Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I got a whole HDD encrypted with TrueCrypt (one partition, non-system disk). I have deleted this partition by coincidence with windows 7 disk manager. Now, I can't mount the TrueCrypt disk (saying wrong password or not a TrueCrypt volume).

At this moment, I haven't touched the disk in the hope that I can recover the partition and the TrueCrypt header so I van mount and use the disk again.

I Googled a lot, but to no success yet. I have tried to recover TrueCrypt header within TrueCrypt tools from 'embedded backup', but to no success.

share|improve this question

migrated from security.stackexchange.com Oct 13 '13 at 1:31

This question came from our site for Information security professionals.

1 Answer 1

Going directly to the source to correct the problem

Basically, that plausible deniablity that everyone loves to quote is springing into action. If you're going to encrypt drives, you must in advance do everything to backup your keys, store your passwords safely and backup volume headers, among other things.

Per TrueCrypt on recovering a deleted volume.

The standard volume header uses the first 512 bytes of the TrueCrypt container. It contains the master keys needed to decrypt the volume. If the header gets corrupted or the container reformatted, TrueCrypt will display Incorrect password or not a TrueCrypt volume.. Using a backup of the volume header is the only possibility to recover the data.

Prepare for disaster in order to ensure success is the word of the day. If you didn't back the volume header up previous to the disaster, you aren't going to recover the volume. It's part of the safety mechanism if my reading on TrueCrypt is correct.

Various other iterations of damage/corruption recovery are covered and the use of TestDisk to recover from partition table overwrites, TrueCrypt Rescue Disk for recovery of encrypted information.

I think the first operation before doing anything would be to image the disk so you can make more than one attempt at recovery.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.