TrueCrypt - Recovering a hidden partition Topic is solved

[teddke]

Please forgive me for my poor knowledge on this topic, even though I've been trying to learn this for the last hard week. This forum is the last place for my desperation for data recovery. I've been using TrueCrypt for many years and everything was fine until a sudden power outage when my laptop was without a battery inside.

I had two partitions, a normal partition and a hidden partition, with keyfiles installed for each partition. Since I was working with a hidden partition that day, I had the following problem. Now this partition mounted successfully with the keyfile, but the contents of the partition became - raw format. I have not tried to format it as windows suggests.

I've read information here about the possibility of a rebuild :https://www.cgsecurity.org/wiki/Recover ... ypt_Volume

Code: Select all

Corrupted Hidden Volume file system
If too much data has been stored in the standard volume or if you have tried to defragment the standard volume without protecting the hidden volume (truecrypt --protect-hidden), the hidden volume file system may be partially overwritten. TestDisk Advanced menu can be used to rebuild the missing FAT or NTFS boot sector.

I'm trying to use the testdisk program to repair this corrupted partition, but it writes: "No partition available."

Dear Experts. As I understand it, this is the final and there is absolutely no possibility of recovery?










23.8.2023 13:49 CET recuperation: replaced Russian text in header by translation

[recuperation]

Could you please upload your pictures to this site using the attachments tab on the bottom of the page?
Thank you.

[teddke]

Yeah, sorry, I didn't see that option.

[recuperation]

1_small.png (82.51 KiB) Viewed 162332 times

2_small.png (43.88 KiB) Viewed 162332 times

3_small.png (36.66 KiB) Viewed 162332 times

4_small.png (29.37 KiB) Viewed 162332 times

I'm trying to use the testdisk program to repair this corrupted partition, but it writes: "No partition available."

Dear Experts. As I understand it, this is the final and there is absolutely no possibility of recovery?

That is wrong but there is no guarantee for a success in recovery either. Your assumption typically applies to certain cases with encryption, lost keys or having keys but facing destruction of certain disk areas without having full recovery information (that is more than just the key).

Congratulations for reading and quoting the wiki. You belong to the filthy few who dare to read!

There is some key information slightly above your quote on that page in the Testdisk manual:

Corrupted Standard Volume file system

Sometimes both Standard Volume header and filesystem boot sector are partially overwritten. After recovering the volume header using a backup, the volume can be accessed but the filesystem is still corrupted.
Recovery under Windows

Run TestDisk, select the drive letter corresponding to the damaged volume, choose None for partition type, Advanced. TestDisk can repair the FAT/NTFS boot sector, ext2/ext3 superblock.

You are not examining a disk. Truecrypt provided you with an acess to a volume (or partition) presenting you "Drive 0". This is not a disk. It is a partition. It does not have a partition table. The partition table is at the beginning of your disk. The partition does not contain another partition table. You should have selected "None" for partition type.

Use the advanced function to copy the decrypted but still broken volume/partition to a file on a secure place before modifying your partition using Testdisk.

Having a decrypted file of your partition simplifies the use other recovery software like commercial stuff or Photorec, the recovery software of last resort.

[teddke]

Thanks for the details on clarifying these points! As you said, I made a copy of the disk image.dd
Next, I choose "None", but the next step prompts me to choose a partition type. I'm not sure I remember exactly what the partition type is for it. Should I try FAT32 first, then try NTFS, then ext2/ext3 superblock ?

8.png (77.28 KiB) Viewed 162320 times

[recuperation]

What's the name of your operating system you used when you created a standard and a hidden partition?
Is there a file bigger then 4 GB contained in your hidden partition?

[teddke]

At the time I created these partitions I was running Windows Server 2012. Now I looked at the main partition (not hidden) it is mounted as NTFS, so most likely the file system was similar. But then, when selecting "NTFS", it gives the following:

9.png (35.46 KiB) Viewed 162142 times

then I select "Rebuild BS" and then I get the following:

10.png (35.52 KiB) Viewed 162142 times

11.png (57.86 KiB) Viewed 162142 times

[teddke]

I also tried FAT32

12.png (57.01 KiB) Viewed 162140 times

FAT16

13.png (35.25 KiB) Viewed 162140 times

exFAT

14.png (32.34 KiB) Viewed 162140 times

I'm not sure if I should try rebild in these cases..

[recuperation]

On which physical drive is the hidden partition located?

[teddke]

I originally put the partition on a Samsung T5 portable ssd (#1), but when the crash happened, I copied everything to the internal ssd (#2) for backup. So now I do all my manipulations with the internal ssd (#2)

1.png (91.94 KiB) Viewed 162096 times