Suggestions on how to recognize the beginning of a TC container.

Discussion in 'encryption problems' started by Joseph M, May 27, 2020.

  1. Joseph M

    Joseph M Registered Member

    May 27, 2020
    United States
    Greetings to all members of the wilders community.

    I recently found this forum on the lookout for possible solutions to my current challenge.

    I'm trying to recover several files of 200GB ( TC containers ), from a formatted HDD.
    My story is a little different. It was
    not accidental format or corruption
    of any kind. Is a 4TB HDD that I decided
    to use mainly for Video Editing so I went
    ahead and did the format but realized
    later I had some media in those containers.

    I'm working with WinHex at the moment
    and I have no backup of any headers.
    These containers were created 8 years ago and back then I had very little knowledge in regards to headers so I never did any backups.

    All containers were created with 7.1a
    on Windows XP, and during the process
    I never created new containers. I made a copy of the 1st container until I filled the HDD with 20 files of 200GB each (4TB total).

    In theory, if I'm able to spot the beginning of any container, I'll be able to recover the rest cause is the same file copied 20 times.

    I tried using the header information
    suggested from the developer of pytruecrypt which suggest that headers V5 should have the header version and TC version at the beginning with x00 x05 x07 x00.

    But I've created several files with 7.1a and none of those containers included such information in the header.

    I do find the word TruE all across the disk, but that's it.

    I'm currently looking for 00s at the end and beginning of 200GB portions to see if that works but I really can't spot anything yet.

    I also wonder if the Lost partition recovery in WinHex is of any use in this case.

    Thank you very much for your help.

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.