cgsecurity.org

Hello folks I am hoping someone can guide me to recover 2 partitions on a hard-disk, one of which was a truecrypt encrypted partition:

I have(had) a 3tb (storage, not system)harddrive, with 2 partitions : One 3gb unencrypted (regular) ntfs partition, and then a second 2.7 odd tb encrypted parition with truecrypt - so the disk had 2 partitions.

Earlier tonight, - truecrypt popped up a warning that said roughly "the truecrypt volume has been automatically unmounted (this can happen if an enclosure or a drive has gone bad)" etc etc..

I tried to re-mount the volume, but the disk was not showing in the system, so I took the drive out of the enclosure and put it into another enclosure, and it did then show up properly - but now the disk is just one 3 tb unallocated partition - the volume will never mount like that because the partitions aren't in place as they were when I encrypted the partition.
Also windows says I need to "initialize the disk" no thanks.

In any case, I am making an effort to get this resolved though I guess it's a long shot. I guess first, I would need to get the partitions back to their former state before I could even think about trying to get the volume mounted, either normally or with the embedded backup header.

How would you guys suggest I proceed? Can I use testdisk to search for lost partitions on the disk, can it detect a truecrypt partition? If I could get the partition layout restored, maybe I could get truecrypt to mount the volume, whether normally or with the embedded backup header whereupon I could run a utility to recover my data.

Advice or thoughts are appreciated

I got testdisk and started working with it - when I open testdisk, select the harddisk, then select EFI/GPT, then Advanced>File System Utilities, I get the following partition layout for the disk, which actually looks correct:
The first partition = looks like the 2.7 tb truecrypt partition
The second = looks like the regular 3gb ntfs partition I created after the truecrypt partition :




When I run a scan on the disk (using the Intel/Pc partition type) I get the following scan results: the highlighted partition looks correct, it's the size of the one I created. The other 2 above it, I don't know what they are I never created them. The scan did not detect the 2.7 tb encrypted partition because I believe that scan type only detects ntfs/fat partitions:




I figure, I need to at least get the partition layout back to what it was when I encrypted that partition with truecrypt, if I ever want to get it mounted again, whether normally or with an embedded backup header. I'm wondering what next step I should take - is it possible to recover that 3gb partition that testdisk detects? any thoughts are appreciated

If you hit 'P' on any of the partitions, do you see any of your files? Sorry,I can't help with getting the partitions back as I'm struggling with my own,but I'll tell you what I've learned from mine if interested.

A 500 GB WD Advanced Format drive running under XP Home. It was a replacement boot. After @ 4 months it developed bad sectors - which I didn't know at the time - after working on it close to week, I bought a replacement drive. I took it out and tried several different external enclosures but it would never been seen. I connected it to another machine and was able to use Testdisk to access it and copy a fair amount of files from it. I put it in mine yesterday, and again, I could access it with Testdisk but it eventually locked the system up.

So, the files are there, retrievable a small amount at a time - Testdisk seems to lock onto the drive and allow for more transfer than Explorer, so keep that in mind.

Finally, to be candid, this stuff is getting too complicated for me, what with my Kaspersky Firewall and its security features and XPs. I don't know if some of this is my fault - I have a 3TB WD Green that has lost it's partitions too.

Oh! One more thing. When I put my 500 gig in an external enclosure, nothing seems to see it. In my computer, Testdisk does and Explorer. I have another external device, it's a Vantec USB jack/cable. The computer sees the drive but prompts to format when i click on it. I'm running Testdisk now. I bring this up because different devices may give different results, so don't give up too soon.

Deity - thanks for the thoughts I appreciate it - I wish you luck in retrieving all of your data - something I wish for myself as well

You're welcome. I just took my 500 GB drive to another computer, Testdisk was able to see and allow me to retrieve a fair amount of info - especially the log. Explorer showed the drive as "Local Disk' and I thought it might be like it was on mine, where I could access it, but just like it did on my USB connector, no access to the info. One thing I've come across reading about all of this, is that it could be an issue where I'm not getting the drive the energy I think I am due to the extension cord and everything else I have in the system. I say this because connecting the drive directly to my system, I can't maintain a connection with it near as long as I can on the other - it also doesn't have near the stuff I have. It's all speculation, but what used to be is no longer due to new tech (AF drives) and I'm struggling not to fall further behind.

Sorry for the long-winded spiel.

Truecrypt encrypts each sector, even a boot sector etc..
So TestDisk doesn't recognize this partition, because it's not standard like FAT or NTFS.
There should be a tool available called "testcrypt", to recover truecrypt encrypted partitions.
In case contact the author.
If your truecrypt issue is solved, you can use testdisk to run another diagnose to get your partitions back.


Fiona