Truecrypt partition not detected; mount device instead

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
playonlcd
Posts: 2
Joined: 29 Apr 2013, 09:35

Truecrypt partition not detected; mount device instead

#1 Post by playonlcd »

Hi,

I have a external hard-disk, wich is encrypted with truecrypt ext3 on Ubuntu 12.04 32 bit.
Last week on a startup the truecrypt partition was unable to mount, giving the message that the password is not right.
I did a "Restore Volume Header" and after that i could mount the device /dev/sdb, not the partition /deb/sdb1, with truecrypt.
The issue is that the device is empty, no files are shown, but there is ocupied space on device.

I tried to find the partition with testdisk_static, even if it reports Structure Ok i can't see any file.
As the space is ocupied seems the files are there, but can't acces them.

Any help is much apricieted.

I tryed to get help on truecrypt forums, but they have a issue with account validation, you don't get the activation link on email.

Thanks in advance!

Simpson474
Posts: 7
Joined: 27 Apr 2012, 19:34

Re: Truecrypt partition not detected; mount device instead

#2 Post by Simpson474 »

It seems that the partition table of your disk has been lost as you only see /dev/sdb and not /dev/sdb1. You are able to mount the volume only because you have restored the volume header - unfortunately TrueCrypt does not check whether the volume header matches the physical size of the disk/partition and therefore the header can be restored at a wrong location and you will be able to mount the volume but none of the sectors can be decrypted. Do you have access to a Windows PC? With TestCrypt you should be able to locate the exact location of the TrueCrypt partition and with TestDisk you should be able to re-create the partition afterwards.
playonlcd wrote:I tryed to get help on truecrypt forums, but they have a issue with account validation, you don't get the activation link on email.
I also was unable to activate an account on the TrueCrypt forum and even trying to contact an administrator does not help as your messages will be deleted immediately. They have an explanation, why the registration process is so strict: they had great success in reducing spam with this strict registration process. I have no doubt in this - if you don't have members in a forum, you won't get spam - the only better way to avoid spam would be to close the forum completely.

playonlcd
Posts: 2
Joined: 29 Apr 2013, 09:35

Re: Truecrypt partition not detected; mount device instead

#3 Post by playonlcd »

Sadlly the partition was encrypted without the option to acces on windows, but i'll givit a try.

Thnak you for advices.

Simpson474
Posts: 7
Joined: 27 Apr 2012, 19:34

Re: Truecrypt partition not detected; mount device instead

#4 Post by Simpson474 »

You won't be able to access it on Windows, but you should be able to restore the partition table on Windows - afterwards Linux should be able to access the volume again.

MURATA
Posts: 1
Joined: 10 May 2013, 19:43

Re: Truecrypt partition not detected; mount device instead

#5 Post by MURATA »

Dear Christophe & All, thank you for TestDisk and your contributions to this forum.

Dear playonlcd, hope you can recover everything a.s.a.p, i have a similar problem on Win7x64 :cry:

Dear Simpson474, firstly i 'd like to thank you for your great "TestCrypt". When i tried to mount my 3TB hdd today, Truecrypt 7.1a said the password was not correct and refused to mount, so i did "Restore Volume Header" hoping that it would be enough to get my drive back, but i was wrong :( now i can see the drive letter in windows but it is unusable/RAW, as if an unformatted drive is installed. After some hours of googling with panic and despair, i found this very nice place to ask for help. I've already run TestCrypt with automatic setting, can you please check the screenshot and guide me on what to do next? Normal header seems to be not available but i was able to mount the disk anyway? :? In your earlier post you mentioned "With TestCrypt you should be able to locate the exact location of the TrueCrypt partition and with TestDisk you should be able to re-create the partition afterwards." How can I accomplish this? I didn't want to try anything else because i'm afraid i can worsen the situation by doing something wrong. For example i'm not sure if I should choose GPT or None for partition types. By the way, GetDataBackNTFS demo didn't work either, it says the filesystem is not NTFS.

Thanks a lot in advance, any suggestions are appreciated.

P.S: Maybe another important thing; the problematic drive is mounted instantly whereas it usually takes 1 second or so with my other proper Truecrypt volumes
Attachments
TESTCRYPT_ANALYSIS.png
TESTCRYPT_ANALYSIS.png (34.5 KiB) Viewed 5182 times

Simpson474
Posts: 7
Joined: 27 Apr 2012, 19:34

Re: Truecrypt partition not detected; mount device instead

#6 Post by Simpson474 »

3 TB HDDs are quite critical due to a lot of bugs in SATA drivers which can result in an address overflow. Therefore as the first step you should check whether HDSentinel reports an addressing issue with the HDD. If not, you can try to mount the volume directly in TestCrypt (click with the right button on the header an select "Mount as Backup Header") - if you are not able to access the data, you may try to use tools like GetDataBack on the volume mounted in TestCrypt.

Locked