4

The whole external hard disk NTFS partition was encrypted using TrueCrypt. I accidentally run quick format on it. I can still mount this partition using truecrypt after restoring volume header but can't access it. Is there any way to get my data back including folder structure without rescue disk?

4

Recovering the directory layout

I would recommend trying TestDisk, a free and open source tool that was designed to help recover broken filesystems and trashed boot sectors. Mount the drive in TrueCrypt first, and do all of your work on the decrypted drive.

It sounds like your best bet may be to try to recover the partition's MFT, or Master File Table (the rough equivalent of a Linux filesystem's superblock). A backup is stored; however, I don't know if a quick format erases the backup as well.

Getting individual files back

If the directory structure is toast, you may still be able to use an undelete tool such as Recuva, which is freeware, to recover your files. You won't get the directory structure, but if you have something really important you need back, you can sift through whatever Recuva finds.

Preventing this from happening

I bet I know how this happened... You plugged in the drive and Windows claimed that it wasn't formatted (because it is encrypted and looks like gibberish to Windows), and you accidentally let it. Regardless of whether or not this is what happened, this still really annoys me.

You need to prevent Windows from associating that partition with a drive letter, which will prevent it from trying to format it. With your disk plugged in (but not mounted in TrueCrypt), fire up the built-in Windows partition editor (hit Start, type partition, and choose "Create and format hard disk partitions"). Select your encrypted partition in the diagram, and right-click it and choose "Change Drive Letter and Paths." Remove all the letters associated with the partition, confirm, and you should be set!

| improve this answer | |
  • +1 Nice answer, here is how to fix your problem, and here is how to prevent it. – BillN Dec 12 '12 at 22:54
2

Just to add to this, if you'd like to prevent this encrypted partition from getting mounted to a drive letter in other windows computers, there is a GPT attribute you can set to prevent this:

0x8000000000000000

GPT_BASIC_DATA_ATTRIBUTE_NO_DRIVE_LETTER

Prevents the partition from having a drive letter automatically assigned. By default, each partition is assigned a new drive letter and a volume GUID pathname. Both the drive letter and the volume GUID pathname can be used to open the volume using Win32 APIs. Setting this attribute ensures that when a disk is moved to a new computer, a new drive letter will not be automatically generated. Instead, the user can manually assign drive letters.

So in cmd prompt, run DISKPART, select the disk you have, select the encrypted partition, and run this command:

GPT ATTRIBUTES=0x8000000000000000

Assuming, of course, that it is a GPT disk

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.