prykpryk - 2016-11-13

By some sort of coincidence I deleted volume where my VeraCrypt volume was. It was placed as a second volume on the external USB drive. There were only 2 volumes on it.
After removing the volume I recreated it and checked if it begins in correct place using WinHex. The newly created volume with my old data is right after the last sector of previous NTFS partition, so this should be correct. I tried restoring volume header using both external and internal backup. When I tried to mount the volume it succeeded but the mounted volume is not formatted (windows asks to format it) and chkdsk says its raw data.

Any ideas?

Will the process of restoring header succeed even if the volume begins in other place than before?

Edit: I noticed quite a few blank (zeros only) sectors around 4.5GB from the begin of the unmounted volume using HexView. So something must have overwritten them :C

Edit2: Hexviewing the decrypted volume doesn't show any decrypted data.

 

Last edit: prykpryk 2016-11-13