Hmm, where do I start? Well I have this old hard drive. It sat quietly in the "I'll do it later when I have time" closet for years. And now... now I have time.
Ok so what exactly are we talking about?
This is a Samsung HD103UJ (1TB, 7200rpm, 32M). It was encrypted with Truecrypt (don't know the exact version) with full disk encryption. I'm pretty sure I used Windows 7 at the time so there is probably a NTFS Partition 'under' the encryption layer. But the drive itself was just a data archive. So just one big partition, no Windows installation.
I still have the password and everything. So I tried mounting it in my Ubuntu 18.04 with Veracrypt. Sadly I got the following error.
A quick smart lookup looks like the drive is not in good shape.
My goal: I have a spare identical drive (HD103UJ). Do a raw sector-by-sector copy from the old to the new drive. Tinker with the new one and hopefully be able to encrypt it and make a backup.
First I tried a simple dd run. This failed me after about 100GB. Probably due to the bad sectors.
Next I tried using Acronis True Image 2017. The Live CD didn't even recognize my drives at all.
I put clonezilla onto a bootable USB thumbdrive. Tried the default non-expert device-device clone function which did not work.
Some google search findings suggest there might be a good set of values to be selected in the advanced menu. But I didn't want to stress my drive more than necessary.
Could you give me advice on what parameter might be good choice?
Thanks in advance and have a great day.
halb9
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Since you mentioned that it might have some bad sectors, I would suggest you use the "ddrescue", which is also included in Clonezilla live, to do the sector by sector cloning.
Steven
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
I was able to do that with VeraCrypt 1.24-Update 4 on my Ubuntu 18.04. Don't know if it really was nessecary but it's too late now.
The error message remained.
But TrueCrypt gives you the option to NOT mount the Filesystem when mounting the crypto layer. I did that (plus read-only mode) and was able to succesfully mount the volume.
As far as I can tell this probably means the crypto layer is intact, however the NTFS layer is corrupted.
This is the part where ddrescue comes into play.
I didn't want to tinker on my original harddrive and break something that is irreversible. So my primary goal was to make a copy of the full NTFS partition.
This has been running for about 36 hours now and is still going. Slowly but the percentage is still going up.
If that goes well it should be possible to make additional copys of the hard disk image and try to repair the NTFS partition. Or use a file recovery tool.
I'll have a look at that later.
Thank you for your time.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Hi there,
short update:
ddrescue got me to 99.85%. It took about 6 hours to go from 99.84% to 99.85%. I let it run additional 10 hours but it was still stuck at 99.85%. For me this was the time to stop it.
As a side note. The link above strongly advice against(!) running it so many times if there are bad sectors. They suggest to seek the help of a professional data recovery center.
The data on the drive is not so important I would be willing to spend a good amount of money on it. I partly wanted to see how far I can come all on my own. Even at the risk of loosing everything.
With ddrescueview you can get a nice gui representation of the logfile, created by ddrescue.
Im going to make additional backups of my IMG file now and we will see how it goes from there.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
I was able to make additional copys of my .IMG file so I could work on them instead of the original HDD. Although probably not necessary I copied the IMG back to an identical hard drive.
I tried restoring the NTFS header with various tools. Which was not very successfull.
From that point I switched to PhotoRec to try to recover my files directly without the convenient help of a filesystem. And this is where I hit my biggest disappointment.
It seems kinda obvious now in hindsight but PhotoRec recovers files only. No directory structure, no filenames, nothing, just plain files. While this at no point is a failure of PhotoRec, for me it meant to have a bunch of unsorted random files. This might be good enough if you're looking for specific .pdf oder .doc(x) documents. If you had a bunch of .mp3 files and VIDEO_TS folder for complete dvds this is a pretty big mess.
Again, not pointing fingers here, just rationalizing that the amount of time I have to put into this to get back to the state I had before is simply not feasable. If possible at all.
My final thoughts.
Make backups
It was a fun ride.
It was a lot of work.
It did not go as I hoped it would go.
I'm glad it wasn't any family pictures or otherwise important files.
Make backups
Thanks for all the fish
Have a good day
TLDR;
Found an old encrypted hard drive.
Restored the crypto header.
Filesystem corrupt as well bad sectors on drive.
Made 99.85% 1:1 copy of failing drive with ddrescue.
Did not manage to restore NTFS filesystem header.
Restored files directly with PhotoRec
Realized this will be to much work.
End project without success. Cry in the corner.
👍
1
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Hello there,
I hope you're all doing good these days.
Hmm, where do I start? Well I have this old hard drive. It sat quietly in the "I'll do it later when I have time" closet for years. And now... now I have time.
Ok so what exactly are we talking about?
This is a Samsung HD103UJ (1TB, 7200rpm, 32M). It was encrypted with Truecrypt (don't know the exact version) with full disk encryption. I'm pretty sure I used Windows 7 at the time so there is probably a NTFS Partition 'under' the encryption layer. But the drive itself was just a data archive. So just one big partition, no Windows installation.
I still have the password and everything. So I tried mounting it in my Ubuntu 18.04 with Veracrypt. Sadly I got the following error.
A quick smart lookup looks like the drive is not in good shape.
My goal: I have a spare identical drive (HD103UJ). Do a raw sector-by-sector copy from the old to the new drive. Tinker with the new one and hopefully be able to encrypt it and make a backup.
First I tried a simple dd run. This failed me after about 100GB. Probably due to the bad sectors.
Next I tried using Acronis True Image 2017. The Live CD didn't even recognize my drives at all.
I put clonezilla onto a bootable USB thumbdrive. Tried the default non-expert device-device clone function which did not work.
Some google search findings suggest there might be a good set of values to be selected in the advanced menu. But I didn't want to stress my drive more than necessary.
Could you give me advice on what parameter might be good choice?
Thanks in advance and have a great day.
halb9
Since you mentioned that it might have some bad sectors, I would suggest you use the "ddrescue", which is also included in Clonezilla live, to do the sector by sector cloning.
Steven
Hi,
thank you for your answer. It is really appreciated.
Before your posting I already tried ddrescue and it is still ongoing.
It turns out TrueCrypt stores a backup disk header embedded in the volume.
You can use that to restore the main header in the case it might be corrupted.
https://www.neowin.net/forum/topic/984006-guide-backup-truecrypt-disk-header/
https://www.truecrypt71a.com/documentation/troubleshooting/
I was able to do that with VeraCrypt 1.24-Update 4 on my Ubuntu 18.04. Don't know if it really was nessecary but it's too late now.
The error message remained.
But TrueCrypt gives you the option to NOT mount the Filesystem when mounting the crypto layer. I did that (plus read-only mode) and was able to succesfully mount the volume.
As far as I can tell this probably means the crypto layer is intact, however the NTFS layer is corrupted.
This is the part where ddrescue comes into play.
I didn't want to tinker on my original harddrive and break something that is irreversible. So my primary goal was to make a copy of the full NTFS partition.
I found
https://datarecovery.com/rd/how-to-clone-hard-disks-with-ddrescue/
and started to image the partition onto a new 2TB hard disk.
This has been running for about 36 hours now and is still going. Slowly but the percentage is still going up.
If that goes well it should be possible to make additional copys of the hard disk image and try to repair the NTFS partition. Or use a file recovery tool.
I'll have a look at that later.
Thank you for your time.
Hi there,
short update:
ddrescue got me to 99.85%. It took about 6 hours to go from 99.84% to 99.85%. I let it run additional 10 hours but it was still stuck at 99.85%. For me this was the time to stop it.
As a side note. The link above strongly advice against(!) running it so many times if there are bad sectors. They suggest to seek the help of a professional data recovery center.
The data on the drive is not so important I would be willing to spend a good amount of money on it. I partly wanted to see how far I can come all on my own. Even at the risk of loosing everything.
With ddrescueview you can get a nice gui representation of the logfile, created by ddrescue.
Im going to make additional backups of my IMG file now and we will see how it goes from there.
OK, thanks for sharing that.
Steven
Hi there again, sorry for the long wait.
I was able to make additional copys of my .IMG file so I could work on them instead of the original HDD. Although probably not necessary I copied the IMG back to an identical hard drive.
I tried restoring the NTFS header with various tools. Which was not very successfull.
From that point I switched to PhotoRec to try to recover my files directly without the convenient help of a filesystem. And this is where I hit my biggest disappointment.
It seems kinda obvious now in hindsight but PhotoRec recovers files only. No directory structure, no filenames, nothing, just plain files. While this at no point is a failure of PhotoRec, for me it meant to have a bunch of unsorted random files. This might be good enough if you're looking for specific .pdf oder .doc(x) documents. If you had a bunch of .mp3 files and VIDEO_TS folder for complete dvds this is a pretty big mess.
Again, not pointing fingers here, just rationalizing that the amount of time I have to put into this to get back to the state I had before is simply not feasable. If possible at all.
My final thoughts.
Make backups
It was a fun ride.
It was a lot of work.
It did not go as I hoped it would go.
I'm glad it wasn't any family pictures or otherwise important files.
Make backups
Thanks for all the fish
Have a good day
TLDR;
Found an old encrypted hard drive.
Restored the crypto header.
Filesystem corrupt as well bad sectors on drive.
Made 99.85% 1:1 copy of failing drive with ddrescue.
Did not manage to restore NTFS filesystem header.
Restored files directly with PhotoRec
Realized this will be to much work.
End project without success. Cry in the corner.