[Solved] Truecrypt partition not recuperable

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Jeff
Posts: 9
Joined: 04 Jun 2014, 09:32

[Solved] Truecrypt partition not recuperable

#1 Post by Jeff »

Hello everybody,

I posted this problem already in the German section but I didn't get any replies, so I try my luck here.

I have a external HD (WD, 1TB), which I did format under Ubuntu (probably 12.04). I then made a partition which had the same size of the HD and encrypted it with Truecrypt. Some days ago, I connected the HD to my PC and couldn't see any partition to mount with Truecrypt. I tried to mount the disk, without any success.

I analysed the HD with testdisk and these are the results:

Code: Select all


Thu Jun  5 15:17:43 2014
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.5.0-47-generic (#71-Ubuntu SMP Tue Feb 18 23:59:30 UTC 2014) i686
Compiler: GCC 4.7
Compilation date: 2012-10-01T12:56:22
ext2fs lib: 1.42.5, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       976773168 sectors
/dev/sda: user_max   976773168 sectors
/dev/sda: native_max 976773168 sectors
/dev/sda: dco        976773168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WD5000BEVT-22A0RT0, S/N:WD-WXK1A10N3804, FW:01.01A01
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WD 10EADS External, FW:1.75
Disk /dev/mapper/cryptswap1 - 5999 MB / 5722 MiB - CHS 11718656 1 1, sector size=512
Disk /dev/dm-0 - 5999 MB / 5722 MiB - CHS 11718656 1 1, sector size=512

Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - WD 10EADS External
Partition table type: None

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
   P Unknown                  0   0  1 121601  80 63 1953525168

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63

block_group_nr 625

recover_EXT2: "e2fsck -b 20480000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=625/7452, s_mnt_count=161/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                     0   0 62 121600 254 59 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Backup superblock, 1000 GB / 931 GiB

Results
   P ext4                     0   0 62 121600 254 59 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Backup superblock, 1000 GB / 931 GiB

interface_write()
   P ext4                     0   0 62 121600 254 59 1953520000 [HD_1TB]
 
Write isn't available because the partition table type "None" has been selected.
New options :
 Dump : No
 Cylinder boundary : Yes
 Allow partial last cylinder : No
 Expert mode : Yes

Interface Advanced
   P Unknown                  0   0  1 121601  80 63 1953525168
Change partition type:
   P ext4                     0   0  1 121601  80 63 1953525168

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
   P Unknown                  0   0  1 121601  80 63 1953525168

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Search for partition aborted

Results

interface_write()
 
No partition found or selected for recovery
Partition table type (auto): None
Disk /dev/sdb - 1000 GB / 931 GiB - WD 10EADS External
Partition table type: Intel

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
No partition is bootable
Ask the user for vista mode
Allow partial last cylinder : No
search_vista_part: 0

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63

Results

interface_write()
 
No partition found or selected for recovery

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63

Results

interface_write()
 
No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Partition table type (auto): Intel
Disk /dev/sdb - 1000 GB / 931 GiB - WD 10EADS External
Partition table type: None
New options :
 Dump : No
 Cylinder boundary : Yes
 Allow partial last cylinder : No
 Expert mode : Yes

Interface Advanced
   P Unknown                  0   0  1 121601  80 63 1953525168
Change partition type:
   P ext4                     0   0  1 121601  80 63 1953525168

   P ext4                     0   0  1 121601  80 63 1953525168
Can't open filesystem. Filesystem seems damaged.
search_superblock

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Current partition structure:
   P Unknown                  0   0  1 121601  80 63 1953525168

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63

block_group_nr 625

recover_EXT2: "e2fsck -b 20480000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=625/7452, s_mnt_count=161/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                     0   0 62 121600 254 59 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Backup superblock, 1000 GB / 931 GiB

Results
   P ext4                     0   0 62 121600 254 59 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Backup superblock, 1000 GB / 931 GiB

interface_write()
   P ext4                     0   0 62 121600 254 59 1953520000 [HD_1TB]
 
Write isn't available because the partition table type "None" has been selected.

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63

block_group_nr 625

recover_EXT2: "e2fsck -b 20480000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=625/7452, s_mnt_count=161/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                     0   0 62 121600 254 59 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Backup superblock, 1000 GB / 931 GiB

block_group_nr 625

recover_EXT2: "e2fsck -b 20480000 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=625/7452, s_mnt_count=161/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                     0   1  1 121600 254 61 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Backup superblock, 1000 GB / 931 GiB

LVM magic value at 10259/233/25

block_group_nr 2401

recover_EXT2: "e2fsck -b 78675968 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=2401/7452, s_mnt_count=161/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                     0   0 62 121600 254 59 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Backup superblock, 1000 GB / 931 GiB

block_group_nr 2401

recover_EXT2: "e2fsck -b 78675968 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=2401/7452, s_mnt_count=161/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                     0   1  1 121600 254 61 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Backup superblock, 1000 GB / 931 GiB
check_FAT: Bad jump in FAT partition

SYSV4 Marker at 51990/91/32

recover_sysv4
     SysV 4               51990  91 32 51990  91 31          0 [|Ԋæh]
     SysV4, 0 B
Partition not added.

     VMFS                 58569  14 45 1413313883 254 49 35764004444738854
     VMFS 1962429706, 18311170 TB / 16653912 TiB
This partition ends after the disk limits. (start=940911911, size=749507878, end=1690419789, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=487/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                 60587 169 54 182188 168 51 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973340855, size=1953520000, end=2926860854, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=487/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                 60587 171 32 182188 170 29 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973340959, size=1953520000, end=2926860958, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=487/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                 60587 173  2 182188 171 62 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973341055, size=1953520000, end=2926861054, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=487/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                 60587 174 43 182188 173 40 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973341159, size=1953520000, end=2926861158, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=487/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                 60587 176 37 182188 175 34 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973341279, size=1953520000, end=2926861278, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=487/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                 60587 177 62 182188 176 59 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973341367, size=1953520000, end=2926861366, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=487/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                 60587 179 40 182188 178 37 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973341471, size=1953520000, end=2926861470, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=487/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                 60587 181  2 182188 179 62 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973341559, size=1953520000, end=2926861558, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=487/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                 60587 182 43 182188 181 40 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973341663, size=1953520000, end=2926861662, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=487/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                 60587 184 45 182188 183 42 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973341791, size=1953520000, end=2926861790, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=487/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                 60587 186 47 182188 185 44 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973341919, size=1953520000, end=2926861918, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=487/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                 60587 188 17 182188 187 14 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973342015, size=1953520000, end=2926862014, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=487/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                 60587 189 50 182188 188 47 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973342111, size=1953520000, end=2926862110, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=487/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                 60587 191 52 182188 190 49 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973342239, size=1953520000, end=2926862238, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=487/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                 60587 193 46 182188 192 43 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973342359, size=1953520000, end=2926862358, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=487/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                 60587 195 24 182188 194 21 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973342463, size=1953520000, end=2926862462, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=487/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                 60587 197  2 182188 195 62 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973342567, size=1953520000, end=2926862566, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=487/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                 60587 199 12 182188 198  9 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973342703, size=1953520000, end=2926862702, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=487/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                 60587 200 53 182188 199 50 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973342807, size=1953520000, end=2926862806, disk end=1953525168)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=487/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                 60587 202 47 182188 201 44 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973342927, size=1953520000, end=2926862926, disk end=1953525168)

HFS magic value at 62786/29/15
part_size 1260520912
     HFS                  62786  29 15 141249 232 42 1260520912 [IE+¯rk^ñ,ÝèdºÔ,È.Í\ͪå>3š¿]
     HFS, 645 GB / 601 GiB
This partition ends after the disk limits. (start=1008658931, size=1260520912, end=2269179842, disk end=1953525168)

HFS magic value at 62786/29/17

SYSV4 Marker at 75739/249/58

recover_sysv4
     SysV 4               75739 249 58 75739 249 57          0 [ê4]
     SysV4, 0 B
Partition not added.

HFS magic value at 82794/17/38
part_size 136314946
     HFS                  82794  17 38 91279  71 56  136314946
     HFS, 69 GB / 65 GiB

HFS magic value at 82794/17/40
part_size 136314946
     HFS                  74308 218 23 82794  17 41  136314946
     HFS found using backup sector!, 69 GB / 65 GiB

HFS magic value at 95930/176/31
part_size 2286586370
     HFS                  95930 176 31 238264  28 14 2286586370
     HFS, 1170 GB / 1090 GiB
This partition ends after the disk limits. (start=1541126568, size=2286586370, end=3827712937, disk end=1953525168)

HFS magic value at 95930/176/33

block_group_nr 6561

recover_EXT2: "e2fsck -b 214990848 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=6561/7452, s_mnt_count=161/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                     0   0 62 121600 254 59 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Backup superblock, 1000 GB / 931 GiB

block_group_nr 6561

recover_EXT2: "e2fsck -b 214990848 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=6561/7452, s_mnt_count=161/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190000
recover_EXT2: part_size 1953520000
     ext4                     0   1  1 121600 254 61 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Backup superblock, 1000 GB / 931 GiB

HFS magic value at 108060/104/55
part_size 8407552
     HFS                  108060 104 55 108583 193  4    8407552 [ÐOæóôØùèP=ËøžÉ÷üœžÿÂï?Ô]
     HFS, 4304 MB / 4105 MiB

HFS magic value at 108060/104/57
part_size 8407552
     HFS                  107537  16 46 108060 104 58    8407552 [ÐOæóôØùèP=ËøžÉ÷üœžÿÂï?Ô]
     HFS found using backup sector!, 4304 MB / 4105 MiB
     Sys=0C               113668  81 32 117375 208 35   59560960
     FATX, 30 GB / 28 GiB
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 18311170 TB / 16653912 TiB)
The following partitions can't be recovered:
     VMFS                 58569  14 45 1413313883 254 49 35764004444738854
     VMFS 1962429706, 18311170 TB / 16653912 TiB
     ext4                 60587 169 54 182188 168 51 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
     ext4                 60587 171 32 182188 170 29 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
     ext4                 60587 173  2 182188 171 62 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
     ext4                 60587 174 43 182188 173 40 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
     ext4                 60587 176 37 182188 175 34 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
     ext4                 60587 177 62 182188 176 59 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
     ext4                 60587 179 40 182188 178 37 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
     ext4                 60587 181  2 182188 179 62 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
     ext4                 60587 182 43 182188 181 40 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
     ext4                 60587 184 45 182188 183 42 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
     ext4                 60587 186 47 182188 185 44 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
     ext4                 60587 188 17 182188 187 14 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
     ext4                 60587 189 50 182188 188 47 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
     ext4                 60587 191 52 182188 190 49 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
     ext4                 60587 193 46 182188 192 43 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
     ext4                 60587 195 24 182188 194 21 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
     ext4                 60587 197  2 182188 195 62 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
     ext4                 60587 199 12 182188 198  9 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
     ext4                 60587 200 53 182188 199 50 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
     ext4                 60587 202 47 182188 201 44 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
     HFS                  62786  29 15 141249 232 42 1260520912 [IE+¯rk^ñ,ÝèdºÔ,È.Í\ͪå>3š¿]
     HFS, 645 GB / 601 GiB
     HFS                  95930 176 31 238264  28 14 2286586370
     HFS, 1170 GB / 1090 GiB

Results
   P ext4                     0   0 62 121600 254 59 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Backup superblock, 1000 GB / 931 GiB
   P ext4                     0   1  1 121600 254 61 1953520000 [HD_1TB]
     EXT4 Large file Sparse superblock Backup superblock, 1000 GB / 931 GiB
   P HFS                  74308 218 23 82794  17 41  136314946
     HFS found using backup sector!, 69 GB / 65 GiB
   P HFS                  82794  17 38 91279  71 56  136314946
     HFS, 69 GB / 65 GiB
   P HFS                  107537  16 46 108060 104 58    8407552 [ÐOæóôØùèP=ËøžÉ÷üœžÿÂï?Ô]
     HFS found using backup sector!, 4304 MB / 4105 MiB
   P HFS                  108060 104 55 108583 193  4    8407552 [ÐOæóôØùèP=ËøžÉ÷üœžÿÂï?Ô]
     HFS, 4304 MB / 4105 MiB
   P Sys=0C               113668  81 32 117375 208 35   59560960
     FATX, 30 GB / 28 GiB

interface_write()
   P ext4                     0   0 62 121600 254 59 1953520000 [HD_1TB]
   P ext4                     0   1  1 121600 254 61 1953520000 [HD_1TB]
   P HFS                  74308 218 23 82794  17 41  136314946
   P HFS                  82794  17 38 91279  71 56  136314946
   P HFS                  107537  16 46 108060 104 58    8407552 [ÐOæóôØùèP=ËøžÉ÷üœžÿÂï?Ô]
   P HFS                  108060 104 55 108583 193  4    8407552 [ÐOæóôØùèP=ËøžÉ÷üœžÿÂï?Ô]
   P Sys=0C               113668  81 32 117375 208 35   59560960
 
Write isn't available because the partition table type "None" has been selected.

TestDisk exited normally.
The quick search finds the partition, but only when the partition table type selected is "none"; if I select "Intel", testdisk finds two (or more in the deep search) FAT32 partitions and I have no idea where they come from. Unfortunately I can't write the partion table to the disk when "none" is selected.

Anyone has some ideas?
Last edited by Jeff on 03 Jul 2014, 09:09, edited 1 time in total.
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Truecrypt partition not recuperable

#2 Post by Fiona »

Sry for your inconvenience, during Whitsun I was on vacation.
Please let me know, do you want to use this topic or your german one?

If you encrypt a partition or disk, each sector will be encrypted also.
So your disk or partition is not standard like Intel, GPT etc.. anymore.

Does your partition still appears as RAW or appears your disk space as unallocated?
Did you try to recover the backup of your truecrypt volume header?

Fiona
Top
Jeff
Posts: 9
Joined: 04 Jun 2014, 09:32

Re: Truecrypt partition not recuperable

#3 Post by Jeff »

Hello Fiona,

the disk space appears as unallocated and the disk has no partition table - the ubuntu disk managent asks to create one (I have duplicated the volume on another hd to try some stuff, without success.

I don't have any backup of your truecrypt volume header; I didn't thought to make some :/

EDIT:

testcrypt can find the partition, but when I mount it, they can't be opened – perhaps because it was formatted as linux only partition by TrueCrypt? I tried to install a programm for windows to read ext*, but it didn't work.
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Truecrypt partition not recuperable

#4 Post by Fiona »

Newer versions of truecrypt including a backup of your volume header at the end of the volume.
Did you try to recover it?
Unfortunately, truecrypt is probably discontinued?
Might be an idea to create an Knoppix-Live-CD and check it?

Fiona
Top
Jeff
Posts: 9
Joined: 04 Jun 2014, 09:32

Re: Truecrypt partition not recuperable

#5 Post by Jeff »

I can only select the entire disk and when I select "Restore the volume header from the backup embedded in the volume" and enter the password, I only get the message "Incorrect password or not a TrueCrypt volume."
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Truecrypt partition not recuperable

#6 Post by Fiona »

Values of your partition like start and size must be identical to your previous affected partition.
In case, an empty and unformatted partition can be added using testdisk.
Did you compare the values found by testcrypt with your current partition?

Fiona
Top
Jeff
Posts: 9
Joined: 04 Jun 2014, 09:32

Re: Truecrypt partition not recuperable

#7 Post by Jeff »

I made a copy of the disk on a bigger HD using the dd command under linux and then created a partition with the same size – whole disk size – of the original one, but it didn't work.

Image

Image

Image

However, it seems that Testcrypt found the partition also for the disk copy.

Image

These are the results of testcrypt with the original disk.

Image

How can I add an empty and unformatted partition using testdisk? I have used the standard Windows tool and Gparted on Ubuntu (on the HD copy, not the original one).
I don't have any current partition and I don't know the original values, but I assume they are the ones testcrypt found (last picture), as the cylinders value is the same for other HD with 1TB space.

Should I try to make an empty and unformatted partition on the original HD after having saved a back up image of it?
Top
User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Truecrypt partition not recuperable

#8 Post by Fiona »

Lokks like your partition is aligned on windows megabyte bondary.
You can use testdisk, partition table type Intel and add your partition using the menu geometry
Start 0/32/33 and end 121601/57/65.
You can write it into your partition table and have another try to retrieve your volume header using its backup.

Fiona
Top
Jeff
Posts: 9
Joined: 04 Jun 2014, 09:32

Re: Truecrypt partition not recuperable

#9 Post by Jeff »

I finally solved the problem :)

Adding a new partition on the original disk didn't work, because TestDisk did reset the last cylinder value to 121600 every time I inserted the right one (121601).

Image

So I decided to give the disk copy (1TB on a 2TB disk, there should be no value limitations for that size) and indeed I could write the partition with the values found by TestCrypt. After restarting the computer TrueCrypt could see the partition, I restored the volume header from the backup embedded in the volume using it and with the right password the volume was successfully mounted and decrypted.

Image
Top
Locked

Return to “Partition Recovery”