Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite

I was formatting a hard drive (160GB) with encryption to be used for backup using Truecrypt. My computer went to sleep while this was happening and the operation got canceled. I just clicked "Back" button once and just tried to format again. Now, Truecrypt formatted a wrong hard drive that was about to be backed up. I know this is Truecrypt's bug because it formatted 320GB hard drive to 160GB partition. Well, all my life data was there without a backup. I was wondering if there is a way to recovery. I tried Recuva on the encrypted partition, but without success, as it is written over with random bits. But I was wondering if I could recover data from the other half of the drive.

share|improve this question
You know it was a bug with TrueCrypt? How can you be sure? Did you try recovering it by unencrypting it using the CD-ROM you burnt? What happened to the backup you ran before encrypting your drive? – Randolph West Aug 6 '12 at 7:24
I just cannot see 320GB hard drive being partitioned to 160GB in any other way. I did not burn any CD-ROM. Please correct me if I am wrong. unecrypting is possible if you just did encryption on the existing data. What I was trying to do is format/encrypt the 160GB drive. If the operation was done, it means random bits were overwritten on existing data, meaning there is no recovery possible. I am just trying to recover whatever I can. Right now I cannot even mount the hard drive anymore. I am looking at winHex and TestDisk for solution. Thanks for the reply though. – Forethinker Aug 6 '12 at 22:30
If you encrypted data, you cannot recover it without decrypting. – Randolph West Aug 7 '12 at 1:06
Sorry if my question was not clear. It was a format with encryption. So if I decrypt it, there is nothing left on the partition. My focus is on recovering the data from the part that was not formatted. – Forethinker Aug 7 '12 at 5:54

1 Answer

up vote 0 down vote accepted

So in this particular case, Truecrypt wrote over some sectors, but the data recovery was partially possible with many software options. (58.9GB/298GB) EaseUS Partition Master and NTFSWalker are free options for Windows. Unfortunately in my case MFT (and its mirror) got deleted. (!) (Please tell me if you know they are recoverable) And since NTFS stores the file names in MFT, I was able to recover files but without the directory structure and and file names. I am still puzzled by the behavior of Truecrypt.

Only files that had names intact were mp3 files because they store names in the IDE tag.

Some other programs that are used for recovery in Windows are:
R-tools
Active File Recovery
GetDataBack for NTFS.

The tool called ntfsundelete for linux is equivalent to Recuva for Windows. It restores deleted files on a partition that still has MFT intacted. From my brief search, data recovery programs for ntfs are available in Windows only.

I will made an update if I find anything interesting. Feel free to correct/enlighten me because I am not an expert on file structures.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.