So, I have a hard drive. The entire volume was encrypted with TrueCrypt.

I then formatted over the volume with FAT, and wrote one file to it (a small image file I think).

So, is there any way to get the original TrueCrypt volume back, or is it just totally gone?

If it isn't possible, I also have a copy of the deleted files on another hard drive. But I wiped them using Eraser with at least 3 passes, possibly 35 (I don't remember). I take it that's totally gone, yes?

Thank you.

Hi, do you work for NASA or something? With that much security!
As far as I know it's not recoverable (truecrypt), and for Eraser it use multiply overwrite pattern..not recoverable either.

Regards Bosse

_________________
Rescue IT Datarecovery service Sweden
Rescue IT Dataräddning Göteborg AB
http://www.rescue-it.se

What kind of TrueCrypt volume was used ?
FYI: http://www.truecrypt.org - "Each TrueCrypt volume created by TrueCrypt 6.0 or later contains an embedded backup header, located at the end of the volume"

Erased files are gone

_________________
SAN, NAS, RAID, Server, and HDD Data Recovery.

@overlappingoddness:

That depends on what OS you used to format it with FAT, and if it was Win7 or Vista, it depends whether it was a full or quick format. If you're not sure, you can look at the disk with a hex editor, say sector 1000000 (i.e. a long way after the FAT), and check if you see lots of hex 00 bytes (bad news) or seemingly random bytes (that's encrypted data - good news).

If the format you did was not a full format with either Vista or Win 7, then that's good news... In that case, yes, you might have a chance to get something back (with some damage to the filesystem inside, of course, caused by the writing of the new FAT & that file). However it is a multiple-step process, and carries risks of human error at any stage, making the situation worse. Are you really sure you want to do this yourself, and accept the risks of DIY?

Assuming you still see the encrypted data on the disk and that you accept the risks of DIY, then I'm not going to go through the whole thing step-by-step, but I'd strongly suggest you start by making a full raw clone of that disk in its current state (and make sure that the clone is then readable, though of course it's still encrypted) so that you can get back to the current state, if things go wrong. Then go and research the TrueCrypt Rescue Disk and don't forget your password! Without your password, you really are stuck.


If Eraser was successful, then yes, totally gone. Again, you can use a hex editor to view that disk and check.

OK. Thank you Vulcan. A very informative post.

Now, I wrote my original post off the top of my head.

I just went and looked at the drive, and it turns out I've overwritten it completely with a NEW TrueCrypt volume. So, in this case, surely I'm totally out of luck, right?

Still, in the future, if I ever do this again, I will look into hex editors and the TrueCrypt recovery disk. Thank you.

Yep out of luck. All data has now been overwritten.

Please, out of curiosity, can you explain how you determined that you "have overwritten it completely with a NEW TrueCrypt volume"?

I am confused because if you overwrote the drive with new data, then you should have known this, so "looking at the drive" was not necessary.

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts