Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

A colleague of mine has a HDD which has been "corrupted" or more specifically "the truecrypt configuration" has been corrupted.

The key pass for truecrypt is still known.

What would be the best process for data recovery from such a device?

Please migrate if you think this question is out of scope for here.

Thanks.

Edit: Just to clarify the rescue disk has been lost since this drive was created.

share|improve this question

migrated from security.stackexchange.com Mar 22 '13 at 22:21

This question came from our site for Information security professionals.

1 Answer 1

In my experience, TrueCrypt requires creation and validation of a Rescue Disk before it will perform whole-disk encryption. You should use the Rescue Disk to boot or decrypt the drive so that you can retrieve the data.

Alternately, you can load the drive into another computer that has TrueCrypt installed and try to mount the encrypted volume there. Try using the following options from the Mount Options dialog:

  • Mount partition using system encryption without pre-boot authentication
  • Use backup header embedded in volume if available

The Mount Options dialog is available from within the Enter Password dialog when you attempt to mount a volume.

If the above options don't work, you're probably out of luck - see my comment on this answer.

share|improve this answer
    
There is no rescue disk anymore, otherwise would be easier solution. –  MaxSan Mar 22 '13 at 21:42
    
@MaxSan In that case, you're probably just plain hosed. Presuming that they key itself is part of the "truecrypt configuration" which was corrupted, your only option now would be a brute-force attack against the data. This is generally infeasible for anyone short of a well-funded and dedicated government organization - and even then, if it's at all possible, it's not likely to be done within any reasonable time frame for your purposes. –  Iszi Mar 22 '13 at 21:49
    
@MaxSan Edited answer to include another possible option. If that doesn't work, see above comment. –  Iszi Mar 22 '13 at 21:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.