cgsecurity.org

I have an external USB mounted HD of 2 TB from Maxtor/Seagate.
On it I had one partition of ca 400 GB not encrypted, and one, of ca 1.4 TB encrypted with TrueCrypt since a few years.
I have runt it both from an old Windows 7 machine and a newer Windows 10 - has worked fine.
So the crash, the system hung and I had to force shutdown and remove the USB HD and restart.
After restart nothing was found when plugging in the HD. Tried Checkdisk, repair, after boot, etc.
After a few tries and reboots the 400 GB partition showed up in explorer and I was able to copy all of the data from it to another HD (phew!).
However, the 1.4 TB TrueCrypt partition (called F:) is not possible to mount in TrueCrypt anymore.
Sometimes TrueCrypt says there is nothing to mount and sometimes it says it has found a problem on it and suggests running repair. However, when running chkdsk on it (ca 12 hours) it comes up with lots of errors but cannot repair since it says it is RAW.
In Disk Manager I can (sometimes) see the two partitions and the 1.4 TB is RAW.
When the 1.4 TB partition and/or the entire 2 TB disk shows up in TestDisk and I analyze it (for about 40 hours) it says it finds errors and no partitions and thus cannot do anything. Very frustrating.
Most times apps like EaseUS and DiskGenius cannot find anything on the USB HD, and it takes about 30 minutes for these apps to just start up and search the system/USB, they seem to be searching the disk for a long time.
Sometimes they find only the 400 GB partition which is no help anymore, but it clearly has a hard time even reading that.
Sometimes when I turn on the system and plug in the USB HB Windows asks to format F: - After lack of options I did a quick format but it did not work - error message.
I have also tried RStudio - it can sometimes find the partition and when I managed to run a scan it only returned I/O device errors on every sector (1117 code).
What else can I do? Is there any data on the disk or not?

I am happy to have recovered the 400 GB, but I really need the other 1.4 TB as well.
Is there any chance of that since it is encrypted with TrueCrypt (even if I could find the files) - or will it just be garbled?
Also: Does it matter what USB port I plug the HD into? - it seems rather random if it can be found or not - I have tried on other systems as well and they do not find it.

I would be extremely grateful for any replies even if it is just to say to forget about it, that it cannot be recovered.
If I cannot get the partition or the data/files back, is there a way I can format the drive and still use it?

thanks in advance!

Reformating your disk was a very bad idea.
You should have cloned your disk using ddrescue as described in https://www.cgsecurity.org/testdisk.pdf, remove the original disk and access your data from the clone.
As you tried to reformat your disk, it may be too late to recover anything...

Thanks for your quick reply.
Sorry I was unclear. When I tried the quick reformat I just got a message that it did not work so the format never went through, so it is not formatted.
I have now connected the disk to other computers and get the same result: They can most of the time not find the disk/partitions.
When they do I run EaseUS and try to scan the lost partition (2TB), it runs for about 20 hours but never advances, does not find anything, goes into deepscan but no result. It is stuck at 0% and 0 files forever and no ETA even.
TestDisk gives similar result, runs forever, finds noting. Chkdsk same thing, runs forever and then says RAW (most of the time it finds no disk).
Seems as if the disk is not searchable (when found). What can I do to make it found in any app and searchable for the files?

NumberMe wrote: 27 Mar 2020, 15:44 I have an external USB mounted HD of 2 TB from Maxtor/Seagate.
On it I had one partition of ca 400 GB not encrypted, and one, of ca 1.4 TB encrypted with TrueCrypt since a few years.
I have runt it both from an old Windows 7 machine and a newer Windows 10 - has worked fine.
So the crash, the system hung and I had to force shutdown and remove the USB HD and restart.
After restart nothing was found when plugging in the HD. Tried Checkdisk, repair, after boot, etc.
After a few tries and reboots the 400 GB partition showed up in explorer and I was able to copy all of the data from it to another HD (phew!).
However, the 1.4 TB TrueCrypt partition (called F:) is not possible to mount in TrueCrypt anymore.
Sometimes TrueCrypt says there is nothing to mount and sometimes it says it has found a problem on it and suggests running repair. However, when running chkdsk on it (ca 12 hours) it comes up with lots of errors but cannot repair since it says it is RAW.

You cannot run chkdsk on an encrypted device.

In Disk Manager I can (sometimes) see the two partitions and the 1.4 TB is RAW.
When the 1.4 TB partition and/or the entire 2 TB disk shows up in TestDisk and I analyze it (for about 40 hours) it says it finds errors and no partitions and thus cannot do anything. Very frustrating.

Testdisk won't find any encrypted Truecrypt partition because there is nothing left to be identified in an encrypted state of a partition.

Sometimes they find only the 400 GB partition which is no help anymore, but it clearly has a hard time even reading that.

Duplicate the drive using ddrescue. Try to mount your partition as read only.

Also: Does it matter what USB port I plug the HD into? - it seems rather random if it can be found or not - I have tried on other systems as well and they do not find it.

No.

If I cannot get the partition or the data/files back, is there a way I can format the drive and still use it?

You can delete everything on the drive but your drive might be already broken.

Thanks for your replies.
I have run DDrescue on two different machines. It cannot find the drive/s to create the image file from.
Strange since the drive showed up in Windows Device Manager just before, so Windows can still detect it sometimes.
Any other options?
thanks

recuperation wrote: 30 Mar 2020, 17:46 I have run DDrescue on two different machines. It cannot find the drive/s to create the image file from.
Strange since the drive showed up in Windows Device Manager just before, so Windows can still detect it sometimes.
Any other options?
thanks

Use the lsblk command to find attached drives.
http://man7.org/linux/man-pages/man8/lsblk.8.html

Thanks recuperation,
I have been running DDrescue-GUI from hamishmb.com (on a Windows machine) and it did not work, it did not find the drives - might be good for others to know. Spent a lot of time trying to get it to work but to no avail.
So did a new install of Linux on another machine, got it running and using the lsblk command I find the drives - good.
TestDisk finds the drive now but not the two partitions, using DeepScan.
Using TestDisk only produces errors from start, so stopped it.
So, running DDrescue now (forwards) for about 20 hours on the 1.4 TB drive gives me 321 read errors and 0% rescued - not so good.
Will try some different commands (backwards) but my guess the drive is not rescueable.
Will it be worth it to send in to some rescue service that also picks it apart? Any recommendations?

NumberMe wrote: 03 Apr 2020, 09:15 Will it be worth it to send in to some rescue service that also picks it apart?

How should I know?
If you have hundreds of bitcoins in your Truecrypt partition or a formula for a Corona vaccine it's probably worth it.

Data loosers in this forum always underline how IMPORTANT their data is
but they rather fool around themselves instead of using a professional recovery service -

a total contradiction!

This is a just an impression I always wanted to tell sometimes that does not necessarily applies to you.

With the progress indicator showing 0% it might be interesting to see if ddrescue did rescue any data at all.
It could be that it already rescued stuff as could be seen on your terminal window.

If it ran 20 hours without rescuing anything stop ddrescue and disconnect the drive.
That would mean that it is beyond your (and my!) possibilities on a logical level.

Sorry I don't have the vaccine for corona on it nor bitcoin (would not be worth much now anyway).

Agree with you on the contradiction. If the data was that important to me I would have used professional help, I can re-create most of it from older backups, e-mails, web-pages, etc, but it will take months so worth to give it a good try.

Ran DDrescue for 24 hours and still 0% and no files at all rescued...

thanks a lot for your help, at least I learned some really useful things, but hopefully this will not happen again.

For your information and others reading about this topic:

ddrescue does not duplicate files!
It does duplicate on a lower level.
It duplicates sectors and the text gui shows you how much data, for instance in MByte have been rescued.