Recovering Truecrypt Container with lifes work from formatted drive

Discussion in 'encryption problems' started by failwhale, Mar 9, 2016.

  1. failwhale

    failwhale Registered Member

    Mar 9, 2016
    Hi All,

    I am hoping someone(s) here will be kind enough to help me with this absolute disaster of a situation. I recently lost my lifes work and irreplacable memories and am still in shock from the loss. I guess a part of me refuses to believe that 20 years of data is gone. I have always been careful with my data, I had 4 independent backups on different devices/drives etc. One of those backups was stolen , and the other 3 were destroyed in a fire along with all my personal posessions. To say that I was devestated would be an understatement.

    Fortunately, I was able to get my hands on an old external drive (formatted) that once contained some of my things (including a TC container full of essential and irreplacable work/personal data)

    I have spent hours reading threads regarding the recovery of truecrypt containers/patitions (especially dantz's threads) however I find my predicament is quite unique and am hoping someone can point me in the right direction.

    I have a 2TB External that is currently formatted and once contained a 65GB Truecrypt Container file.

    I ran getdataback recovery software (sector by sector) on the 2TB External and the search found the container file (original directory structure/tree) however it shows as only 2GB instead of the original 65GB file.

    I copied the single container file to a different drive to try mount it. I was able to mount it with the password however a lot of folders and files were missing (although some were intact as per original)

    I then ran chkdisk and getdataback (recover deleted files) on the TC mounted drive. After trying both methods seperately, the mounted drive started to recover some files and folders (however most of it consisted of weird symbol file/folder names) and not the original data) and ended up expanding to 20GB (still 45 GB off the original 65GB size)

    I assume the container has been fragmented and am looking into using WINHEX to piece it all together.

    Before I mount that hurdle, I noticed when I ran a deep sector-by-sector search of the formatted drive in getdataback, it came up with multiple file systems that were the size of the missing container.

    The issue is, how do I use this information to restore my container file to the original size? Is there a way to take advantage of the fact that getdataback is showing multiple file-systems of the same size as the deleted TC container?

    Any help would see me forever grateful. Thanks again everyone and please please if you have essential data you cannot afford to lose, please keep a backup off-site in case the unexpected happens!