cgsecurity.org

I am trying to access the data on a 5Tb external USB hard drive that is encrypted using TrueCrypt and holds an NTFS volume.

After entering the password I am able to mount the drive, and if I check the filesystem (using that option within TrueCrypt) the chkdsk runs successfully and finds what seems to be the correct number of files on the disk.

In Windows file explorer, when the PC is selected, the mounted TrueCrypt volume shows the correct amount of used and free space. But when I select the drive itself, explorer says it is empty and shows no files.

When I run TestDisk on the mounted volume using Advanced - Boot with "none" as the partitioned table type, it shows that the "Boot sector" is "OK", but that the "Backup boot sector" can't be read and has status "bad".



On this forum in other threads I've seen the recommendation to "TestDisk, Advanced, Boot, RebuildBS, List. If you can see your files, choose Write, confirm, Quit". I can see my files (within the root "backup" directory, which is correct) but there doesn't seem to be any option to "choose Write". If I quit, the files still are not visible in Windows file explorer even though I could see them in TestDisk.

Is "Org. BS" the option I need to use? It looks like it might be, but I would like to confirm before using it as this seems different to what has been recommended previously. The only other option is "Dump", which sounds different to "Write". If a "Write" option should be visible, where would it be?

This is what I see:




What should I do next? Thank you for this tool and for any guidance you are able to offer.

Boot sectors are not subject to write operations during the life of a file system.
The bad backup boot sector suggests possible dammage on your disk that I would examine using smartmontools. If necessary I would clone the disk using ddrescue as described in the manual.

I would then use the clone to copy the content of your Truecrypt encrypted device to a third disk and verify if the copied content is usable.
The target of this copy operation may very well be another device that was encrypted using Truecrypt.

You said that you are missing a "write" function. I remember that the term "write" is used within TestDisk when it comes to writing partition information which is not the case in your incident. "Orig. BS" should be the read menu entry to fix the backup boot sector.

Thank you for your response.

I'd like to confirm that I've understood correctly.

Is the reason the files are visible under the TestDisk "list" option that they are still there on the area of the disk where they are written, but that failure of the physical disk is stopping Windows file explorer from showing them? (Even though they can be seen by TestDisk and chkdsk?)

recuperation wrote: 07 Dec 2024, 10:59 Boot sectors are not subject to write operations during the life of a file system.
...
You said that you are missing a "write" function. I remember that the term "write" is used within TestDisk when it comes to writing partition information which is not the case in your incident. "Orig. BS" should be the read menu entry to fix the backup boot sector.

This seems to say two things at the same time — that the backup boot sector isn't written to, but that it can be fixed using the "Orig. BS" option. Is that something that would fix the files being invisible in Windows explorer? Or is it likely unrelated?

Thank you for your time and guidance. I'm sorry I'm struggling a bit to understand, and I'd like to make sure I understand correctly before making any changes to the disk.