Truecrypt Windows, unmountable boot volume.

Discussion in 'encryption problems' started by User1000, Jan 21, 2016.

  1. User1000

    User1000 Registered Member

    Joined:
    Jan 21, 2016
    Posts:
    4
    Hello,
    I try to keep it simple.

    Samsung Netbook with Windows 7 and data partition, both fully Truecrypt encrypted.
    Start, TC asks for PW, takes correct PW :), Windows 7 loading bar appears, loads for 30 seconds,
    then Blue screen, 0x000000ED 0x85DB32B8, 0xC0000185, 0,00000000, 0,00000000 UNMOUNTABLE_BOOT_VOLUME.

    Is the error the Windows MBR or TC Bootloader?
    I tried to get Parted Magic on USB Pen for saving Data before trying to repair anything, but either with Yumi or Rufus, both times it doesn't find the Parted Magic .SQSF.
    I don't have access to the truecrypt rescue disk.

    What to do now?
    Thank you.

     
  2. Pawelxx

    Pawelxx Registered Member

    Joined:
    Jan 21, 2016
    Posts:
    1
    It worked before, or not?
    To rescue data from TC partition use Linux live usb, ex. ubuntu or something lighter, install Truecrypt and mount this way.
    Maybe you got problem with HDD? But its less possible.
     
  3. User1000

    User1000 Registered Member

    Joined:
    Jan 21, 2016
    Posts:
    4
    Yes, it worked before.
     
  4. Palancar

    Palancar Registered Member

    Joined:
    Oct 26, 2011
    Posts:
    1,594
    User1000,

    The suggestion I quoted above is a good one - BUT - if you are new to this stuff that may take more "expertise" than you want for now. Another easier suggestion is to pull the sata drive from the computer and use another computer and TC to access the drive contents. A simple sata to usb cable (10 bucks) should allow you to open the drive on another computer. TC was designed to do this and it is safe as well as easy. This access would allow you to get your data AND do some repairs to the windows OS if you have some expertise with AV problem resolution.

    In my many years of helping others with the symptoms you describe you have the classic Windows BSOD. This then (educated guess at this point not a confirmation) is not a problem with TC but an issue with Windows itself. Most likely it is something got hosed due to infection/AV causing your BSOD. You may want to read around (google around) about BSOD and likely repairs needed to be accomplished.

    With the proper skill set a user can effect amazing repairs in RAM using either of these approaches to access the disk. By far the better suggestion for most users with a "basic" level of computer knowledge is to make and keep solid backups at the ready. For me it takes 20 minutes to restore an encrypted windows system disk without any hassles. Sometimes its a couple of hours to figure out the repair needed. I only do the repairs to stretch myself in forensics, but that is my thing. If YOU just want a working system and don't care about the forensics, then just go the backup route and be done with it for the future.

    Good luck to you.
     
  5. ExtremeGamerBR

    ExtremeGamerBR Registered Member

    Joined:
    Aug 3, 2010
    Posts:
    1,115
    How do you do this? Via some imaging software? I really want to encrypt my Windows 10 partition with Veracrypt but I don't know how to do this in parallel with having some imaging software (I consider that it's essential) (I don't know if this makes some difference, but I use two SSD in RAID-0).

    Thanks and sorry for my bad english!
     
  6. User1000

    User1000 Registered Member

    Joined:
    Jan 21, 2016
    Posts:
    4
    Thanks Palancar, this seems to be a good advice too. Don't know which method i will use so far, will definitely buy such a USB to sata cable.
    But i also have a extern HD, also full encrypted, done from the same netbook. Can I use TC and another PC to mount this extern HD?
     
  7. Palancar

    Palancar Registered Member

    Joined:
    Oct 26, 2011
    Posts:
    1,594
    Of course. An encrypted TC external device should be able to be used on ANY computer running TC, or even just use TC portable and open it with a computer that doesn't even have TC installed. Simple stuff. Advice gleaned from reading your posts. Please consider going the full backup route when you retrieve the sensitive data off the sata drive. From reading your posts it appears to be the better route for you. Opening a system disk "cold" and making repairs is one click from disaster. For your sake always copy the sensitive data you MUST have to another media before your "virgin" attempt at repairing a system disk "cold". Initially just copy and don't change ANYTHING because if you trash it its gone for good.

    ExtremeGamerBR,

    Yes I do full sector imaging - always. Exact replica in both directions. You are going to have to modify your approach from mine because you are using SSD's. Not tough just different. You'll want to go down to our imaging/backup forums here and proceed with a thread there if you need direction. That is not an encryption issue per se, but encryption will necessitate modification to the user's approach. Easy stuff.
     
  8. User1000

    User1000 Registered Member

    Joined:
    Jan 21, 2016
    Posts:
    4
    Hello,
    it has been a while, I connected now the truecrypted HDD from the netbook to a PC, mounted with password, there are four partitions on the HDD
    RECOVERY
    SYSTEM
    HARD DISK A
    HARD DISK B

    I can access all, except HARD DISK A.
    On HARD DISK A is Windows 7 and the needed files on the desktop, but I have no access to this files.
    HARD DISK A/USER/PBA/
    Then it says, I have no access, proceed, use Register Card Security for access, and from here on I do not know what to do. Can you help please?
     
Loading...