Truecrypt partition corrupted, not recognized by Testcrypt

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Neur0n
Posts: 1
Joined: 28 Jul 2013, 20:56

Truecrypt partition corrupted, not recognized by Testcrypt

#1 Post by Neur0n »

Hello everybody,

I just moved to another country and decided to bring some personal and important experimental data with me on an encrypted partition on a new hard disk (WD My Passport 1 TB). Using Truecrypt 7.1a, I filled the disk with random data and then created two main partitions. The first (NTFS; 465.80 GB) contains some data that I did not consider sensitive. The second (RAW; 465.67) contains both a hidden and a normal Truecrypt partition. Unfortunately, when I arrived at my destination I was no longer able to mount either one of these encrypted partitions. It appears that the headers may have been corrupted, as neither one of my partitions could be decrypted using my passwords.

After trying to recover the volumes with truecrypt (restore volume header), I tried to find the partitions using the nice TestCrypt application. Unfortunately TestCrypt found no evidence of any of the two partitions. I then decided to give TestDisk a try to see if there were some errors on the disk that could account for these problems. Here's the results of my quick scan:

Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121597 255 63

The harddisk <1000 GB / 931 GiB> seems too small! << 4791 GB / 4462 GiB>
Check the harddisk size: HD jumpers settings. BIOS detection...

The following partitions can't be removed:
Partition Start End Size in sectors
HPFS-NTFS 268185 192 51 487311 163 13 3520257326
FAT32 340701 116 43 582561 51 44 3885476801
HPFS-NTFS 376245 50 16 461034 185 5 1362143780

After clicking Continue, the following appeared:
HPFS-NTFS 0 32 33 60806 235 37 976861184 [Backup]

Could any of these errors be related to the problems I have with Truecrypt? And why did Testdisk report an FAT32 partition. Any suggestion or ideas on what steps to take next to try and recover the encrypted data are highly appreciated! Thanks!

Jasper

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Truecrypt partition corrupted, not recognized by Testcry

#2 Post by Fiona »

Did you already get in touch with the testcrypt-developer Simpson474 to get some assistance?
TestDisk and PhotoRec only working with standard file systems.
But encryptet partition are not standard like Intel-MBR anymore.
TestDisk would only be a try, if your disk is decrypted.
Could any of these errors be related to the problems I have with Truecrypt? And why did Testdisk report an FAT32 partition.
There is only one fat-partition in your partition table.
Might be probably due to TrueCrypt?
But it's difficult to judge or determine!
TestDisk finds a partition running Quick Search and also has a label [Backup] on it.
Did you have a try to list your files by pressing p?
Did you get an error message or have you been able to list your files?
I have no idea, is your disk still encrypted or already decryptet?

Fiona

mfilsht170
Posts: 2
Joined: 17 Nov 2013, 21:19

Re: Truecrypt partition corrupted, not recognized by Testcry

#3 Post by mfilsht170 »

Please help!!

I have just read your posts from a year ago, regarding recovering a partition.

http://forum.cgsecurity.org/phpBB3/post ... n474#p4449

I JUST RAN INTO THE SAME PROBLEM... I ran TrueCrypt on external `1tb drive. When i came back in the morning, i had the same message, stating that "please remove protection from the drive and resume" . I remembered that at some point i enabled bitlocker on the drive. but when i went to remove the bitlocker, it says "Incorrect parameters". I don't know if the solutions in the last post where the problem was resolved are custom to each particular situation, but i am truly desperate, and i am reaching out for your help.

I didn't want to tinker with anything without "adult" supervision...:)

Please let me know if you could assist me, and if yes, what additional information do you need from me to help me.

THANK YOU VERY MUCH!!

Locked