TrueCrypt volume RAW file system 0 bytes and more.

Hello,

I have problem with my TrueCrypt volume. My entire 16GB flash drive was encrypted with TrueCrypt, from today it does not mount anymore.

What we have:
- Windows 7
- 16GB USB Flash Drive
- TrueCrypt 7.1a

Mostly i don't disconnect flash drive from computer, but today i wanted to little clean my computer. I dismounted TrueCrypt volume, closed TrueCrypt software and disconnected flash drive(without "safe remove", i don't know if it is the point where something bad happened). After uninstalled couple of programs, restarted computer, installed Kaspersky Anti Virus 2014(legal), scanned system, nothing was found, restarted computer, uninstalled Kaspersky, restarted and wanted to mount my flash drive with TrueCrypt and got 2 times wrong password and on third time i got this:
http://imgur.com/mjUj5th,8avX1bP (restoring volume header do not help, it cant restore)
After pressing OK, got this:
http://imgur.com/mjUj5th,8avX1bP#1
After pressing OK, got "Do you want TC to attempt to disable write protection of the partition/drive?"
If i press yes, cmd pops out and fails to disable write protection, if i press no it "mounts", but is not accessible and have 0 bytes. It shows "you need to format the disk before you can use it" and "Volume does not contain a recognized file system Please make sure that all required file system drivers are loaded and that the volume is not corrupt"

So far i searched google for couple hours, tried to mount in linux and on another Windows machine, with no changes. Until i found this thread: https://www.wilderssecurity.com/threads/crc-error-truecrypt-cant-mount-volume.357357/

I successfully done step-by-step "dantz" posted manual in post #8. Header test mounted with no errors and everything was fine and smooth.

I tried to do the next steps, but with no success, maybe i was not doing something right, but i got errors when i try to open flash drive in WinHex from Physical Media list i got "Access Denied", but when i chose from Logical Volumes/Partitions everything is fine. With red i marked my flash dirve.
http://imgur.com/F01Jqmh

So i started to improvise. I was thinking that maybe there is some hardware problem with flash drive, so i cloned entire volume using WinHex and then tried to mount it from TrueCrypt, problem was the same, but this time restoring volume header was succesfull and for next time volume mounted with no problems or errors, but still it's not possible to access it, it's 0 bytes and RAW. I tried to access it in Linux from TrueCrypt GUI, it showed to me that i need to choose filesystem, so i tried to mount from terminal with choosing filesystem, fat showed some error, now don't remember what exactly. Also tried ntfs(tc volume is in fat), but it showed that it cant find ntfs headers. Also tried testdisk, but i'm not very friendly with testdisk, but there was some errors about fat32.

I hope somebody can help me, and sorry for my bad English, it's not my native language.

 

You could maybe try removing the device in device manager and letting Windows reinstall the drivers for it when you reconnect it..
If that's unsucessful .... it could be faulty hardware I suppose, how old and how used is the card? If they're written to enough for long enough they actually do set themselves read only, typically that only happens if you've had paging files on them, or used them for readyboost for a very long time....

You might find GetDataBack more friendly to use than testdisk/photorec

Otherwise

@dantz
This one looks above my pay grade.. over to you when you get chance.

 

Flash stick is Toshiba 2 months old. But it was very cheap. I tried to use GetDataBack with no success. Also tried to use PhotoRec with no success, but maybe i'm doing something wrong. It was used for running couple of portable apps(Firefox, Filezilla, IM Messenger) and there was couple of small txt files. I need only these txt files. I don't think that removing device in device manager will help, because i have tried this flash drive on other computers with TrueCrypt, the same situation. But i will try. Thanks.

 

@BeardyFace
I will check in soon, but I need to take a break right now.

Sorry, synthetique. I will try to get back to you soon.

 

Thanks, dantz! I'm not in hurry, i will be very thankful if you can try to help me when you will have time.

 

Those types of portable apps don't write enough to cause significant wear to a flash drive

Have you tried using photorec on the mounted clone you made? If you look at that mounted clone using WinHex does it look decrypted? Or entirely random? (no blocks of 00 00 00 00 anywhere?). This really is beyond my skills, but I'm trying to ask things which the answers to might be useful to dantz

 

I am not very close to encryption and data recovery, everything what i have done was more like improvising. I'm not sure if i made clone right and i'm not sure if i used photorec right, but it found only 1 mp3 file without sound, but there is no mp3 files.

When i try to open mounted clone with WinHex it shows "The volume does not contain a recognized file system. Please make sure..." and Error #10 "Cannot access Drive S"

 

A LOT of flash drives are counterfeit. Depending on the source this could be the trouble.

 

In over 10 years using TrueCrypt, I've never had a damaged TC volume to try to recover, at this rate I'm going to have to set up a vm and break some on purpose to learn dantz's methods.

Plain accidental deletions, occasional directory corruption, but never involving TrueCrypt, I know the program and features reasonably, but I'm no recovery expert, sorry I can't help much more

 

I'll be able to spend some time on this thread soon. Maybe tomorrow. There's a lot to understand, as I'm not totally clear about what the OP has done.