TrueCrypt - Recovering a hidden partition Topic is solved

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
teddke
Posts: 9
Joined: 23 Aug 2023, 08:39

Re: TrueCrypt - Recovering a hidden partition

#11 Post by teddke »

Current log file

Code: Select all




Fri Aug 25 11:14:41 2023
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, February 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin32 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1024209543168
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=2000398933504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=1023430098944
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=2000381018112
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000396321280
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=2000396321280
filewin32_getfilesize(\\.\J:) GetFileSize err ???????? ???????.

filewin32_setfilepointer(\\.\J:) SetFilePointer err ???????? ???????.

Warning: can't get size for \\.\J:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\O:)=59055669248
Hard disk list
Disk \\.\PhysicalDrive0 - 1024 GB / 953 GiB - CHS 124519 255 63, sector size=512 - SAMSUNG MZVL21T0HCLR-00B00, S/N:0025_38B5_21B7_B8AF., FW:GXA7401Q
Disk \\.\PhysicalDrive1 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Samsung SSD 970 EVO Plus 2TB, S/N:0025_3853_3190_3887., FW:2B2QEXM7
Disk \\.\PhysicalDrive2 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Samsung Portable SSD T5, S/N:1D39F7654321
Disk \\.\PhysicalDrive3 - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - Seagate FA GoFlex Desk, S/N:NA0KBJL2, FW:0D0B
Drive O: - 59 GB / 54 GiB - CHS 115343104 1 1, sector size=512

Partition table type defaults to None
Drive O: - 59 GB / 54 GiB
Partition table type: None

Interface Advanced
   P Unknown                        0  115343103  115343104
Change partition type:
   P NTFS                           0  115343103  115343104

ntfs_boot_sector
   P NTFS                           0  115343103  115343104
filesystem size           8922980849155958266 2712177588380243268
sectors_per_cluster       128 54
mft_lcn                   8656922565675998984 14374428631713765566
mftmirr_lcn               17970793733309430699 8450474270428948987
clusters_per_mft_record   94 2
clusters_per_index_record -38 82
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
Failed to rebuild NTFS boot sector.

ntfs_boot_sector
   P NTFS                           0  115343103  115343104
filesystem size           8922980849155958266 2712177588380243268
sectors_per_cluster       128 54
mft_lcn                   8656922565675998984 14374428631713765566
mftmirr_lcn               17970793733309430699 8450474270428948987
clusters_per_mft_record   94 2
clusters_per_index_record -38 82
Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
Change partition type:
   P FAT32                          0  115343103  115343104

fat32_boot_sector
   P FAT32                          0  115343103  115343104
Boot sector
Bad

Backup boot sector
Bad

First sectors (boot code and partition information) are not identical.
Second sectors (cluster information) are not identical.
Third sectors (second part of boot code) are not identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.
Change partition type:
   P FAT16                          0  115343103  115343104

fat1x_boot_sector
   P FAT16                          0  115343103  115343104
Boot sector
Bad

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.
Change partition type:
   P exFAT                          0  115343103  115343104

exFAT_boot_sector
   P exFAT                          0  115343103  115343104
Boot sector
Bad

Backup boot record
Bad

Sectors are not identical.
Change partition type:
   P FAT32                          0  115343103  115343104

fat32_boot_sector
   P FAT32                          0  115343103  115343104
Boot sector
Bad

Backup boot sector
Bad

First sectors (boot code and partition information) are not identical.
Second sectors (cluster information) are not identical.
Third sectors (second part of boot code) are not identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.
Change partition type:
   P FAT16                          0  115343103  115343104
Change partition type:
   P exFAT                          0  115343103  115343104
Change partition type:
   P Unknown                        0  115343103  115343104

Analyse Drive O: - 59 GB / 54 GiB - CHS 115343104 1 1
Current partition structure:
   P Unknown                        0  115343103  115343104

search_part()
Drive O: - 59 GB / 54 GiB - CHS 115343104 1 1
file_win32_pread(680,11,buffer,115343096(115343096/0/1)) read err: read after end of file
file_win32_pread(680,11,buffer,115343100(115343100/0/1)) read err: read after end of file
file_win32_pread(680,8,buffer,115343099(115343099/0/1)) read err: read after end of file
file_win32_pread(680,14,buffer,115343092(115343092/0/1)) read err: read after end of file
file_win32_pread(680,14,buffer,115343093(115343093/0/1)) read err: read after end of file
file_win32_pread(680,14,buffer,115343094(115343094/0/1)) read err: read after end of file
file_win32_pread(680,14,buffer,115343095(115343095/0/1)) read err: read after end of file
file_win32_pread(680,14,buffer,115343096(115343096/0/1)) read err: read after end of file
file_win32_pread(680,14,buffer,115343098(115343098/0/1)) read err: read after end of file
file_win32_pread(680,14,buffer,115343100(115343100/0/1)) read err: read after end of file
file_win32_pread(680,14,buffer,115343102(115343102/0/1)) read err: read after end of file

Results

interface_write()
 
No partition found or selected for recovery

search_part()
Drive O: - 59 GB / 54 GiB - CHS 115343104 1 1
file_win32_pread(680,11,buffer,115343098(115343098/0/1)) read err: read after end of file
file_win32_pread(680,8,buffer,115343101(115343101/0/1)) read err: read after end of file
file_win32_pread(680,14,buffer,115343092(115343092/0/1)) read err: read after end of file
file_win32_pread(680,14,buffer,115343093(115343093/0/1)) read err: read after end of file
file_win32_pread(680,14,buffer,115343094(115343094/0/1)) read err: read after end of file
file_win32_pread(680,14,buffer,115343095(115343095/0/1)) read err: read after end of file
file_win32_pread(680,14,buffer,115343096(115343096/0/1)) read err: read after end of file
file_win32_pread(680,14,buffer,115343098(115343098/0/1)) read err: read after end of file
file_win32_pread(680,14,buffer,115343100(115343100/0/1)) read err: read after end of file
file_win32_pread(680,14,buffer,115343102(115343102/0/1)) read err: read after end of file

Results

interface_write()
 
No partition found or selected for recovery
Top
recuperation
Posts: 2737
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: TrueCrypt - Recovering a hidden partition

#12 Post by recuperation »

You did not describe how you performed that copy operation, I wonder if that went wrong.
You can run Photorec on the decrypted drive to see if it finds anything at all.
Top
teddke
Posts: 9
Joined: 23 Aug 2023, 08:39

Re: TrueCrypt - Recovering a hidden partition

#13 Post by teddke »

I will try to explain, but if there is anything unclear please ask again.

In the beginning, I took my Portable SSD 2T and allocated 500GB for TrueCrypt storage, and further, this 500GB was divided into 55GB Hidden Partition and the rest 445GB Regular Partition.

I did the copy operation in two ways.

1. At the beginning, when the failure occurred, I physically copied that 500GB file (which was divided into two partitions by TrueCrypt - the main partition and the hidden 55GB partition) from the Portable SSD to a second SSD hard drive on my laptop. (In the picture in red is Disk 1, which is the primary media, and Disk 2, which is where I copied the copy and which I am now manipulating. That is, now all operations now I make with this copy, which is on disk 2.)

2. On your recommendation, I additionally made a copy, but not from the Portable SSD, but already from the copy. For this purpose I mounted the disk through TrueCrypt then it created a virtual partition with a hidden partition 55GB as usual and then TestDisc program selected this disk (in the picture it is disk O), then "None" - then "Image Creation", and as a result I got the file image.dd (55GB).

Now I ran Photorec also on this disk, and it finds some old files that were probably written to the disk space as I understand it before I even used TrueCrypt. Because the files I'm recovering were encrypted, and none of them were found by Photorec.
1.png
1.png (91.94 KiB) Viewed 83199 times
Top
recuperation
Posts: 2737
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: TrueCrypt - Recovering a hidden partition

#14 Post by recuperation »

If you mounted your hidden partition and saved its content into a file and have the hidden partition already examined by Testdisk and Photorec there is nothing more I can tell you.
Top
teddke
Posts: 9
Joined: 23 Aug 2023, 08:39

Re: TrueCrypt - Recovering a hidden partition

#15 Post by teddke »

But the contents of the hidden partition are still not accessible. It is mounted, but Testdisc doesn't see anything there.
There was a similar story here viewtopic.php?p=26147#p26147 and the person didn't find a solution
Top
recuperation
Posts: 2737
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: TrueCrypt - Recovering a hidden partition

#16 Post by recuperation »

But what?
What should I do know?!
Top
Locked

Return to “Filesystem repair”