TRUECYPT, USB, HDD CRYPTED, HIDED + PASSWORD

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
kokakola
Posts: 4
Joined: 26 Apr 2012, 11:46

TRUECYPT, USB, HDD CRYPTED, HIDED + PASSWORD

#1 Post by kokakola »

lastedit: 2704201

i accidentally "quick formatted" start partition of my "external usb hdd" which was managed by True Crypt
i have tried to create new partition but i couldn't fix it, so someone more talent than me if can help im very thankful.
(its contains family pics etc..

Drive is as i remember: (negativ things)
*total crypt ed (sector by sector"
*file system "NTFS"
*hided patition
*password protected
*i have no "True Crypt rescue disk"

positive things are:
*i havent touch it much
*i remember password whitch i set on it
*im pretty sure drive is healthy "psychically"

operating system is use: win 7, testdisk-6.14.

Deep Search made are there is screenshots of output.

Image
Image


Deep Search + P-fuction made are there is screenshots of output

Image
Image



SECOND DAY SCREENS

Deeper-Search-1
Image
Deeper-Search-2
Image
Deeper-Search-1-P@function
Image
Deeper-Search-2-P@funcktion
Image
Last edited by kokakola on 27 Apr 2012, 13:09, edited 4 times in total.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: TRUECYPT, USB, HDD CRYPTED, HIDED + PASSWORD

#2 Post by Fiona »

TestDisk found two partitions, did you check them and press p to list your data?
Please let me know.
If you deleted your truecrypt partition, and you can't find your data through listing it, it would be an idea to contact simpson474.
http://sourceforge.net/projects/testcrypt/
He already recovered a lot of TrueCrypt cases successful.
Until yet I'd suggest not to change anything to your disk, without recommendation.
Do you have a backup of your truecrypt header?
If he doesn't support you, please let me know!

Fiona

kokakola
Posts: 4
Joined: 26 Apr 2012, 11:46

Re: TRUECYPT, USB, HDD CRYPTED, HIDED + PASSWORD

#3 Post by kokakola »

Fiona wrote:TestDisk found two partitions, did you check them and press p to list your data?
Please let me know.
If you deleted your truecrypt partition, and you can't find your data through listing it, it would be an idea to contact simpson474.
http://sourceforge.net/projects/testcrypt/
He already recovered a lot of TrueCrypt cases successful.
Until yet I'd suggest not to change anything to your disk, without recommendation.
Do you have a backup of your truecrypt header?
If he doesn't support you, please let me know!

Fiona
Thnx 4 fast reply, i let TestDsik program on until i hear if someone tell to do something smart. (deep search)

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: TRUECYPT, USB, HDD CRYPTED, HIDED + PASSWORD

#4 Post by Fiona »

The difference is, TestDisk works Intel Standard.
TrueCrypt encrypts each sector, then it's not intel standard anymore.
TestDisk would probably able to handle a partition if you're able to mount it using truecrypt.

If you were quick formatting your partition, it overwrites your file system.
Your data are still underlying in your sectors.
Then, you'll need datarecovery software like PhotoRec or some commercial tools.
Your current partition is empty like a fresh formatted one.
Please don't write anything to your disk anymore, otherwise you're going to overwrite sectors with your valuable data.

Now at the moment, it's important to get your truecrypt drive mounted.
You should have a try to use testcrypt.
That's why I suggested to get in touch with simpson474.
If you got your truecrypt drive mounted, then we can have a diagnose to get your data off of your disk.

Fiona

kokakola
Posts: 4
Joined: 26 Apr 2012, 11:46

Re: TRUECYPT, USB, HDD CRYPTED, HIDED + PASSWORD

#5 Post by kokakola »

SECOND DAY REPORT
-Scanned with software called TestCrypt Version 3.0
-After long scan it found one NTFS Partition
-I Run again TestDisk deep search

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: TRUECYPT, USB, HDD CRYPTED, HIDED + PASSWORD

#6 Post by Fiona »

Have you been able to mount your partition using TrueCrypt?
In TestDisk it might be possible that you should select that trucrypt mounted drive.

Fiona

kokakola
Posts: 4
Joined: 26 Apr 2012, 11:46

Re: TRUECYPT, USB, HDD CRYPTED, HIDED + PASSWORD

#7 Post by kokakola »

Fiona wrote:Have you been able to mount your partition using TrueCrypt?
In TestDisk it might be possible that you should select that trucrypt monted drive.

Fiona
yes i think so. there is screens of output after TrueCrypt treatment or how to say it :)
What you prefear to do next ..?

Simpson474
Posts: 7
Joined: 27 Apr 2012, 19:34

Re: TRUECYPT, USB, HDD CRYPTED, HIDED + PASSWORD

#8 Post by Simpson474 »

Did you mount the partition in TrueCrypt or in TestCrypt? You can try a deep scan of TestDisk afterwards - however TestDisk is mainly written to locate lost volumes and even a quick format destroys a lot of data. In most of this cases real data recovery software has to be used: Photorec (shipped with TestDisk) would be an option but without any filename or directory structure recovery. If you need the filenames you could try evaluation versions of GetDataBack or R-Studio to check whether the filenames can be also recovered.

Locked