Truecrypt header recovery -- can see ...FF... header start, please advice

Discussion in 'encryption problems' started by Jimmy1203, Jun 4, 2017.

  1. Jimmy1203

    Jimmy1203 Registered Member

    Joined:
    Jun 4, 2017
    Posts:
    1
    Location:
    United States
    I cannot mount my truecrypt disk. What I have tried:

    - Restore header from backup within the volume (from the truecrypt menu)

    - Testcrypt (I believe this program found the header. When trying to mount I'm given deviceIO mount error. I researched this and apprently it's due to the particular usb hard drive I'm using and nfortunately this POS has the sata-usb interface built in).

    I opened the volume in winhex, however, and found two sections of FF values with a bit of seemingly random data in between. Could this be the header? In winhex the sequence of data is: random --> small block of FF --> random --> large block of FF --> random with some sparse readable ASCII.

    Should I paste this file? I suspect that the header has been damaged after plugging it into my mac and spotlight attempting to write metadata files to it or some other macos writing to the drive.
     
Loading...