Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Until a few hours ago, I had a pretty large drive that was entirely encrypted using TrueCrypt. I was working on getting the Windows 7 installer working from a USB drive and when it came to formatting the USB stick (stupid me), I instead selected my encrypted drive. I hit the format command and quickly noticed it was the wrong drive I was formatting. I stopped it at 0% but the damage was already done. (just to clarify, I did all of this on Windows 7 as well)

This is the exact commands I ran in the command line:
SELECT DISK 1 (1 was my encrypted drive, this is where I made the mistake)
FORMAT FS=NTFS (it started formatting at this point, and as I realized it was the wrong drive, I quickly shut it down)

I have then proceeded to see what kind of damage has been done, failing to mount the drive with TrueCrypt. I decided to try recovering the volume header via the embedded backup and it worked. I am now able to mount the volume, but Windows won't recognize any of the files on it, all it offers is a reformat.

I have no clue about how to handle this, and have no idea which software would be best for the job if any are even capable of recovering what I lost. What can be done in such a situation?

share|improve this question
It probably is conceptually possible to recover most of the data, but very likely beyond the abilities of most mortal men. Your best bet is probably to contact TrueCrypt and ask for advice. – Daniel R Hicks Jan 7 '12 at 20:27
possible duplicate of Recover data from a corrupt truecrypt encrypted partiton – Mokubai Jan 7 '12 at 20:27
@Mokubai: The issue is not the same, Filip had no backup header available and was trying to restore that, as far as I understood. – Castor Jan 7 '12 at 20:30
Since TrueCrypt works on block level instead of file level, once you have mounted the encrypted drive, all higher file system operations are done in "plain-text". Thus you should be able to use normal file recovery utilities to get your files back. testdisk is a good start. Make sure you make a raw backup the encrypted drive first. – Jan 7 '12 at 22:08 I've tried testdisk as suggested. After running the analysis, it came up with 4 partitions of various sizes and types. If I try to list the files, it seems to find some files but their data (dates, names) is gibberish. – Castor Jan 8 '12 at 15:55

You must log in to answer this question.

Browse other questions tagged .