truecrypt formatted...
 
Notifications
Clear all

truecrypt formatted volume

3 Posts
2 Users
0 Reactions
392 Views
(@bombone)
Trusted Member
Joined: 13 years ago
Posts: 62
Topic starter  

terrible. I formatted on a wrong disk. It's a truecrypt hard disk. I stopped the process after two/three seconds. Now the system doesn't recognize it as formatted volume!
How I Can recover it?


   
Quote
joakims
(@joakims)
Estimable Member
Joined: 15 years ago
Posts: 224
 

terrible. I formatted on a wrong disk. It's a truecrypt hard disk. I stopped the process after two/three seconds. Now the system doesn't recognize it as formatted volume!
How I Can recover it?

There might be a backup header at eof (last 131072 bytes), but since you most likely overwrote parts of the encrypted data you're out of luck. If you, on the other hand did not overwrite anything beyond 131072 from start of volume during those seconds, then chances of luck might be better.

(actually I've studied the format quite well lately as part of a patch I've working on..)

I know "tateu" made a patch back in 2006 for this kind of situations. However I also tried recompiling it to work with latest version. Not yet working.. (and tateu seems to have abandonded the support in the meantime).

What you could try, is image the volume from offset 131072, then make a second backup file from offset eof-131072 and use that to recover the header using the truecrypt program itself..

Guess that's all.


   
ReplyQuote
(@bombone)
Trusted Member
Joined: 13 years ago
Posts: 62
Topic starter  

terrible. I formatted on a wrong disk. It's a truecrypt hard disk. I stopped the process after two/three seconds. Now the system doesn't recognize it as formatted volume!
How I Can recover it?

There might be a backup header at eof (last 131072 bytes), but since you most likely overwrote parts of the encrypted data you're out of luck. If you, on the other hand did not overwrite anything beyond 131072 from start of volume during those seconds, then chances of luck might be better.

(actually I've studied the format quite well lately as part of a patch I've working on..)

I know "tateu" made a patch back in 2006 for this kind of situations. However I also tried recompiling it to work with latest version. Not yet working.. (and tateu seems to have abandonded the support in the meantime).

What you could try, is image the volume from offset 131072, then make a second backup file from offset eof-131072 and use that to recover the header using the truecrypt program itself..

Guess that's all.

ok many thanks


   
ReplyQuote
Share: