Hello everyone

i have half encrypted system drive using Truecrypt, the system crashed and unable to boot anymore.

i know the password but i lost the recovery CD.

i've cloned all of the data to external HDD, so i can use the laptop.

i tried to get the PasswareKit Forensic Demo , i've cloned the drive to file using"Free EASIS Cloning" saved as file (hdd.img)

on the PasswareKit Forensic Demo, when tried "Decrypt a TrueCrypt Volume " i got Unknown Format



i tried to open the Partition using DiskGenius program ... i was able to see some of the files, but a lot of files are missing ! ...



I tried to save some files ... in most times it did not success.



could you help me ?

is there a way to decrypt the data and restore them ?.. i can pay to restore the data

in the attachments you can find some more screen shots

Thanks a lot

Was it half encrypted or half decrypted volume?
If it was half decrypted volume then you probably need to use backup copy of TrueCrypt header to unlock your volume because the first copy would have been decrypted
Please see this document for technical details - http://www.truecrypt.org/docs/?s=volume ... cification

About backup header (search for "Use backup header embedded in volume if available") - http://www.truecrypt.org/docs/?s=mounti ... pt-volumes

Always have original copy of the volume before applying any changes (i.e. make copy of a copy before trying anything)

If you able to mount your volume with TrueCrypt using back up header/restoring original header you would also need to deal with another complication
Because you have half way decrypted or encrypted volume you would need to know exact point where your decrypted data ends and encrypted starts. You would need to make decrypted copy of encrypted part of your volume using TrueCryt and after that concatenate that decrypted part with already decrypted data that you have now and after that you would get fully decrypted volume

If both TrueCrypt headers are gone - your data is virtually unrecoverable. If you are not sure about where to find those headers and how to mount the volume - look for professional DR help

_________________
SAN, NAS, RAID, Server, and HDD Data Recovery.

It was fully encrypted, i tried to decrypt it using the Rescue CD,when i tried to decrypt, only about 6 GB got decrypted ... but the CD reader damaged the CD.

actually i did not understand what is required, can you direct me to a someone who can do this remotely and i will pay to him.

thanks

Bahr

I don't know anybody who can do it remotely
Usually people send drives to DR companies

_________________
SAN, NAS, RAID, Server, and HDD Data Recovery.

thanks a lot for the kind and fast replay ....

the HDD contain a lot of sensitive data on it, we don't want anyone to see them.

can you recommend a company in Turkey ?

PM Sent

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein

I don't know anyone in Turkey, but most known members here have their own NDA's on their companies, so I don't think your data will be seen by anyone.

Anyway, to be honest, in my case I have so much things to do, that checking clients data would be the last thing on my mind, and I think in fact with most of the pro's here will be the same.
But if you take your drive to a local shop and tell them your data is super secret, I'm sure they will want to see just a small bit of it

thanks a lot

exactly