1

Backstory: After moving a Macrium Reflect disk image from my TrueCrypt external drive (with whole disk encryption) onto an unencrypted drive and using Windows PE with Macrium Reflect to restore my internal disk to the recovery image on the external unencrypted drive, my Windows 8 failed to boot. I then went back and also recovered the System Partition (looking now, it is currently EFI), but I still couldn't boot into my backup.

I was in a hurry to get online for something so I just did a clean install of Windows 8, without the backup. After I installed Windows 8, I went into Disk Management out of curiosity to see if there were other partitions with Windows 8 that Macrium might have missed, and there is (by default) a Recovery Partition of 100MB. My memory of this is hazy, as I was trying to get up and running for an exam at 4 AM.

Something in Disk Management prompted me to convert my encrypted external drive to GPT. I have no idea why I did this, but I went ahead and allowed it to convert my TrueCrypt drive to GPT. Now, I can't mount the drive in TrueCrypt. Disk Management sees it as Disk 1, Basic, and Unallocated. I tried converting it back to MBR with Disk Management, but no dice with TrueCrypt.

If I try to mount the disk in TrueCrypt I get the message:

Incorrect password or not a TrueCrypt volume

I should never have messed with a Truecrypt drive in Disk Management, but I did. I have important college work in that drive, and fear I have lost it forever.

How to recover?

1
  • If converting it back didn't help your sort of Xboned
    – Ramhound
    Oct 25, 2013 at 21:14

2 Answers 2

2

Going directly to the source to correct the problem

If you're going to encrypt drives, you must in advance do everything to backup your keys, store your passwords safely and backup volume headers, among other things.

Per TrueCrypt on recovering a deleted volume.

The standard volume header uses the first 512 bytes of the TrueCrypt container. It contains the master keys needed to decrypt the volume. If the header gets corrupted or the container reformatted, TrueCrypt will display Incorrect password or not a TrueCrypt volume.. Using a backup of the volume header is the only possibility to recover the data.

Prepare for disaster in order to ensure success is the word of the day. If you didn't back the volume header up previous to the disaster, you aren't going to recover the volume.

Various other iterations of damage/corruption recovery are covered and the use of TestDisk to recover from partition table overwrites, TrueCrypt Rescue Disk for recovery of encrypted information.

0

You most likely overwrote the Truecrypt header by GPT's partition system. AFAIK Truecrypt leaves no mark on the drive's data, viewing it should be the same as viewing /dev/urandom.

So your only hope is to recover the header. I seem to recall Truecrypt stores a header backup at the end of the drive (with a different salt of course) but I could be wrong.

Or did you create a header backup previously?

Use dd to copy it back and hope.

Edit: Source: http://www.truecrypt.org/docs/volume-format-specification

Embedded Backup Headers

Each TrueCrypt volume created by TrueCrypt 6.0 or later contains an embedded backup header, located at the end of the volume (see above). The header backup is not a copy of the volume header because it is encrypted with a different header key derived using a different salt (see the section Header Key Derivation, Salt, and Iteration Count).

When the volume password and/or keyfiles are changed, or when the header is restored from the embedded (or an external) header backup, both the volume header and the backup header (embedded in the volume) are re-encrypted with different header keys (derived using newly generated salts – the salt for the volume header is different from the salt for the backup header). Each salt is generated by the TrueCrypt random number generator (see the section Random Number Generator).

For more information about header backups, see the subsection Tools > Restore Volume Header in the chapter Main Program Window.

1
  • edited with a concrete answer. Nov 5, 2013 at 15:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .