TrueCrypt misadventures

Hello everyone,

for the last two days I've been struggling with a corrupted Truecrypt device, until I found this forum, which so far seems to be the most informative place covering similar problems.

There is a USB flash stick, which is encrypted by Truecrypt and contains both outer and hidden partition. While I couldn't care less about the contents of the outer one, I've been using the hidden one to store data really important to me, and losing them would have, without exaggeration, dreadful consequences.

While there is a backup of that data, it is few month old. I admit I grew too comfortable using Truecrypt and it didn't occur to me what would happen if anything goes wrong with it.

Now, one evening I by accident pulled the stick out of USB connector without dismounting it first. The next morning, trying to mount it, it gave me the "Wrong password error" for both outer and hidden partitions. I immediately run to Windows 7 computer (while normally I've been using ubuntu the whole time), and tried mounting it there. Same error appeared though.

Now at that point I panicked and instead of calming down and making the backup copy, I right away tried restoring the header from the corrupted device. Not sure if that could deepen the problem, but I stopped after that and made a copy, which I used afterwards. The copy itself is another 16GB USB stick (original was 8GB - partitions show up as 7.5GB for outer and 5GB for the hidden one).

Meanwhile, before coming to this forum, I've tried various Data restoring software including GetDataBack with different setting, all with no results, showing no data at the output.

CheckDisk told me the disk is RAW, which is kinda expected.

Later, I've stumbled upon this thread: https://www.wilderssecurity.com/showthread.php?t=327959 by Rakoen where dantz provided many interesting insights.

I've obtained a full version of WinHex and tried following through. The volume had a starting point at 16384B. Making a 2MB test file gave me no results, as it didn't mount. Then I've tried restoring the header again, and making a backup header. Then restoring it again from the backup header.

2MB Test file made in WinHex then mounted in Truecrypt. Opening the mounted file in WinHex showed me random data at the beginning with no sign of recognizable patterns and UNREADABLE data after. Mounting the hidden partition gave me just UNREADABLE data.

Now I'm at a loss. Does this mean that the data don't decrypt and are lost for good? (Please tell me otherwise) Or perhaps I'm doing something wrong (might have screwed up the headers or they might have been corrupted from the beginning)?

I'll be incredibly grateful for any input at all.

 

Have you asked your questions over at the TrueCrypt Forums? They might be able to help you.

TrueCrypt Forums

http://forums.truecrypt.org/viewforum.php?f=2

Ken:

 

I've tried to, but it seems that in order to post in TC forums one needs to have an email address from a non-free provider, which I don't have.

Furthermore, looks like the posts there get only rarely answered, which is disheartening as well.

 

I am currently having trouble properly installing my Decoy OS for my computer.