Truecrypt,disk partitions corrupted, now show as unallocated

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
catvsrat
Posts: 3
Joined: 02 Aug 2014, 16:13

Truecrypt,disk partitions corrupted, now show as unallocated

#1 Post by catvsrat »

Hello folks I am hoping someone can guide me to recover 2 partitions on a hard-disk, one of which was a truecrypt encrypted partition:

I have(had) a 3tb (storage, not system)harddrive, with 2 partitions : One 3gb unencrypted (regular) ntfs partition, and then a second 2.7 odd tb encrypted parition with truecrypt - so the disk had 2 partitions.

Earlier tonight, - truecrypt popped up a warning that said roughly "the truecrypt volume has been automatically unmounted (this can happen if an enclosure or a drive has gone bad)" etc etc..

I tried to re-mount the volume, but the disk was not showing in the system, so I took the drive out of the enclosure and put it into another enclosure, and it did then show up properly - but now the disk is just one 3 tb unallocated partition - the volume will never mount like that because the partitions aren't in place as they were when I encrypted the partition.
Also windows says I need to "initialize the disk" no thanks.

In any case, I am making an effort to get this resolved though I guess it's a long shot. I guess first, I would need to get the partitions back to their former state before I could even think about trying to get the volume mounted, either normally or with the embedded backup header.

How would you guys suggest I proceed? Can I use testdisk to search for lost partitions on the disk, can it detect a truecrypt partition? If I could get the partition layout restored, maybe I could get truecrypt to mount the volume, whether normally or with the embedded backup header whereupon I could run a utility to recover my data.

Advice or thoughts are appreciated

catvsrat
Posts: 3
Joined: 02 Aug 2014, 16:13

Re: Truecrypt,disk partitions corrupted, now show as unalloc

#2 Post by catvsrat »

I got testdisk and started working with it - when I open testdisk, select the harddisk, then select EFI/GPT, then Advanced>File System Utilities, I get the following partition layout for the disk, which actually looks correct:
The first partition = looks like the 2.7 tb truecrypt partition
The second = looks like the regular 3gb ntfs partition I created after the truecrypt partition :

Image


When I run a scan on the disk (using the Intel/Pc partition type) I get the following scan results: the highlighted partition looks correct, it's the size of the one I created. The other 2 above it, I don't know what they are I never created them. The scan did not detect the 2.7 tb encrypted partition because I believe that scan type only detects ntfs/fat partitions:

Image


I figure, I need to at least get the partition layout back to what it was when I encrypted that partition with truecrypt, if I ever want to get it mounted again, whether normally or with an embedded backup header. I'm wondering what next step I should take - is it possible to recover that 3gb partition that testdisk detects? any thoughts are appreciated :cry: :cry:
Attachments
scan2.jpg
scan2.jpg (185.74 KiB) Viewed 4375 times
utils.jpg
utils.jpg (126.29 KiB) Viewed 4375 times

Deity666
Posts: 19
Joined: 29 Jul 2014, 20:40

Re: Truecrypt,disk partitions corrupted, now show as unalloc

#3 Post by Deity666 »

If you hit 'P' on any of the partitions, do you see any of your files? Sorry,I can't help with getting the partitions back as I'm struggling with my own,but I'll tell you what I've learned from mine if interested.

A 500 GB WD Advanced Format drive running under XP Home. It was a replacement boot. After @ 4 months it developed bad sectors - which I didn't know at the time - after working on it close to week, I bought a replacement drive. I took it out and tried several different external enclosures but it would never been seen. I connected it to another machine and was able to use Testdisk to access it and copy a fair amount of files from it. I put it in mine yesterday, and again, I could access it with Testdisk but it eventually locked the system up.

So, the files are there, retrievable a small amount at a time - Testdisk seems to lock onto the drive and allow for more transfer than Explorer, so keep that in mind.

Finally, to be candid, this stuff is getting too complicated for me, what with my Kaspersky Firewall and its security features and XPs. I don't know if some of this is my fault - I have a 3TB WD Green that has lost it's partitions too.

Oh! One more thing. When I put my 500 gig in an external enclosure, nothing seems to see it. In my computer, Testdisk does and Explorer. I have another external device, it's a Vantec USB jack/cable. The computer sees the drive but prompts to format when i click on it. I'm running Testdisk now. I bring this up because different devices may give different results, so don't give up too soon.

catvsrat
Posts: 3
Joined: 02 Aug 2014, 16:13

Re: Truecrypt,disk partitions corrupted, now show as unalloc

#4 Post by catvsrat »

Deity - thanks for the thoughts I appreciate it - I wish you luck in retrieving all of your data - something I wish for myself as well :? :?

Deity666
Posts: 19
Joined: 29 Jul 2014, 20:40

Re: Truecrypt,disk partitions corrupted, now show as unalloc

#5 Post by Deity666 »

You're welcome. I just took my 500 GB drive to another computer, Testdisk was able to see and allow me to retrieve a fair amount of info - especially the log. Explorer showed the drive as "Local Disk' and I thought it might be like it was on mine, where I could access it, but just like it did on my USB connector, no access to the info. One thing I've come across reading about all of this, is that it could be an issue where I'm not getting the drive the energy I think I am due to the extension cord and everything else I have in the system. I say this because connecting the drive directly to my system, I can't maintain a connection with it near as long as I can on the other - it also doesn't have near the stuff I have. It's all speculation, but what used to be is no longer due to new tech (AF drives) and I'm struggling not to fall further behind.

Sorry for the long-winded spiel.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Truecrypt,disk partitions corrupted, now show as unalloc

#6 Post by Fiona »

Truecrypt encrypts each sector, even a boot sector etc..
So TestDisk doesn't recognize this partition, because it's not standard like FAT or NTFS.
There should be a tool available called "testcrypt", to recover truecrypt encrypted partitions.
In case contact the author.
If your truecrypt issue is solved, you can use testdisk to run another diagnose to get your partitions back.


Fiona

Locked