Recover lost encrypted data from external HDD
November 24th, 2011, 8:48
Dear all:
I had the following problem regarding an external 500GB hard drive where I store my backups encrypted with Truecrypt.
As the disk’s size is 500GB, I created a 450GB encrypted file/volume with Truecrypt, so that when you opened it, you only see 1 giant file without extension or associated application, and the file within it were to be accessed just after you mount the volume with Truecrypt entering the correct password. So far, everything worked just fine, but yesterday I tried to mount the encrypted volume and stated that it was not possible to read the file and Windows 7 suggested me to run chkdsk in repair mode. Not very confident with this suggestion (I’m aware that these actions may end deleting everything), I launched chkdsk /R anyway. It took 2 hours, now Windows 7 doesn’t ask me to run chkdsk every time I plug the disk, but my giant encrypted file IS GONE!!
I tried so far with Eaesus, iCare, but they just find me after almost 5 hours files I’ve deleted myself a time ago. They also recover some files that don’t make any sense since they are 2-3GB .SWF files (I didn’t have these files). These utility seen to work ok and find things, but they aren’t finding my giant 450GB Truecrypt encrypted file. I just can’t lose that information, so I want to exhaust all the possibilities.
Is there any other utility that can help me in this case?
I know that this is not a “normal” recovery attempt with the Truecrypt’s encryption in the middle, but still, I need to try!
Thanks so much!
I had the following problem regarding an external 500GB hard drive where I store my backups encrypted with Truecrypt.
As the disk’s size is 500GB, I created a 450GB encrypted file/volume with Truecrypt, so that when you opened it, you only see 1 giant file without extension or associated application, and the file within it were to be accessed just after you mount the volume with Truecrypt entering the correct password. So far, everything worked just fine, but yesterday I tried to mount the encrypted volume and stated that it was not possible to read the file and Windows 7 suggested me to run chkdsk in repair mode. Not very confident with this suggestion (I’m aware that these actions may end deleting everything), I launched chkdsk /R anyway. It took 2 hours, now Windows 7 doesn’t ask me to run chkdsk every time I plug the disk, but my giant encrypted file IS GONE!!
I tried so far with Eaesus, iCare, but they just find me after almost 5 hours files I’ve deleted myself a time ago. They also recover some files that don’t make any sense since they are 2-3GB .SWF files (I didn’t have these files). These utility seen to work ok and find things, but they aren’t finding my giant 450GB Truecrypt encrypted file. I just can’t lose that information, so I want to exhaust all the possibilities.
Is there any other utility that can help me in this case?
I know that this is not a “normal” recovery attempt with the Truecrypt’s encryption in the middle, but still, I need to try!
Thanks so much!
Re: Recover lost encrypted data from external HDD
November 24th, 2011, 18:09
Unfortunately your use of chkdsk /R has probably caused irreversible damage to the filesystem's knowledge of which blocks, in which order, used to be in that TrueCrypt container file. 
Such a file (deliberately) looks like random data, and it is huge, so normal "carving" (i.e. signature based) recovery techniques are usually unsuccessful - that's why those recovery programs aren't finding your container file.
Before doing anything which could change the disk (like running chkdsk /R) you should at a minimum have cloned the disk and worked with that clone.
You could try using the services of a good DR company, but I doubt you will be successful. This is the risk you take by not having a backup, I'm sorry to say
Such a file (deliberately) looks like random data, and it is huge, so normal "carving" (i.e. signature based) recovery techniques are usually unsuccessful - that's why those recovery programs aren't finding your container file.
Before doing anything which could change the disk (like running chkdsk /R) you should at a minimum have cloned the disk and worked with that clone.
You could try using the services of a good DR company, but I doubt you will be successful. This is the risk you take by not having a backup, I'm sorry to say
Powered by phpBB © phpBB Group.