Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Partition Magic 8 took a dump on my TrueCrypt partition... and I let it happen! And now I am left with cleaning up the mess.

In short, my encrypted partition is now invisible. TestDisk analysis says of the disk containing the encrypted partition: "Space conflict between the following two partitions".

From the googling and searching on various sites, I have learned the following:

  1. Hex editing is beyond me.
  2. Partition recovery tools are useless.
  3. I am not ready to drop the big bucks for professional help.
  4. ... that I should have kept an external backup of the Volume header.

Now, to get back the volume header, I am planning on recreating the exact same partitions on a new disk of the exact same model, and then encrypting it with the exact same password/keyfiles, and then exporting its volume header to a file. Finally, I hope to be able to restore this volume header on to my damaged drive.

Before I undertake this plan, I would like to know if anyone else out there has tried it and, if so, how successful they were. All other suggestions and tips and welcome!! Thanks.

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Problem solved!

Here is how I got my data back. And yes, I did use WinHex.

"blob" = encrypted volume.

The basic idea behind it is to yank out your undamaged encrypted blob of data from wherever it cannot be read using regular methods. In my case, I had a second partition on my hard drive encrypted (standard format). But I think this method would apply to most set-up scenarios.

Steps:

1) Run WinHex. Click "Open Disk" button on top. Select your physical media where you encrypted data resides.

enter image description here

2) Scroll down to the very end of disk. Search backwards for the letter "a" (... the big Magnifying glasses at top that says "Find Text"). This is to find the end of your blob.

enter image description here

3) Determine if you found the end. You should see a whole lot of random data (... the biggest circle in the image shows where your hard drive data is displayed). If you start seeing English words then you are not looking at your blob. In this example, the end is located here: "4A85AFFFFF". The last two characters should usually be "FF".

enter image description here

4) Now, this is where I got lucky with WinHex. You see at the top where it says "Partition 2" - this is my encrypted partition (... you should be able to tell from its size). It just so happened that clicking there automatically took me to the beginning of my blob - the starting location is "4A85200000". After you find what looks like the beginning (again, English or not as random stuff as the rest means it is not a part of your blob), selected it - go to Edit > Define Block.... Enter the starting and ending locations like in the image.

enter image description here

5) Now that you have your blob of selected, export it to a file by going to Edit > Copy Block > Into New File. Save the file somewhere.

6) Open up TrueCrypt and try to mount the file as you normally would an encrypted file container. Use the pass/keyfiles that your originally used to encrypt. If you are lucky, it should mount, like it did with mine. You see, Partition Magic 8 f*ed up data (e.g. partition table info) around my encrypted blob, but not the blob itself - what I had to do was "simply" get it out of my hard drive and put it somewhere (like in a file) where TrueCrypt could select and mount.

Other notes:
1) If you cannot mount your blob then it is possible you are missing a piece of your blob or have extra stuff somewhere in there (probably at beginning or ending) that isn't a part of the blob, OR that the blob is damaged. However, do not assume it is the latter just because you cannot mount on first try! Be patient. Create a backup copy of the hard disk containing your encrypted volume before starting any repair work.
2) Get a little familiar with WinHex. I myself don't know any more that what I laid out above.
3) Unless you know what you are doing, don't run any sort of hard drive applications/tools/etc. where you have your encrypted volume sitting.
4) Don't use Partition Magic. But if you do, NEVER ever click "Yes" on a screen that looks like this:
enter image description here
5) In the future, whenever you create a TrueCrypt encrypted partition, fire up WinHex and write down where on your hard drive your encrypted volume starts and ends using the steps above. Always keep track of where it's located. This, in my opinion, is more important than backing up your volume header.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.