[Warning completely unrelated to topic in OP. Or anything to do with forensics or ediscovery for that matter]
Why do more and more forum posts start 'So'? This is not a dig at zw1404 at all because many do it, but why? Beginning a sentence with it doesn't add anything, and removing it doesn't detract anything.
I work with an entire department of people, 90% of which start their responses with 'so'. Drives me nuts. That and the overuse of the word pivot.
Per your $MFT record - the logical size of the record is 336 bytes and ends with FF FF FF FF 82 79 47 11. The allocation flag shows it to be a deleted file. The flag for where the data is stored shows 01 for non-resident. You have a data attribute which shows this and correctly shows the data run should be in the latter part of the data attribute at a specific point. But, when I jump out to that area it only shows only 00 00 01 00 00 00 00 00. So, something happened to the data run.
I created a Truecrypt container on my machine and made sure it would be unable to be stored as resident. I parsed out that $MFT record for it and the data attribute showed an accurate data run. So, it is not something that Truecrypt does. I believe something happened to your $MFT record after the file was deleted since it is marked as such.
Thanks for the help cybr4n6, I figured the MFT was damaged. Must have been cleared in the 2/3mins before the power was pulled, really bad luck I guess.
I recall carving out deleted container (approx 20GB) couple of years back using winhex with the help of header information. This wasn't for truecrypt but was another encryption tool.
If you have tried everything give WinHex a chance too, She has been my lady luck till date D