feb 25, 2013.

Thread Status:
Not open for further replies.
  1. lainiwakura

    lainiwakura Registered Member

    Joined:
    Feb 25, 2013
    Posts:
    2
    Hi all,

    it's my first post in this forum; seems the place to get advise (even for newbies like me :-/)
    I guess I messed up restoring an apparently corrupt header of an encrypted non-system partition.
    Yesterday when I tried to mount that partition, Truecrypt notified me the header was corrupt, and advise me to restore it using the build-in tool.
    As I didn't have an external backup, I used the "restore volume header from embedded backup"-option.
    After doing so however, I can mount the volume again, but now it seems unformatted...
    Any hope that I can recover my data ?

    Lain
     
  2. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    991
    Location:
    Hawaii
    The header merely allows you to mount and decrypt your volume. It has nothing to do with the contents of the volume or the condition of the volume's file system. If the header is intact then you can mount your volume to a drive letter and decrypt its contents; if the header is damaged then you will be unable to mount the volume and will generally see the "incorrect password or not a TrueCrypt volume" prompt.

    You didn't mess up. Restoring the header from the embedded backup was the right thing to do. Whatever overwrote or damaged your original header most likely also overwrote a portion of your volume and damaged its file system. That's probably why Windows sees it as unformatted (although there are other possibilities as well).

    Your next steps should involve mounting the volume and then using data-recovery software to explore the mounted volume to see what you can recover. For starters, try GetDataBack (by Runtime software). Or try R-Studio, File Scavenger, TestDisk (carefully, read-only for now), PhotoRec, or many others. Don't try to fix anything yet, as the first job is to recover your data.

    If the data you need to recover is particularly important and you can't risk any further loss then you should proceed very carefully, as you can definitely make the situation worse by blindly mucking around trying to fix things. The safest approach would be to back up the entire disk by making a sector-by-sector image and then restoring the image onto another disk of the same size or larger, thus creating a near-exact copy of the original. At this point you can perform all of your data-recovery attempts on the copy, and if you screw things up then just restore the image again, no permanent harm done.

    In some cases you might be able to recover additional data by repairing the file system. Repairs attempts should generally be performed AFTER all possible data has been recovered using data-recovery tools. Repair tools include TestDisk, chkdsk, and various other utilities.

    You might also want to try the TrueCrypt forums.
     
  3. lainiwakura

    lainiwakura Registered Member

    Joined:
    Feb 25, 2013
    Posts:
    2
    Hi Dantz,
    that's good news, thanks!!!
    Will try the data recovery tools you suggested!
     
Loading...
Thread Status:
Not open for further replies.