TrueCrypt issues | Hacker News Reader

TrueCrypt issues

1 pointphct2 comments

after i update TrueCrypt 7.1a to 7.2 the encrypted partition/volume after mount it became impossible to browse it because partition/volume became RAW and windows explorer does not read RAM partitions,ive tried to use other tools such as VeraCrypt to try to mount with no success,then i try to find problem using testdisk and by what it seems i have Boot Sector and MFT damaged,ive tried to repair Boot Sector/MFT with testdisk but does not work,using winhex and open RAW drive i get this error:

    Warning: Unsupported FILE record size! Cannot read from Drive O:. Sector 613.475.145.525.758 does not exist. Messages of this kind will not be displayed here again for the remainder of this session. Drive O: Cannot open "$MFT". Unexpected data at offset 45BE7A04153FC00 and offset 52B3AE542400, Res=1, Res2=1

my question is, how can i recover the encrypted data? ive tried to use recovery tools like Recuva for eg. but they do not work,Recuva complains "unable to read Boot Sector".. how do i fix Boot Sector and MFT(assuming this is the problem)? note:this is not system disk encryption..

thx in advance.

Have you tried removing 7.2 and reinstalling 7.1a? 7.2 should not be used, it is a crippled, read-only version. 7.1a is the last "real" version of TrueCrypt.

If the encrypted volume was damaged and you don't have backups, you might be out of luck.

hey, yeap i did reinstall 7.1a but the problem persisted,i had a cable disconnected also and i decide to connect it,im dont understand much about hware but this cable connected or disconnected seems "optional" as the disk is detected and seems to work,this is a SATA disk btw,on cryptography mailing-list a guy replied:

>Yes, the NTFS MFT is corrupted; your tools are telling you that much. The TrueCrypt container may very well be corrupted beyond the header that you restored. To what extent either is corrupted is impossible to tell based on the information you have provided, but the sector number and the MFT offset indicated would imply a storage device of at least 3*10^17 bytes (about 314,000 TB), which is clearly implausible. I don't think you need a cryptography expert; rather, you need a data recovery specialist, or possibly someone who knows the ins and outs of TrueCrypt as a product and its on-disk format. Or, if that is out of your budget, at least data recovery software. Now that you are able to open the TrueCrypt container, the fact that the data is encrypted on-disk should have limited bearing on any further problems, _if_ (which is a very big if) there is no further data corruption.

i've tried to ask other places like http://www.wilderssecurity.com/threads/truecrypt-problem.380... https://forum.truecrypt.ch/t/truecrypt-working-but-drive-is-... and https://www.reddit.com/r/crypto/comments/3wscf3/truecrypt_is...

but i did not get many help? how do i repair a TC volume/partition corrupted/damaged?

Reply on news.ycombinator.com