Win 7 64bit - GPT - TrueCrypt Volume - Damaged Partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
lkmcmillen
Posts: 2
Joined: 03 Apr 2012, 17:57

Win 7 64bit - GPT - TrueCrypt Volume - Damaged Partition

#1 Post by lkmcmillen »

I'm in need of guidance and assistance in recovering the partions and files from a TrueCrypt volume on a GPT drive which I have inadvertenly damaged.

One of the non-system hard drives in my Windows 7 Ultimate 64-bit computer was clearly failing. As that drive was about 90% full I purchased a pair of new 2 TB Seagate ST2000DM001 SATA hard drives to replace that drive, and to provide additional storage.

I installed and partitioned the first new drive using the DISKPART utility that is a part of Windows 7 by selecting the drive, running the "clean" command, creating a GPT partition table, creating a simple volume, and performing a quick format with NTFS. I then created a TrueCrypt volume using TrueCrypt Version 7.1a. Then, forgetting to first make a backup copy of the TrueCrypt Volume Header, I transferred the files from the failing drive to the TrueCrypt volume on the new drive.

After ensuring that the files had transferred correctly, I wiped the failing drive using DBAN and removed it from my system.

I then installed the second new drive, and partitioned and formatted that second drive in the exact same manner as the first. Or so I thought. I quickly discovered that I'd just partitioned and formatted the first drive!!!

I THINK that I've managed to restore the TrueCrypt Volume Header from the backup embedded in the TrueCrypt volume using the TrueCrypt function of -> Volume Tools -> Restore Volume Header, as follows:

1. Selected the device (Partition 2 on GPT drive).
2. Volume Tools -> Restore Volume Header -> Restore the Volume Header from the backup embedded in the volume.

I can mount the device using the original TrueCrypt password. But, there are no files displayed in the Windows Explorer.

With the drive unmounted in TrueCrypt, a TestDisk 6.14-WIP analysis, performed by (1) Selecting the disk; (2) Selecting partition table type {EFI GPT]; selecting [Analyse]; displays the following:

Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63
Current partition structure:

Partition Start End Size in sectors

No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
1 P MS Reserved 34 262177 262144 [Microsoft reserved
2 P MS Reserved 34 262177 262144 [Microsoft reserved

No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
2 P MS DATA 262656 3907028519 3906765864 [Basic data partition
2 P MS DATA 262656 3907028519 3906765864 [Basic data partition]

Based on the above, is there any possibility of my recovering the files stored on this hard drive?

If so, what is the best procedure for doing so?

Would it be safe to perform the following?:

1. Create a backup of the TrueType Volume Header (Which would cause a write to the disk)
2. Repair the (GPT) MS Reserved partition?
3. Repair the Basic data partition (Which is the partition which is the TrueType volume)
4. Restore the TrueType Volume Header.

Thank you.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Win 7 64bit - GPT - TrueCrypt Volume - Damaged Partition

#2 Post by Fiona »

If you decrypted your drive successfully and it appears as unformatted and TestDisk doesn't find something, you should use datarecovery software.
PhotoRec might be a possiblity

lkmcmillen
Posts: 2
Joined: 03 Apr 2012, 17:57

Re: Win 7 64bit - GPT - TrueCrypt Volume - Damaged Partition

#3 Post by lkmcmillen »

I'm left to presume that there is no hope for the recovery of my files.

I spent the last 6 days using testdisk to twice analyze the drive. First with the drive unmounted by TrueCrypt. Then with TrueCrypt mounted. Each analysis took approximately 68 hours. Neither identified any recoverable partitions.

So, I threw in the towel, wiped the disk, and created a new TrueCrypt volume.

For posterity, partitions created and destroyed in the manner described are not recoverable.

Please close this message thread

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: Win 7 64bit - GPT - TrueCrypt Volume - Damaged Partition

#4 Post by remy »

For posterity : in such a case, it's usefull to try recovery with photorec on jp only, to see quickly if volume is well decrypted. If it's the case and testdisk cannot find a partition (even with options expert : yes, cylinder bouodary : no) then try a professionnal tool.

Locked