Recovering data from possibly corrupted Truecrypt volume

[z3255859]

I have an external hard drive (no system files on it) which has been encrypted using truecrypt. Suddenly today when i tried to mount the hard drive, I got the following error:

Code:

Incorrect password or not a truecrypt volume

So I tried to mount it using mount options and choosing use backup embedded headers embedded in volume if available option. When I do that the hard drive mounts but I am not able to access any files in the drive.

I get the following error when I click on the drive to open it:

Code:

You need to format the disk drive in J: before using it

How do I recover my files? This is very important and urgent. Your help will be greatly appreciated

PS: I am using windows 7 64bit

[Alt(R-TT)]

This article Data Recovery from Various File Container Formats and Encrypted Disks may help.

[dick]

Do you have a copy of the Truecrypt rescue disk or the iso you created?

[z3255859]

Unfortunately I have misplaced my rescue disk

[loki]

Was it a single partition?
NTFS?

Have you cloned/imaged the drive?

Here are my steps I wrote down when I had a look at recovering a deleted partition with Truecrypt I know its not the exact same issue your describing but it might be helpful if sector0 has got corrupted.

I was using Winhex to do this.

Deleted Truecrypt Partition Repair.docx

(30.05 KiB) Downloaded 542 times

Loki

Last edited by loki on July 4th, 2014, 6:15, edited 1 time in total.

[dick]

When the drive mounts as drive "j" you could copy the partition to another drive as an image file. Then run recovery software on the image. Dmde would be a good start to make the 'j_partition.img' file. Then you could open it with the Dmde software and see what might be available. How big is the drive/partition?

[z3255859]

@Loki

Its a single partition
It is NTFS
No, Hvaen't cloned or imaged the partition

Also looking at your instruction sheet :
[*]How do i action step 3 ? Actually can you help me out with points 3-11 on that list. I haven't used winHex before.

Here is the screen shot when i load the drive in winHex :

@dick

I will try abd do that if recovery method suggested by @loki doesn't work. Also its 1.8TB (massive)

[dick]

You could just run Dmde and point it towards the external drive and "j" partition to see what partition info is available. I would certainly do that! If you see your partition you can open the volume and then recover a couple of files to a second drive and check them.

Also as you are considering making changes to the partition you MUST backup the partition info!

[z3255859]

@dick How do i do that. here is what i see when I open j drive in dmde:

[loki]

"How do I recover my files? This is very important and urgent"

Firstly you should always clone or image the device if possible as if you make a mistake you ruin your chances of recovery or make it more expensive to get a recovery from a pro.
DIY comes with risks & not knowing your limits also puts your data at risk.

If your not sure about something, try & practice & research it using another device

If the data is very important as you say then if I were you I wouldn't risk DIY without an Image backup.



Loki