HDD Decrypting ( TrueCrypt )

[undying]

Hello everyone

i have half encrypted system drive using Truecrypt, the system crashed and unable to boot anymore.

i know the password but i lost the recovery CD.

i've cloned all of the data to external HDD, so i can use the laptop.

i tried to get the PasswareKit Forensic Demo , i've cloned the drive to file using"Free EASIS Cloning" saved as file (hdd.img)

on the PasswareKit Forensic Demo, when tried "Decrypt a TrueCrypt Volume " i got Unknown Format

i tried to open the Partition using DiskGenius program ... i was able to see some of the files, but a lot of files are missing ! ...

I tried to save some files ... in most times it did not success.

Error Copy.jpg (40.85 KiB) Viewed 6400 times

could you help me ?

is there a way to decrypt the data and restore them ?.. i can pay to restore the data

in the attachments you can find some more screen shots

Thanks a lot

Attachments

[Doomer]

Was it half encrypted or half decrypted volume?
If it was half decrypted volume then you probably need to use backup copy of TrueCrypt header to unlock your volume because the first copy would have been decrypted
Please see this document for technical details - http://www.truecrypt.org/docs/?s=volume ... cification

About backup header (search for "Use backup header embedded in volume if available") - http://www.truecrypt.org/docs/?s=mounti ... pt-volumes

Always have original copy of the volume before applying any changes (i.e. make copy of a copy before trying anything)

If you able to mount your volume with TrueCrypt using back up header/restoring original header you would also need to deal with another complication
Because you have half way decrypted or encrypted volume you would need to know exact point where your decrypted data ends and encrypted starts. You would need to make decrypted copy of encrypted part of your volume using TrueCryt and after that concatenate that decrypted part with already decrypted data that you have now and after that you would get fully decrypted volume

If both TrueCrypt headers are gone - your data is virtually unrecoverable. If you are not sure about where to find those headers and how to mount the volume - look for professional DR help

[undying]

It was fully encrypted, i tried to decrypt it using the Rescue CD,when i tried to decrypt, only about 6 GB got decrypted ... but the CD reader damaged the CD.

actually i did not understand what is required, can you direct me to a someone who can do this remotely and i will pay to him.

thanks

Bahr

[Doomer]

actually i did not understand what is required, can you direct me to a someone who can do this remotely and i will pay to him.

I don't know anybody who can do it remotely
Usually people send drives to DR companies

[undying]

thanks a lot for the kind and fast replay ....

the HDD contain a lot of sensitive data on it, we don't want anyone to see them.

can you recommend a company in Turkey ?

[einstein9]

thanks a lot for the kind and fast replay ....

the HDD contain a lot of sensitive data on it, we don't want anyone to see them.

can you recommend a company in Turkey ?

PM Sent

[dmarques]

I don't know anyone in Turkey, but most known members here have their own NDA's on their companies, so I don't think your data will be seen by anyone.

Anyway, to be honest, in my case I have so much things to do, that checking clients data would be the last thing on my mind, and I think in fact with most of the pro's here will be the same.
But if you take your drive to a local shop and tell them your data is super secret, I'm sure they will want to see just a small bit of it

[undying]

thanks a lot for the kind and fast replay ....

the HDD contain a lot of sensitive data on it, we don't want anyone to see them.

can you recommend a company in Turkey ?

PM Sent

thanks a lot

Last edited by undying on November 27th, 2012, 13:06, edited 1 time in total.

[undying]

But if you take your drive to a local shop and tell them your data is super secret, I'm sure they will want to see just a small bit of it

exactly