Unable to read TrueCrypt volume

Discussion in 'encryption problems' started by SniffSnoff, Jan 24, 2013.

Thread Status:
Not open for further replies.
  1. SniffSnoff

    SniffSnoff Registered Member

    Joined:
    Jan 24, 2013
    Posts:
    3
    Location:
    Germany
    Yet another question to the TrueCrypt specialists out there...

    Win7/64, TrueCrypt 7.1

    Last time I mounted my 3TB WD external, fully encrypted (not just the partition), non-system HD, I got a message stating that it hadn't been dismounted correctly the previous time, and that there could be errors on the volume.

    Despite the fact that the data were readable, I (quite foolishly) accepted TrueCrypt's proposal to run chkdisk.

    According to the chkdsk report, corrupted files were found and deleted, improperly allocated space recovered, and 4 sectors marked as bad/unreadable. Seemed like a good result.

    The problem is now that when I try to mount the disk, TrueCrypt generally freezes and doesn't respond. And when it manages to mount the disk, it takes no less than 30sec.-1min. In any case, no data can be found. The volume letter appears in Windows Explorer, but it too freezes and doesn't respond anymore when trying to see its contents (BTW, that happened right after the chkdsk too).

    I tried to restore the volume header and the backup volume header using the TrueCrypt function - to no avail.

    When I manage to mount the disk, its properties in TrueCrypt show a "Data Read since Mount" of about 4 GB (instead of the usual 88 MB or so). I guess that explains the long mounting time, and may hint at the nature of the problem...

    I must point out that except for the original "Your volume may be corrupted" warning, I get no error messages whatsoever.

    TrueCrypt works fine with my other encrypted disks.

    I have read the related posts in this forum, but don't feel proficient enough to "experiment"... Above all, I don't want to make the situation even worse than it is.

    Any help/hint would be greatly appreciated. Thanks !

    S.
     
  2. Cudni

    Cudni Global Moderator

    Joined:
    May 24, 2009
    Posts:
    6,956
    Location:
    Somethingshire
    Those bad sectors spell bad news for that container as it might have introduced too much damage.
     
  3. SniffSnoff

    SniffSnoff Registered Member

    Joined:
    Jan 24, 2013
    Posts:
    3
    Location:
    Germany
    The situation is far from rosy, indeed. (And I'm not 100% positive the chkdsk report mentioned "sectors". It could have been "clusters".)
    However, if I can get even just some of my files back, it's definitely worth spending some time on it.
     
  4. SniffSnoff

    SniffSnoff Registered Member

    Joined:
    Jan 24, 2013
    Posts:
    3
    Location:
    Germany
    Looks like I made some (slight) progress...

    With WinHex I managed to extract a file of what seems to be the embedded backup volume header. If I made no mistake, the file should consist of the last 131'072 bytes of the "unreadable" drive. In any case, Truecrypt can mount it without problem.

    However, when trying to apply the "Restore volume header" function in TrueCrypt using this new file, I get the following message : "The size of the volume header backup is incorrect".

    So, what should be the correct size of the file ? And how can I change it ?

    My plan is to clone the crashed drive (any hint about free cloning programs is very welcome) and try and restore the volume header on it.

    Any help will be met with my most noobishly heartfelt gratitude !
     
Loading...
Thread Status:
Not open for further replies.