Volume doesn't contain a recognized file system

Discussion in 'encryption problems' started by andromedean, May 4, 2014.

Thread Status:
Not open for further replies.
  1. andromedean

    andromedean Registered Member

    Joined:
    May 4, 2014
    Posts:
    6
    hi there

    I've been using truecrypt on a removable USB drive for several years. This is separated into two volumes. Suddenly I can't access the files in the second volume. After entering the password the z drive appears to open OK. However after clicking on the drive a pop up states

    'you need to format the disk in drive Z before it can be accessed'

    on closing this (obviously refusing the format option) it then states

    "Z is not accessible. Volume doesn't contain a recognized file system please make sure that all required file system drivers are loaded and that the volume is not corrupted"

    I doubt if it's a coincidence that I've just been wiping free space using ccleaner on the first volume although that volume isn't affected. I've also recently changed the extension on the cryptainer file to make it recognizable and easier to open. however that doesn't affect the first volume which has the same file and works perfectly.

    I've attempted repairing headers but I don't think that's the problem

    Any ideas how to proceed?
     
  2. andromedean

    andromedean Registered Member

    Joined:
    May 4, 2014
    Posts:
    6
    I've downloaded testdisk and proceeded along these lines.

    http://www.cgsecurity.org/wiki/Recover_a_TrueCrypt_Volume

    I'm not too sure what I'm doing though.

    Corrupted Standard Volume file system
    Sometimes both Standard Volume header and filesystem boot sector are partially overwritten. After recovering the volume header using a backup, the volume can be accessed but the filesystem is still corrupted.

    Recovery under Windows
    Run TestDisk, select the drive letter corresponding to the damaged volume, choose None for partition type, Advanced. TestDisk can repair the FAT/NTFS boot sector, ext2/ext3 superblock.
     
  3. Palancar

    Palancar Registered Member

    Joined:
    Oct 26, 2011
    Posts:
    1,599
    Can you confirm your configuration of two volumes? I am trying to help you make it clear if this is two distinct file based volumes, or IF its a hidden volume inside of an outer/shell volume. I have seen both of these described by users as "two volumes".

    What you described in your first post is EXACTLY what you would see if you WIPED the outer/shell volume and there was a hidden volume.

    This configuration also determines how you proceed, or even if its possible.
     
  4. andromedean

    andromedean Registered Member

    Joined:
    May 4, 2014
    Posts:
    6
    Palancar

    Yes you are correct it's a hidden volume inside of an outer/shell volume. Somehow I had got it in my mind it was two distinct files when wiping free space, but I suppose ccleaner would see the hidden volume as free space?

    I suppose this means it's irretrievable?

    If I access the hidden volume it tells me that zero bytes are available and zero bytes are used
     
  5. Palancar

    Palancar Registered Member

    Joined:
    Oct 26, 2011
    Posts:
    1,599
    Yes, if you did a thorough free space wipe in the outer volume (WITHOUT HIDDEN VOLUME PROTECTION enabled) then your hidden volume data is hopelessly gone. Remember that TC is designed to treat the outer/decoy volume exactly the same whether or not there is a hidden volume within. The design must be that way so that if an adversary ever attempts analysis on an encrypted volume there is no evidence -- either way ---- if a hidden volume exists.

    Sorry, but consider it a lesson learned. BTW --- if you set hidden volume protection and STILL use a full free space wipe you will trigger a TC "alarm" and a small flag would be placed in the volume. NEVER wipe free space on an outer volume with a hidden volume. You can wipe the free space in the hidden volume every single day without any issues (except for wearing out the drive -LOL). The same is true for an encrypted volume with ONLY a shell and no hidden vault.
     
  6. andromedean

    andromedean Registered Member

    Joined:
    May 4, 2014
    Posts:
    6
    Thanks for your help, perhaps the hidden volume protection should be enabled by default?
     
  7. Palancar

    Palancar Registered Member

    Joined:
    Oct 26, 2011
    Posts:
    1,599
    Absolutely not. When hidden volume protection is used there is an OUTER flag displayed in the TC control panel, which indicates the protection is ON. Any adversary could see and would KNOW there is a hidden volume in play. My opinion.
     
  8. andromedean

    andromedean Registered Member

    Joined:
    May 4, 2014
    Posts:
    6
    A further question, I have now reformatted that hidden disk, do I have to do anything else for anything saved on it to be encrypted, bearing in mind that the outer shell is encrypted as before?
     
  9. Palancar

    Palancar Registered Member

    Joined:
    Oct 26, 2011
    Posts:
    1,599
    It is good to go. As a double check when you bring up the TC control panel does the hidden volume display as -- hidden --- in the panel? I ask this just to double check for you.

    Assuming it shows as hidden and you formatted it you are good, but you have one more step ------------------ > create and save a volume header backup for any future problems. Really small at 128 K, but a life saver at times.
     
  10. andromedean

    andromedean Registered Member

    Joined:
    May 4, 2014
    Posts:
    6
    It seems OK. I have created the volume header backup
     
  11. Palancar

    Palancar Registered Member

    Joined:
    Oct 26, 2011
    Posts:
    1,599
    Sounds good to me. Enjoy!
     
Loading...
Thread Status:
Not open for further replies.