TrueCrypt mounts but can't see data. Bad partition?

Discussion in 'encryption problems' started by xrichardx, Dec 27, 2013.

Thread Status:
Not open for further replies.
  1. xrichardx

    xrichardx Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    4
    Location:
    USA
    Hi there,

    I've read through a thread in which Dantz provided a tremendous amount of help for user InterestedParty to solve a similar problem. Actually, it might be the same problem. The thread I'm referring to is here.

    I think I'm going down the right path and am hopeful I'll recover my data since my situation is very similar. But I'd very much appreciate some input as I move along. I'm trying to use the correct terminology. However, all of this is new to me, so I might not get things as precise as necessary...please excuse such mistakes and let me know where I need to clarify.

    I'll show a bunch of screen captures as a picture is worth a thousand words.

    I have a 3TB WD My Essentials USB hard disk that is encrypted with TrueCrypt. It's been a while since I encrypted it and I can't remember exactly how I did it. However, if I recall correctly, under "Select a Partition or Device" it used to show as \Device\Harddisk2\Partition1 in Truecrypt. Now it shows as this (Harddisk 2):

    http://i.imgur.com/A6bg0qV.jpg

    If I select Harddisk 2, I am able to mount it and TrueCrypt then looks like this:

    http://i.imgur.com/5QMEh6X.jpg

    But if I try to open Z: in Windows Explorer, I get the message "The disk in drive Z is not formatted. Do you want to format it now?"

    At some point, I unmounted it and went through the TrueCrypt process to Restore Volume Header. This did me no good in terms of accessing files in the mounted volume.

    I ran the evaluation version of WinHex to look at the physical drive. It has data from 0 through 496 decimal:

    http://i.imgur.com/nRuqsp5.jpg

    Then it is all zeros until 4096 decimal.

    http://i.imgur.com/HXbemac.jpg

    From 4,096 to 1,048,576 decimal, it repeats the same data. After 1,048,576 it looks random to me (you can see the repeating data above 1,048,560):

    http://i.imgur.com/xUA3qBN.jpg

    Based on Dantz' instructions in the other thread, I saved 1,048,576 through 1,248,576 to a file and successfully mounted that file in TrueCrypt (it is 44,972kb in size). (I'll call this the TestFile)

    Other notes: WinHex says the disk size is 3,000,558,944,256. TrueCrypt says 3,000,557,633,536.

    My understanding thus far based on the InterestedParty thread: the TrueCrypt volume header is complete and (I think) starts at 1,048,576. Likely the partition information in the first sector was somehow wiped out and when I restored the volume header using TrueCrypt, then TrueCrypt wrote that information to the first sector. So, I can mount the TrueCrypt volume but it still can't find and decrypt my data.

    With respect to mounting the TestFile, I got a bunch of errors when I opened it in WinHex. These errors are different than what InterestedParty saw:

    First error:
    http://i.imgur.com/foR9HjO.jpg

    Second error:
    http://i.imgur.com/E7vDeBu.jpg

    Third error:
    http://i.imgur.com/3cvXq8w.jpg

    Fourth error: (this is after I opened the mounted volume in Z and was scrolling through in Text view):
    http://i.imgur.com/uo3mqX4.jpg

    When I scroll through the mounted TestFile, much of it is blank but there is some readable text as shown here:

    http://i.imgur.com/g3bcRjD.jpg

    I think this means TrueCrypt is unencrypting the file...a good sign.

    If I am correct thus far and based on what Dantz has written in another thread, it looks like I have two options:

    1. Initialize (but do not format) the physical disk. If I understand correctly, Windows will create a partition by writing to sector one only. But Windows will zero out the first sector of the TrueCrypt partition, so I'll need to use TrueCrypt to restore the volume header. I can use the TestFile as the source of the volume header since I verified that it mounts properly (...as an alternate, can I restore the volume header from the backup embedded in the volume?). At that point, TrueCrypt will be able to see its volume header starting at offset 1,048,576. Mount as a device using TrueCrypt and the original password. This is only completely safe if I copy the entire disk by sector to new media and then perform this operation on the new media (?).

    2. Use WinHex or similar to copy all data starting at offset 1,048,576 to another disk and save it as a file...that would be a huge file. Then mount that file using TrueCrypt and the original password. This is safe because I'm not writing to the original disk.

    Is this correct? I'd love any input.

    I have both Windows XP and Windows 7 available. Is one or the other better to use especially if I go with option 1?

    If it weren't for Dantz, I'd never have made it this far. Thank you. If I hadn't found your responses to InterestedParty I'd be completely sunk.
     
    Last edited: Jan 1, 2014
  2. xrichardx

    xrichardx Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    4
    Location:
    USA
    I'm stuck...

    Using WinHex, I cloned my original disk to a new disk.

    I took the new disk and initialized it and selected MBR. Under Disk Management, the disk then showed as two sections of unallocated space...2048GB and 746.52GB. I ran New Simple Volume Wizard and the max size (default) for the volume showed at 2048GB. I was concerned about all of this because I have a 3TB drive so I cancelled out.

    I used WinHex to recopy the first two sectors from the original disk to the new disk. I initialized again, this time using GPT (instead of MBR). I used New Simple Volume Wizard and the default size, which was listed at 2,861,459MB.

    In TC, when I clicked on "Select Device", it now shows two partitions on that disk...partition1 --128mb and partition2 -- 2.7TB:

    http://i.imgur.com/8BNtdPq.jpg

    This is how it looks in Disk Management:

    http://i.imgur.com/okfqC6P.jpg

    And that is my current concern: Dantz has written about restoring the backup TC header at this point, but he said to be careful about which partition it is written to. My recollection is that the original disk used to show only as /device/harddisk1/partition1 rather than as two partitions. I could be wrong as I never paid much attention to these things...but I simply don't recall seeing two partitions to choose from when using TrueCrypt.

    I'm doing everything on the new disk...so I'm keeping the original disk intact. But I'd like to avoid having to again copy sector by sector the entire original disk because it took 2.5 days.

    Advice? Perhaps GPT wasn't the proper way to initialize...but if it isn't, how do I deal with the smaller disk size shown in the New Volume Wizard when I select MBR while initializing?
     
    Last edited: Jan 1, 2014
  3. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    1,034
    Location:
    Hawaii
    If your test file worked when you copied it from offset 1048576 (decimal) then you had the standard (default) partition. It would have been listed in TC as \Device\Harddisk1\Partition1. (or Harddisk2\Partition1)

    I always prefer using "Option 2" (from your first post) because it avoids many of the types of problems that you are running into. Just set up a big enough formatted location and create the file in it. Yes, it's a very large file, but so what? It's considerably smaller than the maximum file size of almost 16TB for an NTFS-formatted disk.

    As for your current efforts towards "Option 1", most of the WinHex error messages you've linked to are actually expected, but I'm concerned about the "sector size mismatch" error. I don't know why that's coming up. Did you clone a newer disk (with 4096-byte sectors) to an older disk (with 512-byte sectors)? Or vice-versa? Just guessing.

    MBR-initialized disks don't support partitions larger than 2 TB, which is why you're hitting the 2048 GB wall on that approach.

    I have never used Option 1 with a GPT disk, so I'm not sure what sort of advice to give here. You're getting outside my area of experience. Thus, some of the following is based only on guesswork:

    I would definitely use Windows 7 for this, otherwise (in your case) the default partition won't begin in the right place. (Of course, you can't use XP anyway if you are setting up a GPT disk). At this point your disk should not contain any partitions whatsoever, and the unallocated space should all be in a single block. Then I would follow the "new simple volume" steps to create a single large partition that fills the entire disk.

    I'm surprised to see that Windows has apparently decided to create what appears to be the small (approx 100 MB) "System reserved" partition in front of the large user partition that you are trying to create. How did that get there? You can't allow that to happen, as it messes up the entire approach. The one and only partition that you create needs to begin at 1,048,576 decimal. If you're not actually installing an OS, this shouldn't be happening. Sorry, I don't know what to suggest here. Your technique might be faulty. I guess you could try deleting both partitions and then creating a single one in their place. And don't format it, of course.

    If you can't manage to create the desired partition layout using Disk Management then perhaps it could be done using DiskPart.

    Notice how many unexpected difficulties can occur when you try to recreate a lost partition rather than just creating and saving a large file. I'd actually already given up on the whole Option 1 approach before you even posted, and I'm no longer suggesting it as a solution, since Option 2 is safer, easier, more accurate, more reliable and easier to describe.

    I saw your thread a few days ago, but I've been too busy to respond. Sorry. To be honest, I was hoping that you'd just switch to Option 2 and take care of things yourself.
     
  4. xrichardx

    xrichardx Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    4
    Location:
    USA
    Dantz--thank you for your detailed reply. I would have switched to option 2, but I was waiting because it takes so long to clone the disk...I didn't want to kill my long cloning job and then find out there was a simple way to move forward.

    Bottom line: I could have messed up. I've never given any of this much thought in the past so I'm learning from scratch. I'm going to play around a bit with the cloned disk but I'm not going to spend much time on it before switching to option 2 (create a large file) and move forward from there.

    To address some of your questions and, perhaps, help out others:

    Sector size mismatch: The original drive is +/-3 years old and the new drive is brand new. The original drive is a WD My Essentials drive that might mess up my sector size. This item I read this on the WD forum might provide the clue (and I've seen similar things posted elsewhere):

    "Re: Exceeding 2Tb limit questions
    Options

    ‎08-11-2011 12:21 AM
    WD's 3TB externals are specified to work with Windows XP right out of the box, so, AISI, they must be preformatted with an NTFS file system. The way that WD circumvents the apparent 2TiB MBR limitation is by configuring the enclosure to report that the external mass storage device has a 4KB sector size rather than 512 bytes. This extends the MBR limit to 16TiB."


    Small System Reserved Partition: Unfortunately, I have no clue. I'm not installing an OS. Perhaps it's related to the GPT option? I definitely did not select to format the disk...and my recollection is the options were limited. I didn't select to create two partitions. I wish I had more insight/knowledge as to what happened here.

    I'll post back with my progress and (hopefully) success.
     
  5. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    1,034
    Location:
    Hawaii
    You might try this first: Mount your test file and then, in the TC interface, click on "Volume Properties". The Size in bytes represents the total size of your original volume, excluding the 4 headers. Add 262,144 to that number (to account for the four 64KB headers) in order to come up with the total original size of your encrypted partition. Then adjust your block size so that it begins at 1048576 and is exactly the same size that your encrypted partition used to be.

    That much precision might not be necessary, but it's not hard to do and it's generally a good idea to specify the correct endpoint for the new file, if you can manage it. If not, just grab the remainder of the disk to the very end. This will probably allow you to rescue all of your files, but don't consider the resulting volume to be a long term solution. For that purpose you should create a fresh volume that doesn't contain a mismatch between its header parameters and its actual size.

    PS: If you have any problems using the WinHex "Edit: Copy Block into New File" command because of the size of your file, you can always use the "Tools: Disk Tools: Clone Disk" command instead. It's a little harder to set up but it works quite well (although I wonder if it might stumble somehow if your two disks had different sector sizes, which could be the case). Anyway, let me know if you need any tips on how to set up Disk Clone to copy only the specified sectors.
     
    Last edited: Jan 3, 2014
  6. xrichardx

    xrichardx Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    4
    Location:
    USA
    Dantz--again, great information.

    The good news is it looks like I have recovered all of my data. In any event, I've recovered the important stuff. Props to Dantz...I was ready to forget about the files just a week ago before finding his suggestions for others in a similar situation.

    I did it by creating a file (Option 2 in my first post)...which, unfortunately, means I cannot try your most recent suggestions, Dantz. I'd like to have tried just to see what problems, if any, I ran into...could have been helpful for others.

    Here are the details...hopefully helpful if you're in the same situation:

    SUCCESS COPYING AS A FILE: Not much to put here as it was incredibly easy and relatively fast. When I originally cloned the disk, I used an older computer with USB2. To create the file using WinHex edit, I used a newer computer with USB3. Cloning: 2.5 days. Edit/save-to-file: 11 hours. I don't know if that's the difference between using Clone and Edit or if it's because of the faster computer and USB speeds.

    In any event, in WinHex edit I used Dantz's instructions from one of this other posts and selected a block starting at 1,048,576 and ending at end of file. I wrote this file to the new disk and then successfully mounted the file in TrueCrypt. Windows Explorer sees the files and I'm able to navigate around.

    The only glitch is WinHex stopped the operation at the very end because there wasn't enough room on the new disk (...I'm guessing this is because of the 128MB first partition created during the MBT initialization):

    http://i.imgur.com/794XTkx.jpg

    I don't think this affected any of my data...I had significantly less than 3TB of data, so I'm guessing the missing end-portion of the volume didn't hold anything. And it doesn't appear TC or windows cares that I didn't get it all. But that's why I said it looks like I recovered everything--I'm not entirely sure.

    Thank you, Dantz!!!

    EFFORT to USE CLONED DISK (nothing of value here...but I figured I'd put up this info anyway): I never touched the structure of the original disk...everything I did here was to the cloned disk. Among other things, I wanted to see if there was a way to avoid the creation of two sectors.

    If my notes are accurate and I recall correctly, I first use clone tool to copy the first 512 sectors (I believe...I can't find my note as to how many sectors I copied) to the clone disk hoping to start my process over. Then I did a "quick format" NTFS in disk management--Disk Management showed 2794.39 unallocated in a single block and gave me the option to initialize. I elected GPT because MBR can't handle 3TB. Then I used New Simple Volume Wizard and the default size of 2,861,459MB and selected 'do not assign a drive letter or drive path" and "Do not format this volume." Here's what things looked like at the end of Simple Volume Wizard this second time around:

    http://i.imgur.com/UBhpeRc.jpg

    At this point, TrueCrypt showed two partitions again...128MB and 2.7TB. I'm guessing there's just something with GPT that forces this since I saw no option around it.

    I restored the volume header from emedded to partition2 (2.7TB). I successfully mounted in TC but when I tried to access with Windows Explorer, I got the "You need to format the disk..." pop up.

    Which, with my limited knowledge, seems to indicate my TC volume header is available but not in the right location relative to my encrypted data.

    I think the last post from Dantz would have worked....but given the new 128MB partition1, perhaps I wouldn't have had enough room to do his trick on the new disk.
     
  7. DigiDon

    DigiDon Registered Member

    Joined:
    Jan 23, 2014
    Posts:
    4
    Hello everyone, especially Dantz if you're still get updates from this post.

    I'm hijacking this (and hope it is no problem ;)) as my issue is very similar and because I followed the same instructions given by Dantz but unfortunately to no avail..
    So...Dantz, I would really appreciate your help here! :)

    I will try to help others myself by giving some more information as xrichardx did himself.

    I looked at all the similar issues you got involved in, namely:
    Truecrypt Missing Partition Table
    https://www.wilderssecurity.com/showthread.php?t=336671
    Fully encrypted Truecrypt drive accidentally formatted
    https://www.wilderssecurity.com/showthread.php?p=2295052
    Corrupted TrueCrypt Partition
    https://www.wilderssecurity.com/showthread.php?p=2089604
    TrueCrypt mounts but can't see data. Bad partition?
    https://www.wilderssecurity.com/showthread.php?t=357778
    Deleted truecrypt partition via Disk Manager, used dantz method.. garbage data now
    https://www.wilderssecurity.com/showthread.php?t=353002

    Here is the sum up of MY problem

    When it all beggins: Had a non-system external drive fully-encrypted by truecrypt with my Windows 7 computer (100% sure).
    Everything was fine until I reinstalled my computer with windows 7 as well and ... confused... my external drive with an new unformated internal one so I got it NTFS QUICK-FORMATED by mistake..
    Couldn't use my drive anymore but after restoring the embeded header I was able to mount it in TC using my password. I still couldn't see the file on it with Windows explorer.

    http://s21.postimg.org/64dllq347/01_TCMount.png
    http://s21.postimg.org/erm7lzrk7/02_TCInfo.png

    What I'm unsure about:
    I GUESS i formatted it with Truecrypt because I remember it was my new HDD at the time so I don't think I encrypted any data in place but I'm not 100% sure.
    I GUESS I made it the NTFS way BUT I can't be sure because I remember TrueCrypt advising against it
    ---->EDIT: I apparently chose FAT32!

    (Dantz you should skip the following paragraph ;)

    COULD BE USEFULL TO OTHER PEOPLE: if you're not sure like me whether you first created your encrypted drive using FAT32 or NTFS:
    you COULD try to use GetDataBack NTFS AND GetBackData FAT or any other recory program which could propose FAT32 OR NTFS as a scanning option. Make sure it is read only (it is by default in this one)
    Start a recovery proccess in NTFS mode ON THE MOUNTED DRIVE (in TC) and STOP at 15%, let's say (ignore fake warnings, by clicking Ignore in this program). If you just see A FEW ONLY unknown-to-you unopenable system files it MIGHT BE that you used FAT32.
    http://s21.postimg.org/44wzub8sn/14_WH_files_NTFS_Get_Data.png
    To confirm this you MUST try with the other option (FAT32), or GetBackData FAT in my case, to launch the recory process. IF you SEE SOME OF YOUR FILE NAMES or possible and openable files this time it is THAT YOU USED FAT32 when creating the encrypted disk in the first place...before MAYBE formating it by mistake in NTFS format).
    http://s21.postimg.org/svmo84o5f/12_good_Files.png


    What I did
    At the time I tried several programs (Recuva, Chdisk (I think)) but to no avail.
    I thought it was over so I fell nearly into depression and didn't touch the HDD for a long time.

    RECENTLY (1 year later):
    Was about to use my HDD again so I was this close to format it once for all when I decided to look again on the internet and test a few more programs.. TADAM!!!! was able to recover hundreds of pictures using a program called File Scavenger in Long search mode on the TC-Mounted Partition.
    So I figured out MAYBE I could RECOVER ALL files (as I guess it is none or all with encryption) but I didn't want it this way: names were random trah and no folders were displayed.
    EDIT: I was able to obtain names and folders using GetDataBack, so IT IS POSSIBLE

    I looked deeper into the web and found DANTZ' amazing posts including the one in this topic.

    I followed the same instructions as the OP (xrichardx, good for you btw!) and followed your suggestion wich was Option 2 for the OP
    http://s21.postimg.org/964dvog93/13_WH_abort_OP.png
    And your 2nd suggestion as well (adapted to me):
    But when I tried, although it mounted successfully without using the embeded header with TC, it couldn't be opened in explorer the exact same way than before..

    Like the OP I just got not enough space at the very end of WinHex operation of copying the block to a backup drive (it was the same drive I just bought again).

    Same as his screenshot I don't remember if it was this exact size but between 60 000 and 70 000 bytes as well for sure

    The OP said he could still open it in explorer after mounting in TC but I can't.

    My questions:

    -1/ Do your instructions have to be different because it was originally FAT32 or do you think I made a mistake/did smth wrong following your instructions?

    For example: Should I have make an exact sector-by-sector copy of the disk rather than having made a copy of the block from 1,048,576 to 1,000,203,091,968 offsets (made your calculation for my disk according to your post) and checked that there were only "0000" after that.

    -2/ Is it possible that I have another problem? For exemple: is it possible that my header is located at the wrong distance to my data as you talked about in a different post?

    -3/ (optional) Can I expect better result or not following a proper method like you gave that allows us to open it normally again in explorer rather than getting all the data I can by GetDataBack FAT?

    -4/ Using either methods, can I really get back ALL KINDS of files? (no matter the extension, the size or whatever). Is it true that if I can get some of the file and some of the names, it means that ALL MY DATA (or nearly meaning >95%) can be recovered?
    If I can't find a file but know the particular name/extension of a file, do I get better result to obtain it?

    -5/ (optional) In this program I used and that you talked about (GetDataBack) there are options to recover deleted files and allow duplicate file names, should I use them?
    I just want to get the data that was there not the one I would have deleted before. But still, would some files have better chances to get recovered this way/would I miss some of the existing files if I don't use these options?

    -6/ (optional) Is it the same, worst or better to have chosen FAT32 in the first place in term of security and being abble to cope with drive problems?


    As I said I did bought the exact same drive as the one wich was compromised in order to try to recover the file. Don't worry I won't mix them up as I put some stickers on it. The problem is that I currently can't have the copy of the previous disk and the same time the copy of all the files that GetDataBack FAT can get. I simply have not enough space and I already bought the second external drive for that exact reason.


    So the main question right now is:
    Should I try other instructions or should I just get as much data as I can using GetDataBack FAT and save it to my other external drive?


    IF you think I got something wrong following your method then I can give you all the details with screenshots (I did forsee that request).

    The only striking difference I had with the OPs was when I scanned the TC-monted TestFile with WinHex looking for intelligible strings.
    All I managed to see of noticeable was kind of the keyboard layout and some spaces (but very little compared to the OPs):
    http://s21.postimg.org/g0eold8w7/07_WH_Only_Intelligible_stuff.png
    http://s21.postimg.org/f9lyfl6iv/08_WH_Only_Intelligible_stuff.png

    But still, I managed to get some files and even some file names and directory names using GetDataBack FAT so why would it be not decrypting?
    http://s21.postimg.org/svmo84o5f/12_good_Files.png
    Did I do something wrong?


    I'll soon post the report with the screenshots.


    Dantz it would be really appreciated if you would seize the challenge again and give me some hand here! ;)
    :thumb: We all appreciate your much valuable knowledge and help! :thumb:
     
    Last edited: Jan 23, 2014
  8. DigiDon

    DigiDon Registered Member

    Joined:
    Jan 23, 2014
    Posts:
    4
    In fact I think that my unmounted original disk structure in WinHex may be different from the other OPs.
    http://s27.postimg.org/unbv52ieb/03_Win_Hex_Top.png

    I’m describing it here:

    It starts off with ‘000’ with only a few characters around offsets 448.

    http://s27.postimg.org/tjrqt3xr7/05_WH_0_except_header.png

    Then only “000” until 1,048,576 where I see some apparently random data

    http://s27.postimg.org/e0uavzpgj/04_WH_0_until_1048576_Offset.png


    But then things get ugly: I first got this weird “BOOT MGR” and “NTLDR” at 1,049,088 and 1,049,152

    http://s10.postimg.org/wnjoajh15/18_WH_DD_normal_1048576_on1.png

    Then some blanks again

    http://s10.postimg.org/51gwpuxo9/19_WH_DD_normal_from1052720_to.png

    Then weird sequences separated with blanks

    http://s10.postimg.org/8mcs9327t/20_WH_DD_normal_weird_sequence.png

    Then repeating keyboard-like sequences and other repeating sequences

    http://s10.postimg.org/5klzz4p2x/21_WH_DD_normal_weird_sequence_Keyboard_fr106086.png

    http://s10.postimg.org/i9gaisv7d/22_WH_DD_normal_weird_sequence_pattern_to_119187.png

    Then I get again some other weird written stuff (Win7.64 etc.) with other random characters separated with blanks
    http://s10.postimg.org/w1upeflyx/23_WH_DD_normal_weird_stuff_with_blanks.png


    Until FINALLY I get some REAL RANDOM DATA from offset 1,232,896 which goes on and on (normally) !

    http://s10.postimg.org/x6orjt8ft/24_WH_DD_finally_random_data.png


    …Does that means something to you?
    o_O
     
    Last edited: Jan 23, 2014
  9. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    1,034
    Location:
    Hawaii
    I am really busy right now! Plus, there are a whole bunch of other "help" threads that I'm working on. I'm sorry, but it's going to be awhile, maybe a day or two, before I get the chance to read through your very detailed posts and hopefully gain an understanding of the underlying situation.
     
  10. DigiDon

    DigiDon Registered Member

    Joined:
    Jan 23, 2014
    Posts:
    4
    Hi. Little update:

    Thank you Dantz for taking my problem into consideration.
    I understand you are busy and it's no problem if you want to take a few days.

    I finally managed to get most of the data (approx 200GB or more) with some proper folders structure using Ontrack recovery. In fact GetDataBack wasn't of much help as, although it seemed to recognized many of the data, the final result was merely garbage with a high number of unknown folders with weird files and the only folders I recognized were corrupted and incomplete.

    I don't really understand why but it seems that some of these recovery softwares really work better than others. For me:
    -FileScavenger: Found quite a lot of files of some common types (jpeg and so) but with no folders structure and no file names.
    -GetDataBack: Recognized many of my files (with names) but final result was merely trash with not much to recover
    -Ontrack: best results with most of my data recovered. Some folders structure and files names. Very few corruption.
    That should be helpful to know for other people as well as it was not made very clear in the other posts I found on the subject. If one of this well-known software doesn't work, well... don't give up and try another one!

    I would still like to be sure I didn't miss important data because it has been a long time since I made this mistake and I can't say for sure I recovered nearly all. And the only way for it should be using your methods to properly recover the disk.
    So I still would appreciate your help if you can give me some instructions to try before I can move on with this whole matter.


    Thanks
     
  11. Keld Nielsen

    Keld Nielsen Registered Member

    Joined:
    Apr 21, 2014
    Posts:
    1
    Thank you all for your posts

    i just used this + other guides to recover my data from an encrypted usb hard drive. i mange to restore the backup header with truecrypt own tools. and afterwards use some "getdataback" applications to recover the data. i agree with DigiDon that there is so different result if you use one or another application to recover. my favorit is Wondershare Data Recovery.

    again thank you all. I mange to get all my data, i guess. could be nice with a check list so i can be 100% sure. .but i am happy for the result at least..

    thanks
     
  12. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    1,034
    Location:
    Hawaii
    Thank you for the update. I'm glad you figured out a way to get back most of your data. I apologize for not being more helpful in your thread. Initially it was a case of "too much information, I don't have time to go through all of this", but then later on I'm sorry to say that I basically lost track of it. Very sorry.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.