MultiDrive – free backup, clone & wipe disk utility from Atola Technology

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 12 posts ] 
Author Message
 Post subject: Decrypted harddrive, now shows as unallocated? [truecrypt]
PostPosted: October 29th, 2013, 9:50 
Offline

Joined: October 29th, 2013, 9:42
Posts: 8
Location: sweden
Hi,

I have a 1tb harddrive which was divided into 2 partitions, 50/50. One for movies and stuff and one with the system itself.

Decided to decrypt the harddrive - which was encrypted with truecrypt - via a rescue disk created afterwards (done this before, no probs). Took a day+ but completed with success "The disk have now been fully decrypted." or so. So I pressed ESC to go back and then finally shut it down.

I had another computer running at the same time so I decided to connect the now decrypted harddrive while the computer was on (done that before.. if i remember it correctly. not sure if I had a sata hot swap driver/program installed tho).

The harddrive didn't pop up, not even that the "device has been found".

Restarted the computer and now drivers for the device was automatically detected as it should. But it wouldn't show as partitions under "My Computer". Went to the disc management and there it is.. Showing all gb's as "unallocated"??

Now: What should I do from here?

I tried TestDisk to do a deep search for partitions tables but it didn't find anything.

If I right click on the disc under management there is no option available, everything is greyed out.

When I start with rescue disk again it will show "Incorrect password" which of course is not true. But I guess this shows up cause it really is 100% decrypted.


Thinking of buying 2 x 1TBs disc in order to do a full clone etc. But that isn't free :p.


Thanks in advance!!
kalender


Top
 Profile  
 
 Post subject: Re: Decrypted harddrive, now shows as unallocated? [truecryp
PostPosted: October 29th, 2013, 18:10 
Offline

Joined: October 29th, 2013, 9:42
Posts: 8
Location: sweden
Spildit wrote:
I would try to scan the drive with R-STUDIO and do file carving if needed.
If you don't clone the drive make sure that you DON'T WRITE anything to the damaged drive. Don't recover files to that drive either.
At any rate if my guess is correct and the decryption proccess was wrongly done because of the change/hot swap of the drive, at this point i would say that you would have a drive with random patterns like "noise" that is not a "correct encryption" neither your original data. If you have a blob of gibberish that can't be decripted it would be like having an encrypted volume without knowning the key ..... pray that it's not the case.
Best regards and good luck.


Thanks a lot for your reply, appreciate it.

Okok. Tho, I really think the decryption process was completed with 100% success. Because the decryption process was done on another computer, which was powered off safely after completed ("Decryption has now been completed"-ish). And then connected to a running computer afterwards.

One question about cloning tho:
So if I have 2 extra drives one keeping the clone and one with the installed clone. Would the result/output be the exact same as it would be the real harddrive I played with? Almost sounds 2good2be true :p


Top
 Profile  
 
 Post subject: Re: Decrypted harddrive, now shows as unallocated? [truecryp
PostPosted: October 29th, 2013, 19:14 
Offline

Joined: October 29th, 2013, 9:42
Posts: 8
Location: sweden
Alrighty. So from that clone, I can do exactly the same as with the real harddrive. I.e recover files from it aswell? Thinking of doing it then.. But, free is always the best ;-).
Yes, the harddrive is only a couple of months old. No problems with it really.

Had a scan going already with R-Studio. See attached file for the poor results it gave me.

Gahh so annoying.


Attachments:
result.jpg
result.jpg [ 300.17 KiB | Viewed 11728 times ]
Top
 Profile  
 
 Post subject: Re: Decrypted harddrive, now shows as unallocated? [truecryp
PostPosted: October 29th, 2013, 19:34 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3669
Location: Massachusetts, USA
Based on the R-Studio snapshot, it looks like encrypted data.

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: Decrypted harddrive, now shows as unallocated? [truecryp
PostPosted: October 30th, 2013, 1:42 
Offline

Joined: October 29th, 2013, 9:42
Posts: 8
Location: sweden
Oh my god... So "If you have a blob of gibberish that can't be decrypted it would be like having an encrypted volume without knowning the key" = the case for me now?

Will it be impossible to rescue the content? :'( can't believe this is happening.... :(

The files r studio finds is big chunks of swf files etc. I.e probably encrypted shit.

How can it be wrongly decrypted/how did this happen?

Will check on the sectors in a couple of hours


Top
 Profile  
 
 Post subject: Re: Decrypted harddrive, now shows as unallocated? [truecryp
PostPosted: October 30th, 2013, 4:36 
Offline

Joined: October 29th, 2013, 9:42
Posts: 8
Location: sweden
I might give http://forums.truecrypt.org/viewtopic.p ... torder=asc try even tho im sure I used the same TC version..


Top
 Profile  
 
 Post subject: Re: Decrypted harddrive, now shows as unallocated? [truecryp
PostPosted: October 30th, 2013, 16:59 
Offline

Joined: October 29th, 2013, 9:42
Posts: 8
Location: sweden
Downloaded WinHex and as you said it would be, just gibbberish @ the faulty disc. Even tho the other harddrives I opened with WinHex had some wierd characters/text aswell, there is still some "real letters"/readable text somewhere in there at the beginning. Some standard Windows error messsage etc, which the faulty don't have - all I could see was "gibberish". So, I guess it's badly decrypted then. Don't know how that happened.. Hmmmmm...

Soooooooooooooooooooo annoying.


Top
 Profile  
 
 Post subject: Re: Decrypted harddrive, now shows as unallocated? [truecryp
PostPosted: November 4th, 2013, 4:34 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16960
Location: Australia
Could we actually see the hexadecimal contents of sectors 0, 1, 2?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Decrypted harddrive, now shows as unallocated? [truecryp
PostPosted: November 11th, 2013, 18:23 
Offline

Joined: October 29th, 2013, 9:42
Posts: 8
Location: sweden
Spildit wrote:
I would say still encrypted or badly decrypted then.
At this point i don't know how to solve it.
Maybe someone with more experience with truecrypt can help you better.
Posting on truecrypt forums might be a good idea.

I would say that either the procedure was badly done and the drive was forced to decrypt with a wrong key ending up with re-encypted data under another key or the process wasn't done at all ...

Best regards and wishing you luck.


Yep, thread here:
forums.truecrypt.org/viewtopic.php?t=29045

Strange, I am almost 100% sure that I used a rescue disk created with the same TC version. I mean, the latest TC release was released quite some time ago (long before I installed it on my OS) - so the rescue disk should be from the correct version.. If that matters.

fzabkar wrote:
Could we actually see the hexadecimal contents of sectors 0, 1, 2?

Hmm sorry. New to this. Should I printscreen the very beginning or how can I do this ^ ?


Thanks a LOT for wanting to help guys. Finally got hold of an 2TB harddrive. Going to make a sector by sector clone now.
Btw I am also getting "Do you want to initialize the harddrive?" and gives me 2 options, 1) MBR 2) GPT

But I guess i should cancel as always if asked.


Top
 Profile  
 
 Post subject: Re: Decrypted harddrive, now shows as unallocated? [truecryp
PostPosted: November 12th, 2013, 3:15 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16960
Location: Australia
I don't use WinHex, but I would be surprised if there were no way to save sector 0 to a BIN file.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Decrypted harddrive, now shows as unallocated? [truecryp
PostPosted: November 25th, 2013, 6:09 
Offline

Joined: October 29th, 2013, 9:42
Posts: 8
Location: sweden
Sry for late update. Hmm.. The software that I use, that should be able to do a sector by sector clone, won't even find the harddrive?... Any program that u recommend?
Tried Norton Ghost and EaseUS Todo without success. Any recommendation of software?


As I said earlier: I am also getting "Do you want to initialize the harddrive?" and gives me 2 options, 1) MBR 2) GPT
Does this have something to do with it?


Top
 Profile  
 
 Post subject: Re: Decrypted harddrive, now shows as unallocated? [truecryp
PostPosted: November 25th, 2013, 10:11 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3669
Location: Massachusetts, USA
Use search function for "imaging" or "cloning". Plenty of info. The software to use really depends on your level of comfort and experience and resources without screwing up.

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 12 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 149 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group