TC - "Error: Incorrect volume size"

Discussion in 'encryption problems' started by StevenDB, Dec 14, 2017.

  1. StevenDB

    StevenDB Registered Member

    Joined:
    Dec 14, 2017
    Posts:
    4
    Location:
    Belgium
    Hi guys

    Unfortunately I am one of those not so expert users that played around a bit with TC in the past and ended up with a flashdrive being stuck with the "error: incorrect volume size" issue. I thought the data was completely lost until I found this forum and saw the amazing work that you guys do.

    I browsed around, read and learnt already quite much but now I'm stuck in the Winhex phase where I try to construct a test file to check if my headers are still intact. I could use some tailor-made advise I'm afraid :)

    Some context:
    - TC 7.1
    - outer and inner volume
    - I thought I encrypted a full 16gb usb-drive but I already learned that is probably was only a partition on that flashdrive.

    What worries me is that in Winhex I only see "UNREADABLESECTOR" and no partitions.

    https://s17.postimg.org/qcs6ud7hb/Win_Hex_-_Removable_medium_4.png

    Anyone who can advise me on how to proceed?
    @dantz saw you did some great work in the past. Care to help out one more Winhex/TC beginner? ;-D

    Thanks in advance guys!
     
  2. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    1,026
    Location:
    Hawaii
    I assume the image you posted is taken directly from your flash drive, and not from the test file that you created? If so, I'm not sure why Winhex is not reading your drive properly, but let's try to clarify what's going on before worrying about that.

    If you are getting the "incorrect volume size" when you try to mount your test file, this probably means that your test file is below the minimum size that TrueCrypt can recognize, which I believe is around 16 KB. If this is the case then you need to either 1) pad the end of the test file to make it larger or 2) the simpler solution: make another test file, and merely include more data after the header when you copy your test file from the flash drive. Take a few MB.

    And forgive me, but I'm quite rusty at this now. I haven't provided any TrueCrypt support in years and I've forgotten many of the details.
     
  3. StevenDB

    StevenDB Registered Member

    Joined:
    Dec 14, 2017
    Posts:
    4
    Location:
    Belgium
    Hi @dantz

    Thanks for answering! Much appreciated!

    The screenshot is idd of the flash drive itself.
    I'm afraid I've not been able to create a test file yet. I've tried to select a block with some of the numbers I found in other posts but until now I failed.
    Can I deliver you any kind of info that will allow you to suggest offset numbers that I can use to create a test file?

    The "incorrect volume size" is the TC error message when I get when I try to mount the volume directly from the flash drive. I get it when trying to mount both the inner and outer volume (usage of both passwords).
     
  4. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    1,026
    Location:
    Hawaii
    OK, I will think about that, but for now I'd like to address your WinHex screenshot, as we need to be able to view the contents of your flash drive.

    You might be seeing UNREADABLESECTOR because you are running WinHex without Administrator privileges.

    Open WinHex by right-clicking on the exe or shortcut, then choose "Run as Administrator"

    Once WinHex opens, close all previously opened tabs

    Tools / Open Disk / under Physical Media, select your USB drive and click OK

    Create a new snapshot if prompted

    Did this make any difference? Are you now able to see the drive's partitioning style (i.e. MBR) and a list of the various objects (Start sectors, partitions, unpartitioned space, etc)?
     
  5. StevenDB

    StevenDB Registered Member

    Joined:
    Dec 14, 2017
    Posts:
    4
    Location:
    Belgium
  6. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    1,026
    Location:
    Hawaii
    Hmmm, not good. How far does the UNREADABLE SECTOR message go? Can you scroll past it? Does it go clear to the end of the drive?

    Also, when you plug your flash drive in, does Windows say it needs to be formatted? (Don't format it, of course, although it is probably already too late).

    When you try to mount the volume in TrueCrypt, what exactly do you select? I know you start by clicking on Select Device, but after that does TrueCrypt list the flash drive as one of your removable disks, and below that does it list \Device\Harddisk#\Partition1 as one of your choices? (# is a number which varies based on how many disks you have).

    I think that TrueCrypt will display Partition1 as a choice even if it doesn't exist.

    Just to see what would happen, I tried deleting the partition from a blank USB flash drive and then attempted to mount the partition in TrueCrypt. I got the "incorrect volume size" error message, just as you did. This particular flash drive has never had a TrueCrypt volume on it.

    I will explain something here about how TrueCrypt works. No matter what type of TrueCrypt volume you have or where it is located, during the mounting process TrueCrypt is completely (and intentionally) blind. TrueCrypt has no idea whether or not there is actually a TrueCrypt volume present at the location that you specify. You can point it at any disk, partition or file and it will treat them all the same way.

    TrueCrypt will go to the starting location of the disk, partition or file that you selected and will run a quick validity check to ensure that the item exceeds the minimum size (around 16KB I think). If the disk, partition or file is too small then TrueCrypt will return the "incorrect volume size" error and stop all further processing.

    If the item is above the minimum size then TrueCrypt will copy the first 512 bytes into RAM and attempt to process it as though it were a valid volume header. If the header is valid and the password is correct then it will go on to mount (decrypt) the volume.

    You never got close to that step because your partition does not appear to exist. I am guessing that TrueCrypt sees its size as zero.

    Things are not looking very promising.

    Just to confirm that you are using WinHex correctly, I suggest you try opening a different flash drive just to make sure that it looks normal and does not display the UNREADABLE SECTOR messages that you are seeing.
     
  7. StevenDB

    StevenDB Registered Member

    Joined:
    Dec 14, 2017
    Posts:
    4
    Location:
    Belgium
    Too bad :-(

    The UNREADABLESECTOR message goes through to the bottom. Very consistently.

    When I (try to) mount it in TC it get the following options:
    https://s17.postimg.org/rpfed42kf/2017-12-16_09_27_17-_True_Crypt.png
    So you are right about the suggestion of a partition 1.

    And when opening another flash drive I have indeed a whole other pattern and no UNREADABLESECTOR messages.

    So I guess this is the end? :-/
     
  8. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    1,026
    Location:
    Hawaii
    Well, not entirely. I'm not the type of guy who gives up easily. I suspect that all of your data is still on the flash drive and it has merely become inaccessible. Maybe there is a fault in the circuitry. Possibly the memory board could be accessed another way. It might be an intermittent problem that you will recover from at some point. And it might even be a software problem. I'm no flash drive expert, but I do know that I can't help you with TrueCrypt right now, as we can't even see your encrypted data.

    I would be asking: What happened? Did the drive suddenly stop working for no obvious reason? Did it go thorough the laundry? Did you run some type of rescue software on it that accidentally destroyed the partitioning scheme? (Think about this carefully, as this is a real possibility). In that case then it might be possible to perform a software-based repair, but in the process you will have to be very careful not to overwrite your headers or your backup headers or you will never be able to decrypt your data. (Unless you have saved backup headers?)

    Sorry I can't be of more use here. Good luck!
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.