Assistance with recovery of Veracrypt (Truecrypt) encrypted drive
Posted: 09 Apr 2019, 13:03
I had a system running with two disk drives, a solid state primary drive containing Windows 10 and a 1TB spinning disk secondary drive for data storage. The secondary drive was encrypted using Veracrypt as a device-hosted non-system volume. The primary partition was encrypted using a different method (McAfee Endpoint Encryption).
The primary drive recently failed catastrophically beyond recovery. Since it was just used for OS and applications I was happy to accept the loss. I bought a new SSD to replace it. Before reinstalling Windows I disconnected the secondary drive, as I had heard reports that the Windows installer can make changes to attached disks.
Windows was reinstalled without a hitch, so I installed Vercrypt v1.23 and I reconnected the secondary drive. Now, when trying to mount the drive using Veracrypt I get an "Operation Failed (incorrect password, not a valid volume, etc.)". I was certain I was using the correct password, so I used 'Restore Volume Header' tool using a backup of the volume header I have. This process completed and now the drive is mounting using my password and is showing a drive letter in Windows Explorer. However, when I attempt to access the contents, I get the error "E:\ is not accessible / The parameter is incorrect".
I came across the Recover a TrueCrypt Volume on the cgsecurity.org website but I'm having trouble following some of the instructions. To quote the relevant section of the article:
I managed to find the 'Analyse' option and I'm currently running this. I getting a few instances of the following warnings:
Not sure if it's relevant or of any concern.
Thanks in advance!
The primary drive recently failed catastrophically beyond recovery. Since it was just used for OS and applications I was happy to accept the loss. I bought a new SSD to replace it. Before reinstalling Windows I disconnected the secondary drive, as I had heard reports that the Windows installer can make changes to attached disks.
Windows was reinstalled without a hitch, so I installed Vercrypt v1.23 and I reconnected the secondary drive. Now, when trying to mount the drive using Veracrypt I get an "Operation Failed (incorrect password, not a valid volume, etc.)". I was certain I was using the correct password, so I used 'Restore Volume Header' tool using a backup of the volume header I have. This process completed and now the drive is mounting using my password and is showing a drive letter in Windows Explorer. However, when I attempt to access the contents, I get the error "E:\ is not accessible / The parameter is incorrect".
I came across the Recover a TrueCrypt Volume on the cgsecurity.org website but I'm having trouble following some of the instructions. To quote the relevant section of the article:
It seems the instructions for the second paragraph above are incomplete. I tried following the instructions (selecting 'None' partition type) but after that I got lost. Any advice?Corrupted Standard Volume file system
Sometimes both Standard Volume header and filesystem boot sector are partially overwritten. After recovering the volume header using a backup, the volume can be accessed but the filesystem is still corrupted.
Recovery under Windows
Run TestDisk, select the drive letter corresponding to the damaged volume, choose `None` for partition type, Advanced. TestDisk can repair the FAT/NTFS boot sector, ext2/ext3 superblock.
I managed to find the 'Analyse' option and I'm currently running this. I getting a few instances of the following warnings:
Code: Select all
Warning: number of sectors per track mismatches 2 (NTFS) != (HD)
Warning: number of heads/cylinder mismatches 16 (NTFS) != (HD)
Thanks in advance!