Problems recovering of a truecrypt partion

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
conradescape
Posts: 1
Joined: 20 May 2013, 18:48

Problems recovering of a truecrypt partion

#1 Post by conradescape »

I am mounting a TrueCrypt partition ok as F: but when i try to access it, system tells me it is unreadable.
This happened while i was at the computer. F: was doing ok and all of the sudden windows tells me cannot use F anymore. If i mount the partition with the wrong password, it tells me so.

I dismounted, mounted the partition, same result. Restarted the computer, mounted, same result.

After reading the forums, i tried recovering it with TestDisk
http://pastebin.com/5nNTg3Y1
and looked over more instructions on
http://www.cgsecurity.org/wiki/Recover_ ... ypt_Volume

I followed the exact steps from http://pastebin.com/5nNTg3Y1
but at step 8 when i choose "Rebuild BS", TestDisk starts doing it but it hangs everytime at:
"Search mft 458752 / 307199521"

Waited more than 30 minutes, testdisk didnt change.
Trying the option "Stop" does do anything. Again, pressed ENTER and waited ~30 minutes, nothing stopped..
The only way to "stop" it is to manually close the app..

Trying Repair MFT fails saying the Cant'read NTFS MFT.

Anyone has any ideas about what i could try to get my files back ?


This is what is being listed after i choose Boot in TestDisk:

Boot sector
Warning: number of heads/cylinder mismatches 16 (NTFS) != 1 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 1 (HD)
Status: OK

Backup boot sector
Warning: number of heads/cylinder mismatches 16 (NTFS) != 1 (HD)
Warning: number of sectors per track mismatches 63 (NTFS) != 1 (HD)
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.


My system is Windows 7 64bit
using TrueCrypt 7.1 and TestDisk 6.14
Hardrives are SATA.

I just left the computer running overnight with the rebuild bs option.
When i got up this is what the log showed :

rebuild_NTFS_BS
file_win32_pread(304,16,buffer,492032(492032/0/1)) read err: read after end of file
file_win32_pread(304,16,buffer,492225(492225/0/1)) read err: read after end of file
file_win32_pread(304,16,buffer,492226(492226/0/1)) read err: read after end of file
(... many lines like above )
Failed to rebuild NTFS boot sector.

Locked