Decrypted harddrive, now shows as unallocated? [truecrypt]

[kalender]

Hi,

I have a 1tb harddrive which was divided into 2 partitions, 50/50. One for movies and stuff and one with the system itself.

Decided to decrypt the harddrive - which was encrypted with truecrypt - via a rescue disk created afterwards (done this before, no probs). Took a day+ but completed with success "The disk have now been fully decrypted." or so. So I pressed ESC to go back and then finally shut it down.

I had another computer running at the same time so I decided to connect the now decrypted harddrive while the computer was on (done that before.. if i remember it correctly. not sure if I had a sata hot swap driver/program installed tho).

The harddrive didn't pop up, not even that the "device has been found".

Restarted the computer and now drivers for the device was automatically detected as it should. But it wouldn't show as partitions under "My Computer". Went to the disc management and there it is.. Showing all gb's as "unallocated"??

Now: What should I do from here?

I tried TestDisk to do a deep search for partitions tables but it didn't find anything.

If I right click on the disc under management there is no option available, everything is greyed out.

When I start with rescue disk again it will show "Incorrect password" which of course is not true. But I guess this shows up cause it really is 100% decrypted.


Thinking of buying 2 x 1TBs disc in order to do a full clone etc. But that isn't free :p.


Thanks in advance!!
kalender

[kalender]

I would try to scan the drive with R-STUDIO and do file carving if needed.
If you don't clone the drive make sure that you DON'T WRITE anything to the damaged drive. Don't recover files to that drive either.
At any rate if my guess is correct and the decryption proccess was wrongly done because of the change/hot swap of the drive, at this point i would say that you would have a drive with random patterns like "noise" that is not a "correct encryption" neither your original data. If you have a blob of gibberish that can't be decripted it would be like having an encrypted volume without knowning the key ..... pray that it's not the case.
Best regards and good luck.

Thanks a lot for your reply, appreciate it.

Okok. Tho, I really think the decryption process was completed with 100% success. Because the decryption process was done on another computer, which was powered off safely after completed ("Decryption has now been completed"-ish). And then connected to a running computer afterwards.

One question about cloning tho:
So if I have 2 extra drives one keeping the clone and one with the installed clone. Would the result/output be the exact same as it would be the real harddrive I played with? Almost sounds 2good2be true :p

[kalender]

Alrighty. So from that clone, I can do exactly the same as with the real harddrive. I.e recover files from it aswell? Thinking of doing it then.. But, free is always the best .
Yes, the harddrive is only a couple of months old. No problems with it really.

Had a scan going already with R-Studio. See attached file for the poor results it gave me.

Gahh so annoying.

Attachments

[labtech]

Based on the R-Studio snapshot, it looks like encrypted data.

[kalender]

Oh my god... So "If you have a blob of gibberish that can't be decrypted it would be like having an encrypted volume without knowning the key" = the case for me now?

Will it be impossible to rescue the content? :'( can't believe this is happening....

The files r studio finds is big chunks of swf files etc. I.e probably encrypted shit.

How can it be wrongly decrypted/how did this happen?

Will check on the sectors in a couple of hours

[kalender]

I might give http://forums.truecrypt.org/viewtopic.p ... torder=asc try even tho im sure I used the same TC version..

[kalender]

Downloaded WinHex and as you said it would be, just gibbberish @ the faulty disc. Even tho the other harddrives I opened with WinHex had some wierd characters/text aswell, there is still some "real letters"/readable text somewhere in there at the beginning. Some standard Windows error messsage etc, which the faulty don't have - all I could see was "gibberish". So, I guess it's badly decrypted then. Don't know how that happened.. Hmmmmm...

Soooooooooooooooooooo annoying.

[fzabkar]

Could we actually see the hexadecimal contents of sectors 0, 1, 2?

[kalender]

I would say still encrypted or badly decrypted then.
At this point i don't know how to solve it.
Maybe someone with more experience with truecrypt can help you better.
Posting on truecrypt forums might be a good idea.

I would say that either the procedure was badly done and the drive was forced to decrypt with a wrong key ending up with re-encypted data under another key or the process wasn't done at all ...

Best regards and wishing you luck.

Yep, thread here:
forums.truecrypt.org/viewtopic.php?t=29045

Strange, I am almost 100% sure that I used a rescue disk created with the same TC version. I mean, the latest TC release was released quite some time ago (long before I installed it on my OS) - so the rescue disk should be from the correct version.. If that matters.

Could we actually see the hexadecimal contents of sectors 0, 1, 2?

Hmm sorry. New to this. Should I printscreen the very beginning or how can I do this ^ ?


Thanks a LOT for wanting to help guys. Finally got hold of an 2TB harddrive. Going to make a sector by sector clone now.
Btw I am also getting "Do you want to initialize the harddrive?" and gives me 2 options, 1) MBR 2) GPT

But I guess i should cancel as always if asked.

[fzabkar]

I don't use WinHex, but I would be surprised if there were no way to save sector 0 to a BIN file.

[kalender]

Sry for late update. Hmm.. The software that I use, that should be able to do a sector by sector clone, won't even find the harddrive?... Any program that u recommend?
Tried Norton Ghost and EaseUS Todo without success. Any recommendation of software?


As I said earlier: I am also getting "Do you want to initialize the harddrive?" and gives me 2 options, 1) MBR 2) GPT
Does this have something to do with it?

[labtech]

Use search function for "imaging" or "cloning". Plenty of info. The software to use really depends on your level of comfort and experience and resources without screwing up.