TRUECYPT, USB, HDD CRYPTED, HIDED + PASSWORD

How to use TestDisk to recover lost partition
Message
Author
kokakola
Posts: 4
Joined: 26 Apr 2012, 11:46

TRUECYPT, USB, HDD CRYPTED, HIDED + PASSWORD

#1 Postby kokakola » 26 Apr 2012, 11:56

lastedit: 2704201

i accidentally "quick formatted" start partition of my "external usb hdd" which was managed by True Crypt
i have tried to create new partition but i couldn't fix it, so someone more talent than me if can help im very thankful.
(its contains family pics etc..

Drive is as i remember: (negativ things)
*total crypt ed (sector by sector"
*file system "NTFS"
*hided patition
*password protected
*i have no "True Crypt rescue disk"

positive things are:
*i havent touch it much
*i remember password whitch i set on it
*im pretty sure drive is healthy "psychically"

operating system is use: win 7, testdisk-6.14.

Deep Search made are there is screenshots of output.

Image
Image


Deep Search + P-fuction made are there is screenshots of output

Image
Image



SECOND DAY SCREENS

Deeper-Search-1
Image
Deeper-Search-2
Image
Deeper-Search-1-P@function
Image
Deeper-Search-2-P@funcktion
Image
Last edited by kokakola on 27 Apr 2012, 13:09, edited 4 times in total.

Sponsored links

User avatar
Fiona
Posts: 2839
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: TRUECYPT, USB, HDD CRYPTED, HIDED + PASSWORD

#2 Postby Fiona » 26 Apr 2012, 12:38

TestDisk found two partitions, did you check them and press p to list your data?
Please let me know.
If you deleted your truecrypt partition, and you can't find your data through listing it, it would be an idea to contact simpson474.
http://sourceforge.net/projects/testcrypt/
He already recovered a lot of TrueCrypt cases successful.
Until yet I'd suggest not to change anything to your disk, without recommendation.
Do you have a backup of your truecrypt header?
If he doesn't support you, please let me know!

Fiona

kokakola
Posts: 4
Joined: 26 Apr 2012, 11:46

Re: TRUECYPT, USB, HDD CRYPTED, HIDED + PASSWORD

#3 Postby kokakola » 26 Apr 2012, 13:09

Fiona wrote:TestDisk found two partitions, did you check them and press p to list your data?
Please let me know.
If you deleted your truecrypt partition, and you can't find your data through listing it, it would be an idea to contact simpson474.
http://sourceforge.net/projects/testcrypt/
He already recovered a lot of TrueCrypt cases successful.
Until yet I'd suggest not to change anything to your disk, without recommendation.
Do you have a backup of your truecrypt header?
If he doesn't support you, please let me know!

Fiona


Thnx 4 fast reply, i let TestDsik program on until i hear if someone tell to do something smart. (deep search)

User avatar
Fiona
Posts: 2839
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: TRUECYPT, USB, HDD CRYPTED, HIDED + PASSWORD

#4 Postby Fiona » 26 Apr 2012, 13:45

The difference is, TestDisk works Intel Standard.
TrueCrypt encrypts each sector, then it's not intel standard anymore.
TestDisk would probably able to handle a partition if you're able to mount it using truecrypt.

If you were quick formatting your partition, it overwrites your file system.
Your data are still underlying in your sectors.
Then, you'll need datarecovery software like PhotoRec or some commercial tools.
Your current partition is empty like a fresh formatted one.
Please don't write anything to your disk anymore, otherwise you're going to overwrite sectors with your valuable data.

Now at the moment, it's important to get your truecrypt drive mounted.
You should have a try to use testcrypt.
That's why I suggested to get in touch with simpson474.
If you got your truecrypt drive mounted, then we can have a diagnose to get your data off of your disk.

Fiona

kokakola
Posts: 4
Joined: 26 Apr 2012, 11:46

Re: TRUECYPT, USB, HDD CRYPTED, HIDED + PASSWORD

#5 Postby kokakola » 27 Apr 2012, 13:09

SECOND DAY REPORT
-Scanned with software called TestCrypt Version 3.0
-After long scan it found one NTFS Partition
-I Run again TestDisk deep search

User avatar
Fiona
Posts: 2839
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: TRUECYPT, USB, HDD CRYPTED, HIDED + PASSWORD

#6 Postby Fiona » 27 Apr 2012, 13:32

Have you been able to mount your partition using TrueCrypt?
In TestDisk it might be possible that you should select that trucrypt mounted drive.

Fiona

kokakola
Posts: 4
Joined: 26 Apr 2012, 11:46

Re: TRUECYPT, USB, HDD CRYPTED, HIDED + PASSWORD

#7 Postby kokakola » 27 Apr 2012, 13:43

Fiona wrote:Have you been able to mount your partition using TrueCrypt?
In TestDisk it might be possible that you should select that trucrypt monted drive.

Fiona


yes i think so. there is screens of output after TrueCrypt treatment or how to say it :)
What you prefear to do next ..?

Simpson474
Posts: 7
Joined: 27 Apr 2012, 19:34

Re: TRUECYPT, USB, HDD CRYPTED, HIDED + PASSWORD

#8 Postby Simpson474 » 27 Apr 2012, 19:48

Did you mount the partition in TrueCrypt or in TestCrypt? You can try a deep scan of TestDisk afterwards - however TestDisk is mainly written to locate lost volumes and even a quick format destroys a lot of data. In most of this cases real data recovery software has to be used: Photorec (shipped with TestDisk) would be an option but without any filename or directory structure recovery. If you need the filenames you could try evaluation versions of GetDataBack or R-Studio to check whether the filenames can be also recovered.


Return to “Partition Recovery”

Who is online

Users browsing this forum: No registered users and 1 guest