cgsecurity.org

lastedit: 2704201

i accidentally "quick formatted" start partition of my "external usb hdd" which was managed by True Crypt
i have tried to create new partition but i couldn't fix it, so someone more talent than me if can help im very thankful.
(its contains family pics etc..

Drive is as i remember: (negativ things)
*total crypt ed (sector by sector"
*file system "NTFS"
*hided patition
*password protected
*i have no "True Crypt rescue disk"

positive things are:
*i havent touch it much
*i remember password whitch i set on it
*im pretty sure drive is healthy "psychically"

operating system is use: win 7, testdisk-6.14.

Deep Search made are there is screenshots of output.





Deep Search + P-fuction made are there is screenshots of output






SECOND DAY SCREENS

Deeper-Search-1

Deeper-Search-2

Deeper-Search-1-P@function

Deeper-Search-2-P@funcktion

TestDisk found two partitions, did you check them and press p to list your data?
Please let me know.
If you deleted your truecrypt partition, and you can't find your data through listing it, it would be an idea to contact simpson474.
http://sourceforge.net/projects/testcrypt/
He already recovered a lot of TrueCrypt cases successful.
Until yet I'd suggest not to change anything to your disk, without recommendation.
Do you have a backup of your truecrypt header?
If he doesn't support you, please let me know!

Fiona

Fiona wrote:TestDisk found two partitions, did you check them and press p to list your data?
Please let me know.
If you deleted your truecrypt partition, and you can't find your data through listing it, it would be an idea to contact simpson474.
http://sourceforge.net/projects/testcrypt/
He already recovered a lot of TrueCrypt cases successful.
Until yet I'd suggest not to change anything to your disk, without recommendation.
Do you have a backup of your truecrypt header?
If he doesn't support you, please let me know!

Fiona

Thnx 4 fast reply, i let TestDsik program on until i hear if someone tell to do something smart. (deep search)

The difference is, TestDisk works Intel Standard.
TrueCrypt encrypts each sector, then it's not intel standard anymore.
TestDisk would probably able to handle a partition if you're able to mount it using truecrypt.

If you were quick formatting your partition, it overwrites your file system.
Your data are still underlying in your sectors.
Then, you'll need datarecovery software like PhotoRec or some commercial tools.
Your current partition is empty like a fresh formatted one.
Please don't write anything to your disk anymore, otherwise you're going to overwrite sectors with your valuable data.

Now at the moment, it's important to get your truecrypt drive mounted.
You should have a try to use testcrypt.
That's why I suggested to get in touch with simpson474.
If you got your truecrypt drive mounted, then we can have a diagnose to get your data off of your disk.

Fiona

SECOND DAY REPORT
-Scanned with software called TestCrypt Version 3.0
-After long scan it found one NTFS Partition
-I Run again TestDisk deep search

Have you been able to mount your partition using TrueCrypt?
In TestDisk it might be possible that you should select that trucrypt mounted drive.

Fiona

Fiona wrote:Have you been able to mount your partition using TrueCrypt?
In TestDisk it might be possible that you should select that trucrypt monted drive.

Fiona

yes i think so. there is screens of output after TrueCrypt treatment or how to say it
What you prefear to do next ..?

Did you mount the partition in TrueCrypt or in TestCrypt? You can try a deep scan of TestDisk afterwards - however TestDisk is mainly written to locate lost volumes and even a quick format destroys a lot of data. In most of this cases real data recovery software has to be used: Photorec (shipped with TestDisk) would be an option but without any filename or directory structure recovery. If you need the filenames you could try evaluation versions of GetDataBack or R-Studio to check whether the filenames can be also recovered.