TrueCrypt device based volume corrupted

Discussion in 'encryption problems' started by oley, Sep 12, 2013.

Thread Status:
Not open for further replies.
  1. oley

    oley Registered Member

    Joined:
    Sep 12, 2013
    Posts:
    1
    Location:
    Germany
    Hello!

    I have got a problem with a TrueCrypt volume. I have seen some other threads about corrupted TC volumes, but I think my problem is a little bit different.
    On my computer I have got two hard disks. One of them has some partitions: windows system, linux system, linux swap and data partition.
    Second disk was used as TC volume (device based, not file based, also whole disk was TC volume).
    Yesterday I have newly installed my Windows (7 pro). After this installation I saw my second disk as not formatted NTFS disk with drive letter attached. How it happened, I have no idea. I think, if windows detect a second physical disk, it creates automatically a new partition on it.
    So, I have deleted the drive letter from this disk and try to mount it with TrueCrypt. It doesn’t work, so I made the restore of volume header. After that I can mount it with my password, but there is no file system on this disk.
    I have checked it with TestDisk – nothing found. I have also looked into it with winhex and I can see a random data on this disk, so I assume it was not a full format or something.
    Any ideas?
     
  2. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    991
    Location:
    Hawaii
    This happens a lot during Windows 7 installs. You're supposed to disconnect all TC drives before doing anything like that, otherwise it's kablooie! Apparently Win7 overwrote a portion of your encrypted volume's file system (plus the volume header, of course) in its eagerness to "fix" things. Luckily you didn't do a full format.

    Use the embedded backup header to mount your TC volume to a free drive letter, then try to access your data using GetDataBack or a similar data-recovery program. Make sure you point your data recovery program towards the correct location, that is, whichever drive letter you mounted the TrueCrypt volume to. WinHex should also be able to see some decrypted data if you use it to look at the correct logical volume.
     
Loading...
Thread Status:
Not open for further replies.