Is disabling indexing on a secondary drive required?

If I've understood correctly, you are trying to recover data from a deleted TrueCrypt container and you know the password.

If so this may help you https://github.com/4144414D/pytruecrypt

The examples should give you an idea on how to go about it hunt.py, in particular, may help.

Hey thanks for your suggestion mate. Is there any python in there or elsewhere that can copy a block found in winhex or in some other hexeditor into a file, and try to open that with the known password? Winhex evaluation copy won't allow me to copy into a new file anything over 200kb or 200mb not sure what exactly. I tried HxD and it doesn't seem to have such an option.

Also, I'm so incompetent I may have managed to forget the filename but probably not the password. Do you think hunt.py or something else can hunt for the file without the filename, and just the password? But anyways, Pytruecrypt says it's slow at what it does, and I feel I could have the entire sequence of blocks in front of me in winhex, don't get me wrong I'm probably wrong about that too. It's a 75gb or so file in a 2tb drive.

The dump.py example will do that for you, if you comment out the last two lines (about dumping the first sector) then you only need the 512 bytes that makes up the truecrypt header. (It assumes it's the default options were picked in truecrypt, so if you changed the encryption algorithm you'll need to modify it a bit)

You have to be spot on with it though, if you're one byte off with the header it won't decrypt (or use the wrong password)

Test it on a brand new container just to make sure you know how it's working.