cgsecurity.org

Please forgive me for my poor knowledge on this topic, even though I've been trying to learn this for the last hard week. This forum is the last place for my desperation for data recovery. I've been using TrueCrypt for many years and everything was fine until a sudden power outage when my laptop was without a battery inside.

I had two partitions, a normal partition and a hidden partition, with keyfiles installed for each partition. Since I was working with a hidden partition that day, I had the following problem. Now this partition mounted successfully with the keyfile, but the contents of the partition became - raw format. I have not tried to format it as windows suggests.

I've read information here about the possibility of a rebuild :https://www.cgsecurity.org/wiki/Recover ... ypt_Volume
I'm trying to use the testdisk program to repair this corrupted partition, but it writes: "No partition available."

Dear Experts. As I understand it, this is the final and there is absolutely no possibility of recovery?










23.8.2023 13:49 CET recuperation: replaced Russian text in header by translation

Could you please upload your pictures to this site using the attachments tab on the bottom of the page?
Thank you.

Yeah, sorry, I didn't see that option.

teddke wrote: 23 Aug 2023, 09:16 I'm trying to use the testdisk program to repair this corrupted partition, but it writes: "No partition available."

Dear Experts. As I understand it, this is the final and there is absolutely no possibility of recovery?

That is wrong but there is no guarantee for a success in recovery either. Your assumption typically applies to certain cases with encryption, lost keys or having keys but facing destruction of certain disk areas without having full recovery information (that is more than just the key).

Congratulations for reading and quoting the wiki. You belong to the filthy few who dare to read!

There is some key information slightly above your quote on that page in the Testdisk manual:

Corrupted Standard Volume file system

Sometimes both Standard Volume header and filesystem boot sector are partially overwritten. After recovering the volume header using a backup, the volume can be accessed but the filesystem is still corrupted.
Recovery under Windows

Run TestDisk, select the drive letter corresponding to the damaged volume, choose None for partition type, Advanced. TestDisk can repair the FAT/NTFS boot sector, ext2/ext3 superblock.

You are not examining a disk. Truecrypt provided you with an acess to a volume (or partition) presenting you "Drive 0". This is not a disk. It is a partition. It does not have a partition table. The partition table is at the beginning of your disk. The partition does not contain another partition table. You should have selected "None" for partition type.

Use the advanced function to copy the decrypted but still broken volume/partition to a file on a secure place before modifying your partition using Testdisk.

Having a decrypted file of your partition simplifies the use other recovery software like commercial stuff or Photorec, the recovery software of last resort.

Thanks for the details on clarifying these points! As you said, I made a copy of the disk image.dd
Next, I choose "None", but the next step prompts me to choose a partition type. I'm not sure I remember exactly what the partition type is for it. Should I try FAT32 first, then try NTFS, then ext2/ext3 superblock ?

What's the name of your operating system you used when you created a standard and a hidden partition?
Is there a file bigger then 4 GB contained in your hidden partition?

At the time I created these partitions I was running Windows Server 2012. Now I looked at the main partition (not hidden) it is mounted as NTFS, so most likely the file system was similar. But then, when selecting "NTFS", it gives the following:
then I select "Rebuild BS" and then I get the following:

I also tried FAT32
FAT16
exFAT
I'm not sure if I should try rebild in these cases..

On which physical drive is the hidden partition located?

I originally put the partition on a Samsung T5 portable ssd (#1), but when the crash happened, I copied everything to the internal ssd (#2) for backup. So now I do all my manipulations with the internal ssd (#2)