TrueCrypt Win7 RAW to NTFS

Discussion in 'encryption problems' started by pd00, Oct 6, 2012.

Thread Status:
Not open for further replies.
  1. pd00

    pd00 Registered Member

    Joined:
    Oct 6, 2012
    Posts:
    5
    Hey Guys,

    I found some threads in this Forum for the following issue but none of em could really show me how to get the next step.

    First the problem. I have a SSD with my OS installed (Win 7 64bit). Yesterday I reinstalled windows 7 on this device. After this I wanted to mount my both fully encrypted 1.5TB HDDs to it. But suddenly just one was mounted. The other one moved from RAW to NTFS.

    Oh my godness... after searching and searching of everything. I could restore the header of the HDD via TrueCrypt. Now the HDD moved from NTFS to RAW and I can mount it with TrueCrypt again. But ... windows doesn recognize the filesystem. Now I think there is a problem in the filesystem ... but I have no Idea how to fix it... right now (while writing this post) I make an image of the mounted volume with norton ghost which needs 3 hours...

    So if you have any ideas for me to go ahead,... please tell me.. :)
    I hope I can fix the filesystem ... so that I can restore it completely. :)

    best
    pd
     
  2. pd00

    pd00 Registered Member

    Joined:
    Oct 6, 2012
    Posts:
    5
    So the backup image of the mounted volume is done...

    Also I found this Guide... do you think it is worth a try ?
    http://pastebin.com/5nNTg3Y1

    pd
     
  3. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    991
    Location:
    Hawaii
    It sounds like your HDD was still connected when you reinstalled Win7, so Windows attempted to help you by 'fixing' the encrypted (and thus unrecognizable to Windows) drive to make it look like a normal drive. Thank you, Windows! Not. I only hope you didn't allow Windows to run a full format the drive, as that would be total and irreversible.

    I suggest you spend some time viewing the TC forums, where you will soon discover that there are all sorts of similar pitfalls that you probably didn't know about. TC is actually a very dangerous program. The trick to using it safely is to always keep backups of your headers and your data, as well as learning what not to do (e.g. don't leave encrypted drives connected while reinstalling the OS, don't run any type of partitioning software while an encrypted partition is present, etc.)

    Yes, that procedure can be successful as long as the damage wasn't too severe. I prefer to run data-recovery programs on the unaltered drive first, but if you're in a hurry and don't mind taking on the extra risk then you can skip ahead and attempt to repair the boot sector and the file system by using testdisk followed by chkdsk, as described in the link.
     
  4. pd00

    pd00 Registered Member

    Joined:
    Oct 6, 2012
    Posts:
    5
    Thank you for your answer.

    First of all. I tried Testdisk with the settings in the link... but after the 8th I had the problem that after hours of Testdisk Search routine ... Testdisk just showed me this....

    http://img521.imageshack.us/img521/7/11111222.jpg

    Surprisingly PhotoRec could find within 2 minutes hundreds of mp3 on the mounted device... so I am still hoping that it is possible to fix the stuff.... any Idea what to do after this message of testdisk ?
     
  5. pd00

    pd00 Registered Member

    Joined:
    Oct 6, 2012
    Posts:
    5
  6. pd00

    pd00 Registered Member

    Joined:
    Oct 6, 2012
    Posts:
    5
    And now we go ahead...

    I retried GetDataBack with intense settings and now it found EVERYTHING... Name, Folder Hierarchy ... etc...

    http://s14.directupload.net/images/121009/6o2lm2ir.jpg

    Why is it impossible to just repair it.... I am really confused about that :-/
     
  7. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    991
    Location:
    Hawaii
    It's unrealistic to expect to get back all of your files if the MFT is damaged. Humpty Dumpty was in a similar situation, but I think you're a bit better off. Use photorec and other file-carving programs to recover as much as you can.
     
Loading...
Thread Status:
Not open for further replies.