Truecrypt header recovery -- can see ...FF... header start, please advice

Discussion in 'encryption problems' started by Jimmy1203, Jun 4, 2017.

  1. Jimmy1203

    Jimmy1203 Registered Member

    Jun 4, 2017
    United States
    I cannot mount my truecrypt disk. What I have tried:

    - Restore header from backup within the volume (from the truecrypt menu)

    - Testcrypt (I believe this program found the header. When trying to mount I'm given deviceIO mount error. I researched this and apprently it's due to the particular usb hard drive I'm using and nfortunately this POS has the sata-usb interface built in).

    I opened the volume in winhex, however, and found two sections of FF values with a bit of seemingly random data in between. Could this be the header? In winhex the sequence of data is: random --> small block of FF --> random --> large block of FF --> random with some sparse readable ASCII.

    Should I paste this file? I suspect that the header has been damaged after plugging it into my mac and spotlight attempting to write metadata files to it or some other macos writing to the drive.