cgsecurity.org

Hello,

I want to recover a deleted Truecrypt partition. I successfully ran TestDisk and found 2 partitions which meet the same size of my original Truecrypt partition. I chose the [ backup to file ]option and ended up with 2 image.dd files. Only one of them contains my Truecrypt partiton and the other one, must be the free-unallocated space "partition" I remember from my original partition table.

I read on the TestDisk website and tried to mount each of them with Truecrypt CLI, but Truecrypt says "wrong password or no truecrypt partition". I absolutely know the password.



So I'm struck here struggling to reach / mount my Truecrypt partition from one of these image.dd files. One of the files must be the Truecrypt partition and the other one, the free-unallocated space.

* Anyone can help?
* One more thing: I noticed in TestDisk, that it always says "NTFS" format on these 2 partitions. But this is impossible - it should be RAW format for the Truecrypt partition. I searched, but couldnt find a way to change it to RAW??

Try http://testcrypt.sourceforge.net/ It may find your lost partition.

cgrenier wrote:Try http://testcrypt.sourceforge.net/ It may find your lost partition.

How can I feed TestCrypt with the 2 image.dd files, that were generated by TestDisk? The Truecrypt partition should be on one of the image.dd files. Scanning with TestCrypt the whole computer, didnt work.


Edit: I found a way to mount the image.dd file: I used "VBoxManage convertfromraw" to generate a fixed (!) size VHD file. Then I mounted it via the Windows 7 Professional / Ultimate, Disk-Management Tool. Because then it is displayed as a volume for Truecrypt and TestCrypt. OSFMount does not work here! However TestCrypt didnt found any Truecrypt partition.

As I was creating the backup image.dd from TestDisk, it showed me the suspected Truecrypt partition as a M???/NTFS partition... However, after mounting it in Disk-Manager it says "RAW". Does this matter? How could I change the partition from M???/NTFS into completely RAW? Or is that correct already?