My entire life has been kept on three different 2TB drives for the past decade. I thought it was smart to have two of the drives encrypted with TrueCrypt, and one without encryption. The drive without encryption was stolen after my father passed away. But that is why I have backups! Today I was in the process of organizing the contents of the two encrypted drives. The goal was to manually sync the contents as I do every couple of months. Then I would copy the contents to new drives without encryption. I rearranged some folders, deleted some files and ended up extracting an .rar file from within one of the encrypted drives to the .rar's parent directory when things began acting strange. The contents of the extracted .rar file could not be opened. For example, a .jpg image would not open with a warning that the file header could not be read. I then copied the same .rar file to my desktop and extracted it with no issue and the extracted contents opened like normal. Then I began manually deleting the recycle bin. Some of the folders would not disappear after I selected to permanently delete them. Others deleted just fine. Hoping that the strange behavior would go away after I dismounted and remounted, I ended up with both of the drives mounting as normal with the password, but an explorer window says "the disk structure is corrupted and unreadable". All of my Converted family VHS, photos, videos, gone. I never encrypted a drive in it's place, meaning that I always encrypted the entire drives before adding files. I never used the hidden features that have two passwords and two headers to deal with. I never messed with keyfiles and have never been asked for them. Been using Win10 for three years. Every time I connected one of the encrypted drives, windows asks if I wish to format it but of course I never do. As far as I can tell, my situation is somewhat favorable because I have two nearly identical drives that have the same issue, so I can experiment with one, while the other remains in the same state locked away. This problem happened while both encrypted drives were mounted while connected to a two bay hotswap external usb 3.0 open faced enclosure. (Thermaltake BLACX Duet). I had this same issue with another one of the encrypted drives months ago, but because my data was safe on other drives, I was not in a rush to investigate the cause. I still have that other drive, however I did perform some header restores. So I actually have three drives to work with. Either one, even the older one will have most of the contents that I need, so only one needs to be recovered. Can't believe I missed the aid of Dantz by 10 months. I would have already began utilizing Dantz's previous help to others, but most of them seem to deal with Win7 and hidden containers, which do not apply to my situation. This is too important and I will wait for direct help. I believe the problem was caused by the divided speed of the BLACX Duet. I learned soon after I purchased this device that it was unreliable. Sometimes while transferring data between two drives within the BLACX Duet, the speed would drop, then freeze. I learned not to transfer files using the BLACX Duet, but forgot about it today when both were in that unreliable BLACX Duet. Please, someone help. I was a couple days away from never having to deal with encryption again. I was warned years ago to drop TrueCrypt. Now look at me. I never needed it in the first place.
I just completed a signature search (a form of comprehensive file header search) on one of the drives using WinHex. It took about 30 hours and found almost 900,000 files. Due to my inexperience with WinHex, I am certain that I did multiple things wrong regarding the signature search settings that I did not understand. Below is a somewhat play by play of the signature search. This verifies that TrueCrypt is working and decrypting. At this point, from my limited experience, I can use Ontrack to recover files from both drives, and hopefully, the problems are located at different areas of each drive, increasing my chances of getting most of my files back. Sadly I will never be satisfied until I communicate with someone more knowledgeable. All of my files were organized by the folders. I made my own "tags" within the folder names. Getting just the files back will leave me without dates/times, locations, and names. I must get back most if not all of the folders also, with their contents still in them. I can say one thing for a fact, EaseUse data recovery is a rip off. I was using it for several years along with other recovery programs, and what do you know, I was never able to recover anything worth mentioning with it. EaseUse would spam the found file results with multiple duplicates, and forget getting back most folder or file names with them. The creators of EaseUse purposefully made EaseUse do this because they knew it sucked. Out of all of the programs I used side by side, Ontrack would find most if not all of my files, while EaseUse found less than 05% of what Ontrack found. I have read dozens of threads on this site alone, and was surprised by how many users recommended EaseUse. file header signature search 64 255 (255x64=16,320) 12amish - 1.7gb per minute - 01% - 20.0h left - - 27th 08amish - 700mb per minute - 19% - 33.5h left - 161,800 files - 27th 10amish - 709mb per minute - 23% - 33.0h left - 209,286 files - 27th 11amish - 687mb per minute - 24% - 41.5h left - 271,800 files - 27th 12pmish - 662mb per minute - 26% - 40.5h left - 338,500 files - 27th 01pmish - 679mb per minute - 28% - 30.0h left - 363,000 files - 27th 02pmish - 652mb per minute - 29% - 39.5h left - 441,500 files - 27th 03pmish - 664mb per minute - 32% - 29.5h left - 467,000 files - 27th 04pmish - 701mb per minute - 36% - 26.0h left - 471,000 files - 27th 05pmish - 723mb per minute - 39% - 25.0h left - 472,400 files - 27th 06pmish - 721mb per minute - 41% - 26.0h left - 485,400 files - 27th 07pmish - 725mb per minute - 44% - 23.0h left - 498,500 files - 27th 08pmish - 714mb per minute - 45% - 26.5h left - 561,000 files - 27th 09pmish - 698mb per minute - 47% - 30.5h left - 646,000 files - 27th 10pmish - 700mb per minute - 49% - 22.0h left - 673,000 files - 27th AROUND 50%, WINHEX APPEARED TO FREEZE, I BELIEVE IT WAS DUE TO THE SIGNATURE SEARCH COMING ACROSS ONE OR MORE OF THE AREAS OF THE DRIVE THAT HAVE THE PROBLEM. 11pmish - 690mb per minute - 50% - 21.5h left - 681,000 files - 27th 10:35am - 906mb per minute - 99% - 37min left - 863,144 files - 28th 10:50am - -100% - - 863,148 files - 28th The volume snapshot now comprises 863,148 files (7 before, i. e. +863,141).
Wilders had only one TrueCrypt expert and he's not doing support anymore. If you don't receive an answer to your issue is because there's no one else, at that level of expertise, to help you. Thought you should know.
I understand. Others seeking help were told the same thing after Dantz moved on. I will try everything I learn on my own and post my findings here.
sdmod mentioned video showing how to use "Permanently Decrypt System Partition/Drive". I am curious. Do you tried WinHex after decrypting system drive or on mounted encrypted volume?
I used WinHex while the drive was still encrypted and mounted via TrueCrypt. Attempting to decrypt the entire drive, or copying the encrypted drive to another drive are steps I will take after I have exhausted every other option. I am unable to afford a new 2TB drive, so my only option would be to use the 3rd 2TB drive that I had a similar problem with months ago to copy/decrypt/recover files onto, and since that 3rd drive is my third shot at getting my data back, I do not wish to use it. The data on my phone is throttled to 14kbps so I am unable to watch sdmods video until I get some wifi, but I thank sdmod for the help.
So I connected the same drive via usb 2.0 to a Windows 7 Home Premium desktop and initiated a Kroll Ontrack EasyRecovery scan. Around 50% a storm caused a loss of power for two days. Once the power was back, I started the scan over. There are seven phases of the Ontrack recovery process. After the 16 hour phase 1 completed, a "OntrackEasyRecoveryforWindows.exe has stopped working" window appeared, and that was the end of that. I now will attempt the same scan again, but this time with the drive connected to an internal sata.
Connecting the drive via internal SATA did the same amount of work in 1/4th the time of the USB 2.0. Sadly, after phase 1 reached 100%, the program crashed with a "OntrackEasyRecoveryforWindows.exe has stopped working" window again. I will now watch the video that sdmod provided a link for and think of something else to try.
I believe I have about 10 options to try while using internal SATA within my Windows 7 desktop. The 10 options turn into 20 if I try them under Windows 10 also. Then if I try those 20 options while using USB instead of SATA, that would give me about a billion options to try. I do not envision any benefits from using USB, only a loss of speed. I do not see using Windows 10 as being beneficial due to the last versions of TrueCrypt being catered to Win 7, if I am not mistaken. 1a) - File recovery using WinHex via SATA. (LOW RISK) - original drive. 1b) - File recovery using WinHex via SATA. (LOW RISK) - cloned drive. 2a) - Truecrypt disk decryption via SATA. (LOW RISK) - cloned drive. ------ Then file recovery using WinHex if files are not found or useable. 2b) - Truecrypt disk decryption via SATA. (MILD RISK) - original drive. ------ Then file recovery using WinHex if files are not found or useable. 2c) - Truecrypt disk decryption via SATA. (LOW RISK) - cloned drive. ------ Then file recovery using WinHex if files are not found or useable. 2d) - Truecrypt disk decryption via SATA. (MILD RISK) - original drive. ------ Then file recovery using WinHex if files are not found or useable. 3a) - Use a check disk utility to find problems and repair the drive while still encrypted. (LOW RISK) - cloned drive. ------ Then file recovery using WinHex if files are not found or useable. 3b) - Use a check disk utility to find problems and repair the drive while still encrypted. (HIGH RISK) - original drive. ------ Then file recovery using WinHex if files are not found or useable. 4a) - Use a check disk utility to find problems and repair the drive after decryption if files are not found or usable. (LOW RISK) - cloned drive. ------ Then file recovery using WinHex if files are not found or useable. 4b) - Use a check disk utility to find problems and repair the drive after decryption if files are not found or usable. (HIGH RISK) - original drive. ------ Then file recovery using WinHex if files are not found or useable. I still do not know how to recover files with WinHex. The video sdmod provided me with let me know how brutally slow decryption is while not using Windows. However, the efforts made in the video were to fix an entirely encrypted drive, including the operating system. It seems that the only issue was from the loader being corrupted. I believe my problem is from the file system, or file table, or MFT, and I do not know the difference between the names.
Try the non neutered old TrueCrypt version on Linux https://www.grc.com/misc/truecrypt/truecrypt-7.1a-linux-x64.tar.gz on something like an easy live Linux version like Ubuntu 18. BTW with FinalCrypt this would have never happened as: 1) FC encrypts files and not volumes (processes still can read all files in an unlocked volume, but not encrypted files) Also with data corruption only one file would be corrupted (never happened to me many TBs encrypted and decrypted). 2) encryption is solely dependent on your personal cipher / photo / video file so keep them on a couple of backup USB sticks 3) I consider the encryption code lines in FinalCrypt's code (the XOR part) holy and virtually never to be touched (like a constitution) 4) I made sure FinalCrypt is spread worldwide over a huge number of sources, so it can't really be erased by the man in black. Good luck
Ron de Jong, my TC version is 7.1a under Windows. From what I recall, this was close to, or the last release before TC was killed off. So I am curious as to why you would call it old. I have zero experience with Linux. Is there a preferred way to run Linux under windows? Did you recommend this TC 7.1a Linux version for me to see if the drive mounts with password and actually shows some or all of it's contents? Or would I be doing it for another reason? Does the TC 7.1a have more capabilities under Linux vs Windows? Thanks for your time.
Linux is different OS. It is not meant to be installed inside Windows OS. You may try virtual machine such as Virtualbox or VMware Workstation Player, but I don't know whether TC under Linux have more capabilities.
I am aware that Linux is an OS, and that it is not meant to be run from within Windows, I was just asking if Jong knew of something like an emulator off hand to spare me further Google and Dogpile searches and downloads due to my low bandwidth. I have used Virtualbox in the past but remember little about it. What Jong recommends seems to be very low risk, so it should be one of the first options I attempt from a large list of other low risk options. I wish to try every low risk option first, regardless of the time it takes. Sadly, I have a strong feeling that something like a checkdisk utility scan and repair performed on the drive would make the contents of the mounted drive visible, with the exception of the areas that needed fixing, but should a checkdisk program be performed on the drive while it is mounted with TC or unmounted? I am 90% certain that I should checkdisk while mounted. Does a TC mounted volume/drive have it's own unique filesystem that runs off the drives original filesystem? Questions like this leave me hanging for days.
I also think that checkdisk should be performed on unencrypted or at least mounted TC partition, but I don't know whether this is safe anyway.
You're right TC v7.1a is not that old, but it's the one but last (non neutered) version i meant. Don't run Linux in a virtual machine as it would take too much hardware resource running your system more likely unstable. Just write the Linux img file to a USB stick and boot up the Live version of it. Connect your TC encrypted external drive and download and run TC unlocking your external drive. That should do it. P.S. I would not use rar, tar, zip etc. for such large archives. If you really have to intermittently use an archive then you're probably better of using CPIO archives. I would use rsync to directly and recursively copy all the files from the unlocked encrypted volume to another filesystem. If that breaks of in the middle then at the next run only the difference is synced. Never happened to me. Here's a little rsync script i made and use myself called sync_directories.bash (the script is self explanatory) meaning just run it without parameters and it will print usage instructions: Code: #! /bin/bash if [ "$#" -ne 2 ]; then echo "Please parse 2 directory params ending with \"/\"..."; exit 1; fi if [[ -d "${1}" ]]; then export src="${1%/}/"; else echo "Source not a valid directory: ${1}"; exit 1; fi if [[ -d "${2}" ]]; then export dst="${2%/}/"; else echo "Destin not a valid directory: ${2}"; exit 1; fi echo "Synchronizing: ${src} -> ${dst}" rsync -rtpXDHh --links --modify-window=1 --delete --progress "${src}" "${dst}" 2>sync_directories.err sync Good luck mate, I hope you manage getting back your data Cheers, Ron
The encryption layer sits beneath the file-system layer so if you ckeckdisk / fsck (linux) a filesystem, make sure it is unlocked / decrypted, but not mounted. Here is a document that explains howto do it under Linux. Here is howto unmount under windows: BTW VeraCrypt is also TrueCrypt compatible. Be very careful and cautious with file-system repairs and use only as a last resort.
I should have known better. Performing the additional decryption of an .rar within a TC disk that is already performing decryption, so asking for trouble, but I never had an issue before. I am almost positive that the Thermaltake BLACX Duet that I had both of the TC drives mounted from is the reason the disks became corrupted. It was cheaply made and splits the speed of the USB to each bay. Another mistake I made was connecting the Thermaltake BLACX Duet to a USB 2.0 without thinking. I made three mistakes at once. I believe that the Thermaltake BLACX Duet could not keep up and the speeds of each drive dropped, but the Thermaltake BLACX Duet did not drop the drives like it would under similar situations in the past for some reason, resulting in both drives having the same problem, but the problems should be in different locations. I had no idea that VC and TC were compatible. If I can run VC and attempt to mount a TC disk, that will also be one of the first things I will try. Thanks again for your help, I will be able to resume the list of steps in a couple days when I am home with a desktop to use.
I followed the initial steps you gave me. When I attempted to mount one of my problem drives with TC in Linux Ubuntu, I got the following error """mount: /media/truecrypt11:wrong fs type, bad option, bad superblock on /dev/mapper/truecrypt11, missing codepage or helper program, or other error.""" ------------------------------------------------------------------------------------------------------------------------ A source online stated the following,... -Wrong FS: So, you're going to mount the volume and it shows: mount: wrong fs type, bad option, bad superblock on /dev/mapper/truecrypt0, missing codepage or other errorIn some cases useful info is found in syslog - try dmesg | tail or so When creating volumes (unless it's used the --filesystem option), truecrypt create those volumes using 'auto' filesystem which, for linux porpuses doesn't work for nothing, so, in order to avoid this error you'll need to create a filesystem in the volume like this: root@root [~]# truecrypt --device-number 20 /media/data/private /media/mystuff && mkreiserfs /dev/mapper/truecrypt20 To actually create a file system on the truecrypt device, first its need to be mapped, that's why you need to mount it first and instally after create the file system you want, I used reiserfs but you can use whatever you like. The '--device-number' option is optional, I used becuase is better if you want to control what device you're going to format. ------------------------------------------------------------------------------------------------------------------------ From what I understand, all of the topics I found online regarding this error only offer advise on how to properly encrypt/use TC under Linux, and do not explain how to get a windows created TC drive to open under the Linux version of TC.
