Please help recover my long lost partition

Discussion in 'encryption problems' started by jackcrowley, Mar 30, 2014.

Thread Status:
Not open for further replies.
  1. jackcrowley

    jackcrowley Registered Member

    Joined:
    Oct 27, 2013
    Posts:
    3
    Hello all and hopefully dantz too,
    I DD'd a freebsd router image (60mb) for IPCop over the start of my 2Tb drive which had previously had a 2Tb partition encrypted with Truecrypt. I have the password, and can recover the backup header to the drive and mount the truecrypt partition but I only see "this drive must be formatted" in windows as the filesystem header is corrupted.
    I've had this problem since Sept 2012, so if anyone can help recover the drive with the file names in tact I'm very happy to send 0.2btc to you.
    I can recover the files without file names with Photorec, but I have around 25,000 files on this drive so it would take years to rename everything and organise everything, so I would prefer to recover the partition with the file names if this is possible.
     
  2. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    991
    Location:
    Hawaii
    With only 60MB of a 2TB partition overwritten you should be able to recover quite a bit. PhotoRec and similar file-carving tools are recommended if the file system is totally trashed, but your file system should still have quite a bit of life in it. The MFT might be intact, and that's where all of your file names etc. are stored. Have you tried using other data-recovery programs such as GetDataBack that are designed to work within a partially-damaged file system?
     
  3. delboy1977

    delboy1977 Registered Member

    Joined:
    Feb 28, 2014
    Posts:
    3
    Location:
    Ireland
    Dantz I Have a similar problem

    I have followed your instruction from various threads and found them very useful. I had a 1tb hdd that a windows image was copied on to from my 500gb C Drive.

    Using the tc recovery disk I was able to decrypt the hdd. However after rebooting my pc booted from the image on the 1tb disk and not the main C drive. The previous 500gb C drive says that the disk is not formatted.

    The remaining 500gb of decrypted data on my 1tb disk is unreadable. Movie files that wont play and word docs that are unreadable and .gz files that are unreadable.

    Any advice help would be appreciated. I still have an exact copy of the original 1tb disk after the windows image was copied on to it. I used ease us data recovery but it was no use.

    Any help or advice wold be appreciated.:rolleyes:
     
  4. jackcrowley

    jackcrowley Registered Member

    Joined:
    Oct 27, 2013
    Posts:
    3
    Okay, I created a duplicate of the original drive again from scratch, then recovered the backup header from the embedded backup at the end of the drive, mounted the drive in truecrypt and I have a raw 2Tb partition mounted in windows again.

    I have recovered the files before in photorec but need the file names unfortunately. The directory structure doesn't matter to me too much but the file names of the many thousands of files are very important to me. I also tried testdisk various times in the past to recover the partition but had no luck.

    I'll try GetDataBack now and see how I go recovering the MFT and NTFS partition structure to get the files and file names back.
     
  5. Alhaitham

    Alhaitham Registered Member

    Joined:
    May 18, 2013
    Posts:
    173
    Location:
    Egypt
Loading...
Thread Status:
Not open for further replies.