Corrupted TrueCrypt Partition (header)

[Tobiasz22]

I have the same problem like OP from this thread: http://www.wilderssecurity.com/threads/ ... on.327959/
I couldn't reply in the old thread, so I have to create a new one..

I recently allowed Windows to initialize the drive and that destroyed the header.

1) This is what I had at the beginning. I was able to mount my drive in TC:


but unfortunately I was not able to see any data, there was no partition:

2) Then I created in WinHex partition's starting offset file: Test Outer.tc
I used starting block 1048576 and ending block 5048575
I was able to mount this file in TC, so everything went well

3) I have created partition in DISKPART
(Create partition primary offset=1024)

4)now I see partition in TC, but I can not mount it because I get error message
"incorrect password or not a TrueCrypt volume":


5) now I have header's copy in file Test Outer.tc , partition on my encrypted hard drive (but I can not mount the drive anymore longer because of "incorrect password")

now in WinHex i probably need to restore Test Outer.tc to the disk
post number 19 in this thread described this:
http://www.wilderssecurity.com/threads/ ... st-2089995
but I dont know how to do that and I dont want to experiment


Could someone help me? I think I am pretty close to succeed

[Tobiasz22]

bump, can anyone help?

[dick]

I have seen this situation a couple of times when in my cases Windows appeared to 'repair' the partions and so damaged the Truecrypt header in the process. So do you have a rescue disk?

Have you previously made a full image of the drive? If the answer is no then I suggest you do that right now!

Normally I would boot from the rescue disk and either repair the header or run a full drive decrypt. Have you tried booting from a cd or usb and decrypting with your known password? You would then run software recovery tools to scan for the partition and files if required.

I know my suggested procedure is the easy method. Maybe you have already exhausted these options?

[Spildit]

(...)Normally I would boot from the rescue disk and either repair the header or run a full drive decrypt. (...)

+1

TrueCrypt full drive encryption forces you to create the rescue disk. Use it.

[Tobiasz22]

Unfortunately I dont have Rescue Disk

i belioeve that the answer for my problem is in this and next post:
http://www.wilderssecurity.com/threads/ ... st-2089995