Recover partition header after accidental deletion

[Jens Anders]

Hi all,

Could I ask someone with some more technical understanding of partition to help me out. I’m quite desperate, so even paid technical consultation is something I am willing to get. We are talking 10 years of unreplaceable data (idiotic to have no backup)

I have accidentally managed to delete my Veracrypt partition encryption when trying to delete a USB partition. Listed on the picture as Harddisk 2 with only Partion1 left (I assume this is the GPT) It was similar in the layout to Harddisk 3 but formatted as RAW.

Any chance in hell to recover this?

I bought a another of the same drive to make a clone so any testing is without risk to the original drive. Volume header restore in Veracrypt and TestCrypt has no result for me at all. As disk was encrypted by AES(SHA-512) as a Standard Veracrypt Volume, so then I would guess that conventional way of recovering the partition will not work. It was previously listed as “RAW” format

I have exhausted google for things to try like https://www.wilderssecurity.com/threads/accidentally-deleted-truecrypt-partition.357892/

Tips, hints, rude comments are all welcome as long as they somehow help.

Pictures:
https://ibb.co/n9oeq8
https://ibb.co/hzOqxo
https://ibb.co/gJnTiT
https://ibb.co/ithuOT

[Enigma2Illusion]

I believe you can access the data again assuming nothing has overwitten the data.

Try the following:

• Use Windows to create a new partition using the exact same size of the original RAW format.
• Select the option to NOT format. Remove assigning a Windows drive letter.

The end result should be \Device\Harddisk2\Partition2 as RAW.

Attempt to mount with VeraCrypt.

If mounting fails, attempt to mount using the option of embedded backup header.

[Jens Anders]

Alex, thanks for answering. The software is just a bit to complicated and could not find documentation for how to configure DcsFV.cfg. Tried it a week back, but had to resort to an older version just to even make it run. Thanks for making this though, from my limited understanding its pretty awesome and kinda similar to TestCrypt. Just more advanced and made for VeraCrypt.

Enigma2Illusion,
Can't belive it was this easy. Waited for the sector by sector clone of the disk to finish then tried it on the cloned drive and voilà!
Restored the volume header from backup embedded in the volume, had to randomize a bit with the mouse and there you go. That simple solution and Ive been trying other things 5 hours plus, just because I believed it was encrypted all the way. No part of the RAW made by Windows so doing this would just overwrite whatever header infromation I was trying to recover.

First thing I did was to put the disk(s) into Raid 1 :D

Thanks a lot for taking the time to answer. You saved me from so much agony.

[Enigma2Illusion]

I am glad my suggestion worked!

FYI: RAID 1 is not a backup due to any mistake made by you or software error will be synchronized to the other drive.

[Strahan]

Bless you, I was crushed when I realized I had accidently formatted my VeraCrypt volume. I found this post from years ago and it helped me get it all back.

Thank you so much :)

[Alex]

To locate and decrypt any partition (or data) encrypted by VeraCrypt I created tool DcsFV (find volume)
Details:
https://sourceforge.net/projects/dc5/files/beta/
use DcsFV_03.zip
main goal of dcsfv - scan sectors(file or disk) and locate VC headers. It tries authorization for each sector => large amount of time => you have to limit sector range (possible location of headers: probably begin of partition and last 256 sectors of partition).

Important: it is possible to recover data if VC header is found. (the header contains keys for sectors and the header is encrypted by password) It can help if you have backup of VC header for the disk.