Unable to locate a specific deleted Veracrypt container file for undelete Topic is solved

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
BRAC
Posts: 8
Joined: 01 Aug 2017, 14:17

Unable to locate a specific deleted Veracrypt container file for undelete

#1 Post by BRAC »

Hello,

I've been trying to recover a deleted Veracrypt file (30GB) from an external disk using TestDisk. However, navigating the results page for one specific file is a near impossible task with a listing of nearly 400000 files (found from Recuva). It's a whole lot worse than searching for a needle in a haystack. Tried opening the log file (88MB) in Word. Sadly, it's been nearly a day it still hasn't loaded the complete list. The last check was at 22000 pages and counting. I'm trying to locate a file named MVS without extension. Any advice on how to go about this is appreciated.

Also, I have a newer copy of the said file (45GB) which sadly seems to be corrupted ( a .chk file) after an unexpected disconnection of the external disk. Tried repairing it using Unchk3 utility but it returns an error. Although I can mount the veracrypt volume , it's inaccessible with "disk structure is corrupt and unreadable" error. So, it seems recovering an earlier deleted file is my only option. Of course, I was Smart enough not to keep a back up of this one particular file . Every thing else is neatly backed up.

I've attached a screenshot of the Recuva recovery list. The file named named MVS (marked excellent) is what I'm trying to recover and one named found.001 is the latest possibly corrupt file ( I do have a back up of this).
Attachments
capture-20170731-010922.png
capture-20170731-010922.png (119.66 KiB) Viewed 6897 times

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Unable to locate a specific deleted Veracrypt container file for undelete

#2 Post by cgrenier »

When TestDisk lists you all the files, press 'f' to create a filter and use "MVS" in capital letters. Press "r" to reset the filter(s) if needed.

BRAC
Posts: 8
Joined: 01 Aug 2017, 14:17

Re: Unable to locate a specific deleted Veracrypt container file for undelete

#3 Post by BRAC »

Thanks for the reply.

Tried the filter but the 'MVS' file is not listed although it shows up in Recuva. Is there a deep scan option like the one you have in the 'Analyze ' option. Or, does TestDisk not recover encrypted files for some reason?

Also, I would like to be able to repair the damaged encrypted container, if possible. Can TestDisk manage that. When I tried 'Analyze>List files on the mounted drive, it said "Can't open filesystem. Filesystem seems damaged." although the structure is ok. Is it a lost cause or are there other options.

Thanks in advance.

BRAC
Posts: 8
Joined: 01 Aug 2017, 14:17

Re: Unable to locate a specific deleted Veracrypt container file for undelete

#4 Post by BRAC »

Hello,

Just a brief background of the problem above. The concerned external hard disk is my old laptop disk which I use for secondary backup and connected via an enclosure. The disk was partitioned as follows:
Image
The corrupt Vercrypt volume (MVS - 45 GB) happens to reside in drive L:

On the fateful :D day, I had connected a USB flash drive to a port adjacent to the external one. Since the flash drive was showing unusually erratic behavior--likely caused by the slightly problematic external disk-- I disconnected the external disk via 'safe-removal'. Now, the flash drive was back to functioning normally and I could continue as normal.

Then, upon connecting the external disk back I was shocked to find (in Disk Management) unallocated space (28X GB) where there used to be two Dcrypt partitions ( 242 GB + 4X GB). The partitions to the left were intact. Since I already had the backup of the two wiped out partitions, I went ahead with a quick format of the unallocated space in the hope of recreating the said partitions. Upon completion I was asked to restart which I did with no anticipation of what was to come. After the restart there was more pain in that now drive N: too was gone along with the veracrypt container in L:. In its place was a file named file00000001.chk (45 GB).

Subsequently, I tried fixing the chk file with the Unchk3 tool and the built-in chkdsk command to no avail. I also ran the extended (nearly 20 hours) search on the concerned drives i.e. the whole disk, drive L: and the mounted veracrypt file (drive S:) using TestDisk. Although I couldn't make much sense of the results, TestDisk reports the encrypted partition as 'structre is ok' but can't list the files it contains.

I'm posting screenshots of the same. Hope someone can have a look and advise me on the next action.

PS: The old deleted file i.e. MVS still doesn't show up in the undelete list although it does in recuva. And I have since recreated the two partitions above.

Thanks
Image
Attachments
Whole disk_after deep search.jpg
Whole disk_after deep search.jpg (69.86 KiB) Viewed 6879 times
veracrypt partition_after deep search.jpg
veracrypt partition_after deep search.jpg (25.37 KiB) Viewed 6879 times
External Disk partition.png
External Disk partition.png (14.1 KiB) Viewed 6879 times

BRAC
Posts: 8
Joined: 01 Aug 2017, 14:17

Re: Unable to locate a specific deleted Veracrypt container file for undelete

#5 Post by BRAC »

Not enough space to ttach one file above. So, it's here
Image
Attachments
Whole disk_before deep search.png
Whole disk_before deep search.png (26.75 KiB) Viewed 6878 times

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Unable to locate a specific deleted Veracrypt container file for undelete

#6 Post by cgrenier »

If S: is your unlocked Veracrypt continer, when selecting S:, choose None for the partition table type, go in Advanced, List (or Boot, RebuildBS, List)

BRAC
Posts: 8
Joined: 01 Aug 2017, 14:17

Re: Unable to locate a specific deleted Veracrypt container file for undelete

#7 Post by BRAC »

Thanks for the reply.

I've made progress since my last post. Tried 'RebuildBS' repair as well as created a .dd image. Tried mounting the dd image as per your tutorial but the issue persisted. It said both MFT & its mirror were damaged beyond repair.

Anyway went back to recuva and tried scanning for files on the mounted veracrypt file for no apparent reason and just got lucky. All files were intact and I could recover them. The strange thing is when I tried the same with an exact copy of the corrupt container, recuva reported the MFT as damaged. Have no idea why the original file decided to work and not its copy. Anyway, all's well now that I've got my files back.

The positive outcome of all of this is that I've taken the baby step in to the world of Hard disk functioning, data storage (Cylinders/Heads/Sectors/Tracks :mrgreen: )...Will keep TestDisk handy for any future exigencies.

A suggestion I would like to make is to add a deep scan option for deleted files (like recuva). As of now TestDisk doesn't seem to list those hard to access files. Also, a more user (newbie) friendly interface of the deep search results window so those of us a little less technically inclined can make sense of what's wrong.

Locked