Fully encrypted hard drive partly overwritten by windows setup - any chances...
Open source disk encryption with strong security for the Paranoid
Brought to you by:
idrassi
Menu
▾
▴
Hi,
I'm desperate. I have a 6TB drive which I had encrypted fully on disk level, so not just a partition, but the entire drive. This caused Windows frequently to not recognize the drive, prompting to "initialize" it in the drive manager window. Of course, I always declined and even removed the drive letter inside Windows so that it was hidden from Windows. Windows asking to initialize it was normal, it meant the encryption was active and I could mount the drive with VeraCrypt.
Yesterday I wanted to reinstall Windows on my SSD drive. It's a completely different physical drive, so I thought the 6TB encrypted drive would not be touched by this process. Of course, in hindsight, I should have physically removed all the drives from the mainboard except the SSD drive where I wanted to reinstall Windows on. But I didnt remove the other drives.
In the setup window I clicked on the SSD drive to install Windows there. Which it did... Well kind of. After Windows was reinstalled and booted I realized that upon opening the device manager, it suddenly did NOT ask to initialize my VeraCrypt drive any longer. A bad sign! So I checked on the drive and discovered that the setup manager had shifted the 50 mb "system-reserved" partition, which was supposed to go onto the SSD together with the rest of Windows, onto the 6TB veracrypt drive...
The rest of Windows went - as intended - on the SSD drive.
So the VeraCrypt encrypted drive now has a 50 mb partition on it with the system-reserved MBR and it is therefore no longer un-initialized and also it has now 3 partitions (one is the 50mb system-reserved, the other two are "not allocated") when before it was just one un-initialized black column in the device manager. Here's a screenshot of the aftermath of that drive.
I still tried to mount the drive in VeraCrypt, I entered the correct password and PIM as always, but it failed to mount, showing an Source: MountVolume:8941 error message.
In the VeraCrypt device window, the drive now shows the 50mb partition right underneath it when before it was only the drive without any partitions underneath.
The probably good thing is:
I still have an external backup of the volume header as well of the key file and of course I know my VC password and PIM.
I don't know if that might be helpful or not. Is there any way to get the data (or at least SOME of the data)? Most of the files on this drive were backup files, so I do have a copy. But some few files weren't and I don't have a copy now.
Windows only wrote a 50mb partition on it, so I'm assuming the rest of the large 6TB is untouched and probably still there. I just don't know how to gain access again...
Might restoring the external backup of the header or/and key file help? I don't want to mess with the drive, so I immediately removed it physically from the computer and I'm now waiting for an exact identical copy (same model) to arrive in the mail so I can clone the drive sector-by-sector and experiment with the clone instead of the original.
Thanks a lot for helping me here!
Best
Marvolo
Last edit: Tom Marvolo 2024-12-03
@marvolo
Hello
I quite like your detailed description of the incident and am sorry that you're the victim of this very unfortunate incident.
What's the version of the Microsoft Windows that you'd planned to reinstall?
The incident that you'd encountered further reinforces my belief that Microsoft Windows is a crappy piece of software.
The incident that you described happened to me once, but not with "veracrypted" external drives.
From now on, it'd be wise if you remove all attached drives from your motherboard except the one that you plan to install/reinstall Microsoft Windows on.
You're still using MBR/BIOS? I was under the impression that with Microsoft Windows 10 or later version, you'd need to use GPT/UEFI to create system partitions.
It'd be wise not to try that procedure even if the developers of Veracrypt say it's fine with it.
That's a very wise move. What's a few hundred dollars (or in your case, Euros) when the backup files are so valuable that money can't buy.
What's the name of the software that you plan to use to "clone the drive sector-by-sector"?
To the best of my knowledge, none of the cloning software can do a perfect job. But who knows? You might be the lucky one (it's like you won a 1 billion EUR lottery out of the 2 billion lottery tickets sold.)
Best wishes.
Vencent
Last edit: Vencent Valerian 2024-12-07
Hi @Vencent Valerian
Thanks for your detailed reply.
In the meantime, I was able to solve this problem by doing so as I explained above.
When the identical copy of the HDD arrived in the mail, I made an exact sector-by-sector copy of the original HDD using gnu_ddrescue in a Live Linux (Booted flash drive) environment.
It took almost 14 hours to copy the 6TB bit by bit.
When the clone was created I then used this clone to experiment. I opened up VeraCrypt and let it restore the Volume Header. I didn't even need my externally saved copy of the Header. It was enough to use the internal header which is saved on the HDD. Despite the beginning of the drive being overwritten with 50mb.
After the header restore was successfull, I could normally mount the drive again and everything was still there. All the files and folders. Then I copied everything I needed.
If I had known beforehand how easy it would have been to repair, I wouldn't have bought another HDD model for almost 200€... I could have just repaired the original with a few clicks.
Also, in that case, I was using MBR/Bios because the system where this happened is an older one from 2009. It supports Win10 but the Bios is still legacy and not UEFI. I'm currently looking for components to build a new / up-to-date system, though.