Accidentally Formatted over TrueCrypt Volume

[overlappingoddness]

So, I have a hard drive. The entire volume was encrypted with TrueCrypt.

I then formatted over the volume with FAT, and wrote one file to it (a small image file I think).

So, is there any way to get the original TrueCrypt volume back, or is it just totally gone?

If it isn't possible, I also have a copy of the deleted files on another hard drive. But I wiped them using Eraser with at least 3 passes, possibly 35 (I don't remember). I take it that's totally gone, yes?

Thank you.

[mr_spokk]

Hi, do you work for NASA or something? With that much security!
As far as I know it's not recoverable (truecrypt), and for Eraser it use multiply overwrite pattern..not recoverable either.

Regards Bosse

[Doomer]

What kind of TrueCrypt volume was used ?
FYI: http://www.truecrypt.org - "Each TrueCrypt volume created by TrueCrypt 6.0 or later contains an embedded backup header, located at the end of the volume"

Erased files are gone

Last edited by Doomer on August 23rd, 2011, 17:02, edited 2 times in total.

[Vulcan]

@overlappingoddness:

I then formatted over the volume with FAT, and wrote one file to it (a small image file I think).

So, is there any way to get the original TrueCrypt volume back, or is it just totally gone?

That depends on what OS you used to format it with FAT, and if it was Win7 or Vista, it depends whether it was a full or quick format. If you're not sure, you can look at the disk with a hex editor, say sector 1000000 (i.e. a long way after the FAT), and check if you see lots of hex 00 bytes (bad news) or seemingly random bytes (that's encrypted data - good news).

If the format you did was not a full format with either Vista or Win 7, then that's good news... In that case, yes, you might have a chance to get something back (with some damage to the filesystem inside, of course, caused by the writing of the new FAT & that file). However it is a multiple-step process, and carries risks of human error at any stage, making the situation worse. Are you really sure you want to do this yourself, and accept the risks of DIY?

Assuming you still see the encrypted data on the disk and that you accept the risks of DIY, then I'm not going to go through the whole thing step-by-step, but I'd strongly suggest you start by making a full raw clone of that disk in its current state (and make sure that the clone is then readable, though of course it's still encrypted) so that you can get back to the current state, if things go wrong. Then go and research the TrueCrypt Rescue Disk and don't forget your password! Without your password, you really are stuck.

I also have a copy of the deleted files on another hard drive. But I wiped them using Eraser with at least 3 passes, possibly 35 (I don't remember). I take it that's totally gone, yes?

If Eraser was successful, then yes, totally gone. Again, you can use a hex editor to view that disk and check.

[overlappingoddness]

OK. Thank you Vulcan. A very informative post.

Now, I wrote my original post off the top of my head.

I just went and looked at the drive, and it turns out I've overwritten it completely with a NEW TrueCrypt volume. So, in this case, surely I'm totally out of luck, right?

Still, in the future, if I ever do this again, I will look into hex editors and the TrueCrypt recovery disk. Thank you.

[dick]

I just went and looked at the drive, and it turns out I've overwritten it completely with a NEW TrueCrypt volume. So, in this case, surely I'm totally out of luck, right?

Yep out of luck. All data has now been overwritten.

[labtech]

I just went and looked at the drive, and it turns out I've overwritten it completely with a NEW TrueCrypt volume.

Please, out of curiosity, can you explain how you determined that you "have overwritten it completely with a NEW TrueCrypt volume"?

I am confused because if you overwrote the drive with new data, then you should have known this, so "looking at the drive" was not necessary.