VeraCrypt - Disk: Unallocated, Can mount, no data access, Stuck with user dantz's solution

Discussion in 'encryption problems' started by Michael Hecker, Nov 20, 2016.

  1. Michael Hecker

    Michael Hecker Registered Member

    Joined:
    Nov 20, 2016
    Posts:
    2
    Location:
    Germany
    Dear community,

    I really hope you can help.
    • I have an external HDD, fully encrypted with veracrypt
    • In the past everything was working fine
    • Yesterday, while working on a file, a file access error occurred. This happened in the past when I accidentally came with my hand against the USB cable. This might have happened now again
    • I rebooted the notebook and mounted the disk again
    • When trying to open the disk in windows explorer, there was an error message, which basically said that the drive can not be opened and asked, if I want to format the drive
    What I have done so far:
    • I have restored the header file from the disk
    • I ran testdisk
      • Quick mode did not find a partition
      • I started deep search and hired a data recovery expert via upwork.com. He said, that I should abort testdisk, because he has better tools
    • He ran File Scavenger, but it did not find anything
    • I have read all the threads here - Especially: https://www.wilderssecurity.com/threads/truecrypt-missing-partition-table.336671/
      • As recommended, I started at step 3.3 and opened the mounted drive in WinHex. Although the disk is mounted, I can not find any non-random patterns
    • I saw in windows disk management that the disk is shown as "unallocated"
      • Before the error, the space was allocated and drive letter Z was assigned
    • I'm creating a bit-by-bit backup currently and want to test the "create volume without formatting the drive"-solution. Do you think this could help?
    • I'm worrying, since WinHex is not showing any non-random data
    • How likely is it that the header is corrupt (all data is lost), when veracrypt mounts the drive?
    I really hopy you can help. User dantz seems to be very familiar with these kinds of problems. Can I or someone in the community contact him and ask for help?

    There is sensitive data on the drive, that I really need to recover.

    Thank you for your help.

    Yours,
    Michael
     
  2. Michael Hecker

    Michael Hecker Registered Member

    Joined:
    Nov 20, 2016
    Posts:
    2
    Location:
    Germany
    You guys are amazing!!!
    There was a lot of critical company data on the disk and I were able to save all of it with the help provided by this board.

    After reading all the relevant threads, I found two options.
    1. Export Test File from physical drive, test decryption, export all encrypted data
    2. Create a new Simple Volume (size = default size = max size, do not assign letter or path, do not format drive) + restore header afterwards
    After cloning the disk (-> Will always do this in the future first), I went for option 1, because option 2 sounded like a lucky punch to me, while option 1 is a very analytical process.
    After building an Excel File to do the math mentioned in the posts and testing the process with a new USB stick, I were quite optimistic at first. However, while you could see the beginning and end of the encrypted data on the new usb stick beautifully, it was very difficult to find the start byte on the HDD. So I went for option 2 (new (cloned) disk) and it worked like a charme. All data is recovered.

    I'm not quite sure why it works, but it feels like winning the lottery.

    Thank you very much!
    + A big thank you to user dantz. His comments in all the threads represent 95% of the steps/tests I wrote down.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.