TrueCrypt - A Last Gasp

Since my TrueCrypt volume won't mount any more, I used data recovery software to read and store the RAW data in the 40GM external drive.

It produced 4 files or folders: a DIRO.GZI folder, a DIR1.JPG folder, an DIR2.ARJ folder and a DIR3.TOC folder. Each of these had neat folders inside them. (the folders within the ARJ folder all seem to be zipped.)

My question is: can I create a new volume, move these folders into it, then open it with TrueCrypt?

Probably not, but it doesn't hurt to ask, eh?

Phil "Grasping at Straws" Chenevert

 

Your volume won't mount anymore? What happened? Did you damage your working header? Are you seeing the "incorrect password or not a TrueCrypt volume" prompt? If so then you have turned a single problem into two problems, and you need to restore a good header from a backup. No matter what other tools you use, you will get absolutely nowhere without a working header, and there's no point in trying to run data recovery tools, hex editors, or any other tools on an unmounted volume. All they will see is random raw data with no filesystem, which is completely useless.

I'm not familiar with the files you descibe, but if you're trying to make a backup of your damaged drive then you need to use disk imaging software that works with RAW unformatted data. I believe the latest version of Acronis True Image can do this, as can the now obsolete but still very powerful Ghost 2003 (when a certain command-line switch is used).

It sounds to me as though your real problem is that your volume is internally damaged to the point where there is no longer a working filesystem (e.g. your FAT or MFT has been damaged). This could happen to an encrypted volume or a normal volume, and in either case the solution is the same: data-recovery tools. I prefer WinHex, but have also heard good things about both GetDataBack and certain R-Studio tools.