All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 7 posts ] 
Author Message
 Post subject: Encrypted volume disappeared (veracrypt)
PostPosted: January 6th, 2019, 14:45 
Offline

Joined: January 6th, 2019, 12:51
Posts: 2
Location: Egypt
Hello,

I have external WD passport HDD encrypted the whole disk with veracrypt, the HDD has only one partition and it worked well for more than 2 years.
Two days back when I tried to mount the HDD from veracrypt, as usual, I got an error that my volume header is damaged or something but I didn't have any backups so I tried my luck with the embedded backup in the volume itself and it worked well and again I didn't take a backup, now when I connect the HDD it doesn't show any volumes under it (screenshot below) and when I mount it shows unformatted partition (screenshot below).

is there any solution? should i try to decrypt it and try to recover the partition? and if so how I can do it?


Attachments:
hdd prob2.png
hdd prob2.png [ 470.81 KiB | Viewed 270 times ]
hdd prob.png
hdd prob.png [ 4.54 MiB | Viewed 270 times ]
Top
 Profile  
 
 Post subject: Re: Encrypted volume disappeared (veracrypt)
PostPosted: January 7th, 2019, 15:01 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 10341
Location: Portugal
I don't use veracrypt but i do use older TrueCrypt. On TrueCrypt (veracrypt is a TrueCrypt branch) when you do full drive encryption it forces you to create a CD/DVD that you can use to force decryption in case something goes wrong.... Do you have a recovery CD/DVD to force the decryption of your partiton ?

If not what you have done was not the best decision. Maybe the drive itself is failing like having bad sectors and/or other issues.

I would have attempted to clone the drive first of all to a new drive and only then i would attempt to mess with the encryption .... If something goes wrong is goodbye data for good.

If you replaced the "header" with the keys with non-valid keys that can't decrypt the data and if there are no other copy neither recovery CD it's ... game over...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Encrypted volume disappeared (veracrypt)
PostPosted: January 7th, 2019, 15:55 
Offline

Joined: November 29th, 2006, 10:08
Posts: 7278
Location: UK
I have to agree, at the very least make a clone before messing about with it anymore.

Also agree that it’s likely the drive is failing rapidly, and so if the data is at all important seek assistance from a proper DR company (NOT a PC store or “whiz kid” tech guy!) before it all goes horribly wrong and you lose your data FOR GOOD.

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!


Top
 Profile  
 
 Post subject: Re: Encrypted volume disappeared (veracrypt)
PostPosted: January 7th, 2019, 16:03 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 10341
Location: Portugal
For me it's quite simple ... The new "header" does have a new key and it can't decrypt the data so you see an empty partition. Even if you were to run logic data recovery software like R-Studio on that partition you would found nothing ... It's a little bit like a hidden volume inside the true volume for plausible deniability that TrueCrypt is so famous to have (and veracrypt uses the same code).

If you don't have a backup of the "header" and keys most likely data is gone for good.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Encrypted volume disappeared (veracrypt)
PostPosted: January 7th, 2019, 16:12 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 10341
Location: Portugal
I use TrueCrypt all the time as my password file to access all sites, etc is stored on a TrueCrypt colume and all my passwords are unique and random character/numbers, etc so i do have to open my TC volume to access ANY site including my site (log-in) here you have a screen capture :

Attachment:
Spildit.jpg
Spildit.jpg [ 55.9 KiB | Viewed 233 times ]


If it's a "container" you should try to restore volume header from EXTERNAL BACKUP. If volume header is replaced with invalid one say goodbye to encrypted data. If it's full drive encryption TrueCrypt FORCES YOU to do a backup CD/DVD when you install full drive encryption so you should have that cd as it's required for TrueCrypt to encrypt the volume to start with (TrueCrypt does verify that you did indeed create the recovery CD).

If no recovery CD is available and if no header backup is available and in new header now have keys that don't decrypt the data or you don't even have correct cypher order, etc .... data is gone for good ....

Again i'm talking about TrueCrypt that i use but VeraCrypt was compiled using the same TrueCrypt source code + some modifications to be "better" but i assume the same principals are still valid ...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Encrypted volume disappeared (veracrypt)
PostPosted: January 7th, 2019, 20:36 
Offline

Joined: January 6th, 2019, 12:51
Posts: 2
Location: Egypt
I would like to thank you for your help
Good news is that I found the recovery CD
The bad news is I did encrypt my old laptop system partition too and I don't remember if it forces you also to create recovery CD so maybe this belongs to my old laptop :roll:
so what is the best practice right now?


Top
 Profile  
 
 Post subject: Re: Encrypted volume disappeared (veracrypt)
PostPosted: January 7th, 2019, 21:58 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 10341
Location: Portugal
1 - Clone the drive. Get an identical HDD and clone it ... Clone the bad one to a known good one sector by sector with something like hddsuperclone.

2 - Make sure you have the correct CD to force decryption ! If you use wrong CD you will mess things up for good.

3 - With correct recovery CD and CLONE just force the decryption of the clone with the option to do so (decrypt the entire partition or drive) on the CD. You should force decryption of the entire partition and of course you need to use the correct CD.

4 - If necessary use logic data recovery software like R-Studio on the decrypted clone ...

If it fails re-clone and try again with another CD/method ...

Whatever you do don't even think to do anything more with the original drive without cloning first ...

Otherwise say goodbye to your porn collection inside the veracrypt volume ...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 7 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Exabot [Bot] and 43 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group