I have an HDD with 2 partitions: 100GB unencrypted, unimportant data and 1,7TB encrypted (AES with TrueCrypt) important data. When I installed Windows 7 on another hard drive it wrote about 100MB on that drive which damaged it. (My post about that can be found here in case anybody has any further suggestions for recovery.)

Now I'd like to recover the 1,7TB of encrypted data. Before sending it to an expensive data center I'd like to try my luck with things such as TestCrypt.

Before doing so however I'd like to copy the damaged hard drive to another hard drive so that my attempts won't risk data loss.
For this purpose I've bought a 2nd HDD of the exact same size and type.

-> Now I'm not sure what the best way for this 1:1 copy would be: should I do a bit-to-bit copy, clone, image or mirror? (It should simply create the most identical copy possible.)
What program should I use? (Clonezilla maybe?)
Also note that I'd like to access the original HDD as few times as possible to avoid risk of data failure on the original hard drive as much as possible.

  • 1
  • @DavidPostill not sure why that looks like a duplicate of that question to you. This question is about how to copy the hard drive and which method to use for that - the question you posted is about data recovery. – mYnDstrEAm Nov 23 '15 at 10:56
  • 1
    "This will copy the data exactly at a sector-by-sector level." – DavidPostill Nov 23 '15 at 11:06
  • 1
    Who knows if it is needed to do a sector by sector copy? I mean which are the info used by TrueCrypt? Did it uses the physical connection number of the HDD somehow? Did it uses the absolute sectors? Because if not maybe it's enough to copy the single partition. Did it uses the HDD serial number? because if yes and you are not able to change it, you need to spoof it or to do an image with those informations inside... With encryption things are used to be more complicated. First of all be sure Windows is not writing anymore on that HDD part. – Hastur Nov 23 '15 at 11:24
  • 1
    Read carefully this page of cgsecurity.org about TrueCrypt. Take more information you can on how to recover corrupted (or overwritten) TrueCrypt encrypted partition and do your attempts. Do not stop at the first problem. Post specific problem as new question or update this one. Do a (paper) logbook of each action you will do so that you can reproduce all... – Hastur Nov 23 '15 at 14:58

If your disk is damaged, you should avoid to use it before making sure you saved what can be saved.

So the best way is to use a live CD, I would recommend SystemRescueCd. This system contain a tool designed to save what can be saved from you disk: ddrescure

This tool is designed to get the most out of your damage disk. See https://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html#Examples for most common examples.

Once your data is saved, go ahead with reinstalling, etc.

  • I'd only use it for cloning the data to the 2nd hard drive. Does it matter to ddrescue that my data is encrypted? Note that it's not physically damaged - there's just 100MB of Windows 7 data that overwrote and damaged the disk's data. So with this in mind is there any advantage of using ddrescue instead of using EASEUS Disk Copy of the Ultimate Boot CD (ddrescue seems to be a bit more complicated and I'd like to keep the chances of doing sth wrong low)? – mYnDstrEAm Nov 23 '15 at 13:17
  • 1
    No, I think EASUS does the job, so if it fits your needs go ahead with it. The main advantage of ddrescue is that it's free and open source software, but really, use the tool you feel at ease with. Good luck ! – alci Nov 23 '15 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.