TC encrypted partition quick formatted recovery?

Discussion in 'encryption problems' started by aklies14, Sep 25, 2012.

Thread Status:
Not open for further replies.
  1. aklies14

    aklies14 Registered Member

    Joined:
    Jun 22, 2012
    Posts:
    29
    Location:
    America
    I accidentally quick formatted my TC encrypted partition while trying to format some other partition,I have another backup of 80% data which is on this partition but other 20% is also important.So do I have any chance of getting all my data back or is it a lost case.

    Some info:
    Hard drive size:1TB
    Number of partitions :2 (500Gb each :\Device\Harddisk3\Partition1 and \Device\Harddisk3\Partition2)

    \Device\Harddisk3\Partition2 is the quick formatted one,since then I haven't used my drive and didn't write anything else on it.Before format it was a TC encrypted partition with an outer(FAT32) and hidden(NTFS) volume.I have external FILE backup of both the headers(outer and hidden) at separate location.


    I have gone through a couple of threads here on TC data recovery and get a chance to learn a lot from these about how drive encryption is different from partition encryption,idea about partition table,volume header location etc but neither of these has a solution for quick formatted partition recovery.
    www.wilderssecurity.com/showthread.php?t=327959
    www.wilderssecurity.com/showthread.php?t=293891

    I think if I just restore Header backup to this partition then it may work just fine but since I am no expert I am afraid to do so.
    Also what quick format really does to the partition?what information it deletes which makes a partition APPEAR empty and available for writing new data?and from which location it deletes this info?beginning?


    let me know if you guys need more info.
     
    Last edited: Sep 25, 2012
  2. aklies14

    aklies14 Registered Member

    Joined:
    Jun 22, 2012
    Posts:
    29
    Location:
    America
    So I ran couple of tests my self,I created a new test partition of 500MB on my other drive,encrypted it the same way I did for the original lost partition,put some data in both outer and inner volume...took header backup and then formatted the partition using NTFS.After that I tried mounting this formatted partition using TC with option "Use backup header embedded in volume if available",TC popped up a warning message "WARNING:The host file/device is already in use...if you continue mounting then it may result in system instability"...so I removed the partition letter and then tried ...again same warning but this time I continued with mounting but when I clicked on mounted drive ,my system hanged and I couldn't test the data inside.

    So I thought lets try WinHex approach.I opened this formatted partition in WinHex and saved COMPLETE data as a file.tried to mount this data file using embedded volume backup headers but it failed with wrong password error(even though partition itself mounted with embedded backup headers,then why file mounting failed?)...then I restored headers from my external backup to this DataFile...mounted outer volume but couldn't browse it through explorer as Filesystem was unrecognized,why? and Winhex displayed only random data but on mounting hidden volume I was able to browse it in Explorer and all the data was intact...So this approach seems to work but I dont have space to take FULL backup of the 500GB partiton using WinHex as a File.


    Update:I restarted my system. and then tried to mount the TEST partition using embedded backup headers,both volumes mounted successfully without any warning this time and I was able to see all my data in the hidden volume but outer volume mounts as unrecognized filesystem and cant be browsed and even on viewing in Winhex all I see is random data.why?what happened to outer volume?

    Able to mount my original lost partition also from embedded header,but again same thing,hidden volume data was decrypted all well but outer volume not or may be I am not reading it properly in Winhex.

    So problem looks solved but I still would love few answers:
    1.Why the Test Partition COMPLETE File backed using Winhex failed to mount using embedded headers?
    2.Why I am not able to ACCESS outer volume data after mount even though hidden volume can be accessed properly?Is it because hidden volume was NTFS and NTFS saves filesystem(or whatever it is) info in the middle of partition and outer volume was FAT32,which saves filesystem info in the beginning and on quick format that info was lost?if it is so then any way to get the outer volume data also?
     
    Last edited: Sep 25, 2012
Loading...
Thread Status:
Not open for further replies.