VeraCrypt Encrypted HFS+ Partition lost

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
kdvr
Posts: 2
Joined: 26 Nov 2017, 14:34

VeraCrypt Encrypted HFS+ Partition lost

#1 Post by kdvr »

Hope someone can give me some pointers on this issue.

I have a Western Digital Elements 3TB external drive of which I have encrypted the entire main partitionthru VeraCrypt.

This worked until recently when a I ran the fsck.hfs instead of fsck.hfsplus drive fixer and not paying proper attention. Had to do this because OSX refused to mount the drive and only Linux allowed access. This sometimes happens when Journaling is turned on. This is where it went terribly wrong. Somehow it lost the idea of what partition it is. Resulting in the vague "unknown fstype, bad password or options?" in VeraCrypt . Trying to do another fsck didn't work, as it turns out the b-tree was corrupt and other unexplained errors.

So what I am hoping now is to restore the partition via testdisk. I've read multiple tutorials where the data that was provided by Testdisk was enough to restore the GPT partition. (such as: https://perrohunter.com/repair-a-mac-os ... ion-table/)

First of ran testdisk and chose GPT from the partition list and did a quick search. This resulted in, what seems to me, rather a mess. I can see HFS mentioned, but what is MS Data doing there?

Code: Select all

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/mapper/veracrypt1 - 3000 GB / 2794 GiB - 732480960 sectors
     Partition               Start        End    Size in sectors
>P MS Data                 11122106   11147705      25600
 P MS Data                 11768339   11769110        772
 P MS Data                 28879818   28905417      25600
 P MS Data                 28931355   28932126        772
 P Mac HFS                 39692186   39695103       2918
 P MS Data                 52544319   52545090        772
 P Mac HFS                 80806705  101306178   20499474
 P MS Data                163242794  183132201   19889408
 P Mac HFS                227578819  227581736       2918
 D MS Data                228040142  254254541   26214400
 D MS Data                237702202  263916601   26214400
I was running the deep search but somehow the bloody terminal crashed, but that just showed, at 78%, only MS Data partitions. Re-running the quick search again so I can do a deep search later I expect this to finish tomorrow so it will take another X hours for deep search.

Questions:

- Should I have selected Mac in the partition list before running analysis?
- Is there a 'cheat' way to fix this? I mean, I know it is the entire drive that has been encrypted. So in a way I was thinking of just using Startblock 0 to X (need to find out what the last block is) to recover the partition
- Is there hope, and I do not mean in a spiritual way?

Any useful pointers are greatly appreciated!

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: VeraCrypt Encrypted HFS+ Partition lost

#2 Post by cgrenier »

I don't know if it will work with an HFS+ filesystem but TestCrypt should be able to find the partition location http://testcrypt.sourceforge.net/

kdvr
Posts: 2
Joined: 26 Nov 2017, 14:34

Re: VeraCrypt Encrypted HFS+ Partition lost

#3 Post by kdvr »

Ah, so even if I have used VeraCrypt to attach the drive (not mount it) Testdisk is unable to verify the partition am I correct?
Lesson learned, never encrypt a disk ever again :cry:

Locked