Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

i got the whole HDD encrypted with TC (one partition, non-system disk) recently i have deleted this partition by coincidence with windows 7 disk manager now, can't mount the TC disk (saying wrong password or not a TC volume)

at this moment, i better havent touch the disk in hope i can recover the partition somehow, then recover the TC header to be able to mount the TC disk again.

Googled a lot, no success yet. i have tried to recover TC header within truecrypt TOOLS from 'embedded backup'. No success.

Can anyone help? thank you

share|improve this question
add comment

migrated from security.stackexchange.com Oct 13 '13 at 1:31

This question came from our site for Information security professionals.

1 Answer

Going directly to the source to correct the problem

Basically, that plausible deniablity that everyone loves to quote is springing into action. If you're going to encrypt drives, you must in advance do everything to backup your keys, store your passwords safely and backup volume headers, among other things.

Per TrueCrypt on recovering a deleted volume.

The standard volume header uses the first 512 bytes of the TrueCrypt container. It contains the master keys needed to decrypt the volume. If the header gets corrupted or the container reformatted, TrueCrypt will display Incorrect password or not a TrueCrypt volume.. Using a backup of the volume header is the only possibility to recover the data.

Prepare for disaster in order to ensure success is the word of the day. If you didn't back the volume header up previous to the disaster, you aren't going to recover the volume. It's part of the safety mechanism if my reading on TrueCrypt is correct.

Various other iterations of damage/corruption recovery are covered and the use of TestDisk to recover from partition table overwrites, TrueCrypt Rescue Disk for recovery of encrypted information.

I think the first operation before doing anything would be to image the disk so you can make more than one attempt at recovery.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.