Weird issue. All of a sudden my correct password isnt working and I cannot...
Open source disk encryption with strong security for the Paranoid
Brought to you by:
idrassi
Menu
▾
▴
Fortunately, its not the most important data in the world. But the issue seems to have cropped up out of the blue and I have not damaged my drive or changed any settings, or even saved to it or accessed it in 6months. My device hasn't moved location (so I don't understand how it could have become physically damaged), and prior to this the device operated as expected. And nothing has changed since then.
I have this error message after I Select
Device > Mountand enter my password. I have no doubt the password is correct:I have browsed a online and, please go easy with my with regards to the technical jargon this is a deepened of the pool I am not used to, noticed a few people suggesting
Mount options > Back-up Headerhowever I tried that and have had no success with that either. I get the same error message.When I insert the drive into my older Windows 10 machine, which is not the normal machine I accessed the data on, the empty folder drive being detected does pop-up in Win10 Directory, but for some reason VeraCrypt wont accept my password. I wonder if this will work on my work machine, which was normally what I used to save the data onto it? Its really bizarre.
For context, I am using a 7TB WD drive. I have shucked it in the past before putting it back in the enclosure, so thought maybe there was a connection issue. Shucked it again and everything seemed tightly attached, tried VC again and still no luck. The drive was working perfectly 6months ago when used on my other work machine, but for the first time since then I decided to use the drive again and had this issue.
The version of VC I am using on my older W10 machine is 1.25.7, I cannot recall which version is on my work machine but suspect it would be an older version, but will have to wait before I can test mounting it on that machine as that machine is in the office.
One other potentially useful detail, is I notice the device is appearing as "Elements (D:)" in the Windows directory (obviously no files or folders are appearing), but there is no drive D option in VC (I am not sure if that matters).
Any thoughts before I just wipe the drive and use it for other stuff?
Welcome to the community forums.
First, it's mandatory to know what kind of VeraCrypt volume you used with your (external USB???) device: whole drive encrypted or an encrypted partition or an encrypted container file.
Furthermore, you should not use/ connect the device to any machine as this could cause more and more damage to the encrypted data.
Hey RealTehreal, thank you for the warm welcome and assistance, that is really kind! When I saw the views for the forum go up but no comments, I thought it was too complex a problem to even investigate further, so I appreciate your time!
Ah, so I encrypted the whole drive. There are no partitions and there are no individually encrypted files. I remember encrypting the whole drive and using the quick format option in veraCrypt to do the encryption.
Ah, I see. I will hold fire from doing anything else and wont load in another machine. Thanks for helping me dodge that bullet!
Never mind, I just hope, I can be of help.
Alright. So, when you connect the device to a computer, a file explorer window opens up, showing an empty folder. Is this correct?
That is correct. Just like if I were to insert a non-encrypted drive into my machine a window would pop open and I would be able to see all the files on that drive, but in this instance no files are appearing :(
If it is useful I am using a 8tb WB Elements external drive.
If that's the case, it seems like the drive has been formatted. That's why VeraCrypt cannot open the volume. Additionally, it's most likely damaged now.
In case you are interested in data recovery, the most secure way to proceed would be to boot up any Linux live system. Ubuntu and its derivates are quite easy to operate. As Windows seems to currently be a nuisance when it comes to damaged virtual devices (like VC volumes) this seems to be the only good way to go at the moment.
Then create a binary backup of the whole device. Every attempt to get data back should then be run on the backup, leaving the original device untouched for now. To do so, you would have to mount the backup and do the following on the virtual disk device.
Remove the partitioning with, e.g., GParted or any other partitioning software.
After this, there should be a raw device with no partitioning and no partitions, again. Just like it was after encryption.
Then you could try again to mount the device, always using the
Mount volume as read-onlymount option. It's unlikely to work, but better trying than crying.If it doesn't succeed, try again with additional mount option
Use backup header embedded in volume if available, hoping that the backup header is still intact.In case you get another error, like mentioning a damaged filesystem, you should additionally use the mount option
Do not mount. In case it succeeds this way, you should either again create a binary backup of the mounted volume, mount it and use data rescue software to get as much data as possible off the volume. You could also directly set data rescue software on the mounted volume, though.If none of the above works, it's likely that both the main and the backup header are screwed, leaving us incapable of action. In such case, the only way to still get something done would be to have a backup of the header. But such backup has to be created before a disaster occurred.
That the gist of it. If you have questions on one or the other steps to take, don't hesitate to ask about them.
Greets
Ah thats a shame, but not the end of the world. Tbh, it would be nice to see what was on the drive more out of curiosity, so I will give this a shot. I actually happen to be on my Ubuntu machine now, so why not! Even if I could just see the file names on the device, that would be enough.
I am going to need some idiot steps though! So:
This is my very, very first step, right? So I installed the software but I am not sure what I am looking to do next.
It reads:
/dev/sde1 -- Elements -- ntfs -- Elements -- 7.28Tib -- 332.67 Mib (used) -- 7.28Tib --msftdata
Then, on the next row
unallocated (partition) -- 1Mib (size), with the rest of the columns being empty.
I see an option to Delete Selected Partition, is this what I shuld be using? And if so against which row?
Not a good sign, when I cant even make it past the first few steps!
Thank you for all the help!
Its so weird though, because I did not move the drive at all and just didnt access the content for a few months. Bizarre! Anyway, lets see what happens!
I just saw that it seems like GParted cannot remove the partition table. But gnome-disks can! So you should instead use this program to remove the partition table and choose to not overwrite the drive.
I assume that at one point in time, when the drive was connected, Windows offered to make the drive available, which includes to create a partition table and a partition. Windows cannot detect if the drive is encrypted or not and assumes that the drive is just new and fresh. That's why VeraCrypt shows a warning about encrypting an entire drive instead of a partition.
Keeping this in mind, you should from now on better encrypt a partition instead of an entire drive.
Hey RealTehreal, thank you again for your guidance! I installed gnome-disk-utility before realising its the default disk utility already installed with Ubunutu!
I navigate to my 8.0TB Hard drive, and per your direction in an earlier post "Remove the partitioning with, ...After this, there should be a raw device with no partitioning and no partitions, again. Just like it was after encryption.". However, looking at Disks, it reads "Elements Partition 1: Elements 8.0 NTFS" and there doesnt seem to be any visible partition split. Whereas when I click on my SSD, in my Ubuntu machine, I do see the drive broken down into multiple partitions.
Therefore I am not sure how to remove any partition. Clicking on Additional Partition Options for my WD Elements drive, I see Edit Partition/ Format Partition/ Restore/Create/ Benchmark Partition.
Please could I confirm which of these options I should be selecting and if I should proceed dispute no visible partition being apparent.
You bet! As it seems with all tech stuff I do, that lesson has been learned the hard way! FIngers crossed I can atleast see the files on the system, even if I cannot access them. It will just give me peace of mind its nothing actually important on the drive!
Once again, thank you RealTehreal!
Could I maybe ask, how you know all of this stuff? Are you like a data engineer? Do you learn this stuff at college? I find this world really interesting (although stressful out of fear of clicking the wrong thing and making matters worse, hence all my self doubt above). Its an area of IT, I have always wanted to learn more about, but it seems very unapproachable to outsiders!
Sorry for being out of touch for so long — have been busy with work.
You have to make really sure that you are wiping the partition table of the correct media. Otherwise, you could destroy beloved data. Please have a look at the screenshots to see the steps to be taken.
I've been playing around with all kind of technical stuff for decades (now I feel old when thinking about it xD). I've been working as a program developer, have a degree in electronics engineering and computer science, and now I'm working as a teacher at an IT trainee center. But all those nice reading achievements aside, far before getting any degree or whatsoever, what really matters is trying things out, losing data by doing mistakes (yes, same happened to me many, many times before) and making experiences.
Thank you for this! Could I please re-confirm I am to proceed even though my partition system looks different to the example you provided above? I have attached a screenshot of my partition split (which is not a partition split really just a full 8tb drive), just before I pull the trigger I thought it was worth confirming!
As you directed, I do have the option to: Format Disk > Erase: Dont overwrite existing data, Partitioning: No Partitioning.
But just want to triple check! Sorry for being a pain! I dont want to corrupt anything further as now I am invested in semi-recovering this data!
After this, from an earlier post you suggest,
1. I Mount the volume as read-only (on my Ubuntu machine, I think),
2. If that fails (which you mentioned was sadly likely), do I then try again but with Mount options > Back-up Header checked.
Have I understood all of that correctly? I did try Back-up Header before, but that was without formatting the drive as I am getting ready to do!
Lastly, could I just double check I have understood one of your earlier posts:
If I get an error message, I Do not Mount option, and if that works I should create a binary back-up, is that right? How would I create a binary back-up? I dont have any recovery software, but I am sure I could pick some up, if this is a recoverable project.
Fingers crossed! Looks like we are close to the moment of truth!
I am actually studying computer science, but this type of work seems more engaging to me than writing code at the moment. I was actually considering swapping to electronic engineering. Have you found getting a job easier as an electronics engineer or computer scientist? I think CompSci gives me more employability from what I see online.
I looked online to see if there were any books on this type of stuff, because some of it is just too hard to learn by trial and error for me, and is also really, really stressful when its your own data! E.g. I had no idea inserting my drive into another machine, could potentially corrupt the data further like you mentioned in an earlier post! And I dont know how to learn stuff like that myself! Hopefully the degree gets more interesting though!
Thank you again for all your help, and no need to apologies for the slow replies, I just appreciate the expertise!
Of course, my partition table looks different from yours. Just make sure that you are actually going to wipe the correct media. But I guess, as long as you don't have more than one media with 8 TB storage, you should be good. Better safe than sorry.
This is mandatory. Otherwise, you would wipe the data, which is likely still there but inaccessible.
This would be correct.
This is an optional step which should always be done, in case we are talking about valuable data. But for testing's sake, you could as well skip this step. You would have to have a second media with 8 tb or more storage at hand to create a binary backup, anyway.
Using Linux, "dd" would be the built-in solution. Just to be mentioned, it's nothing to be used without double-checking. It can destroy media partitioning itself quite easily, which is another common way for a VC volume to get corrupted.
I always liked the open-source solution "Testdisk / Photorec". But it's not easy to use.
I wonder!
This is quite off-topic. But to give you my opinion, it always depends on what you are willing to do as daily work and, especially, where on the globe. If you want to further talk about such topics, better PM me. Thank you.
That's what you are currently doing, though. :-)
I hope, it's not in vain, though. At last, there is a chance that we are getting nowhere and there could still be a way to get your data back in a way, I for myself do not know.
Thank you for all the confirmations! I will try this as soon as I get home. Is formatting the drive in this manner a destructive action? I have kind of become some what invested in trying everything to retrieve the data, even if its just the files names saved on the drive.
Even so, I think its my only option at this stage! I actually do have another 8tb I got for Christmas, so if the Binary step comes up (and hopefully isnt overly complicated), it might give me the change to learn further!
Also, thank you for the offer to PM, if I will certainly shoot you a message (and update email), once I get home. Once again, all your assistance is appreciated!
Sorry, just another thought I had! If the formatting process is destrucive and can reduce the likelihood of recovering the data, is there anything else you would suggest I do before that stage?
I have become somewhat invested in recovering this data now! Sorry again for all the annoying noob questions!
Removing the partition table is, of course, a destructive process. But it should not have any effect on the user data. Formatting as NTFS was the most destructive action so far.
This is unlikely to become reality, as file names are stored where now the new partition information of the NTFS partition is stored. So, it could be possible to restore data, but no original file names.
Thank you for this! So it looks like this is my only option at this stage.
I am sorry for having so much self doubt, but once I have configured everything like you suggested, I get the below message. Please can I confirm, for the last time I promise, that I just hit format at this stage and hope for this best!
I kind of at the back of my mind was hoping to get the data, but I think its long gone sadly. But I just want to make sure I dont shoot myself in the foot at this stage if there is any hope :(
It's fine to make sure, everything's configured correctly.
In case you set the mentioned options and this is the correct device, you can hit the format button.
Sincerely thank you for the above, I am just super jittery I will screw this up and any possible chance to recover the data will be lost be forever lost by my negligence.
You asked me this in your first post to me and I said I believe I partitioned the whole drive, I am doubting my answer a little here.
Before the data issue the way I would mount the drive would be
Select Device > Mount...So I do believe that means the whole device is encrypted, is that right? Sorry for all the self doubt - after this I am ready to pull the trigger and format the drive no matter what happens!
Both encrypted partitions and entirely encrypted devices are mounted via
Select Device...option.Ah, so I would need to format the drive regardless?
I just plugged in my device into my Ubuntu machine to do the format, but noticed there is a " System Volume Information" folder appearing in the 8TB drive (the folder contains a"IndexerVolumeGuild" and "WPSettings,dat". Is that helpful, or do I go ahead and hit format?
Sorry again for all the self-doubt! And a sincere thank you for your help!
If I'm not mistaken, there is a NTFS partition on your device, which was created via Windows and overwrote the VeraCrypt volume.
What to do still depends on how you created your volume in the first place - entire device encrypted or an encrypted partition.
Ahh, I see. I believe I would have encrypted the entire drive or like 99.99% of it, but I honestly cant remember. I think I would have just done the default settings, but it was so long ago...
Is there any way for me to confirm this? If not, what would you propose I do next?
Thank you again!
The only way to confirm would be to go on and see if there's any data to recover.
When you are more certain that there was an encrypted partition, you could format the device (quick) using MBR or GPT (depends on what was used before), create a raw partition (quick) of the same dimension and position on the device as the original encrypted partition, and finally try to mount it the way as described before.
I think, doing nothing will bring you nowhere. But the final decision lies on you.
You are totally, right. I am sorry for all the self doubt! I am ready to go!
So, I am a little uncertain here. Does this mean my next step is to proceed with the steps you laid out above? (i.e. Disks > Format...).
Would I do this in VeraCrypt after formatting the drive? Are you able to offer a little more context for this part?
So I think I am getting my wires crossed and proceeding with Disks > Format should be the last thing I do, is that correct? If so, what would my first steps be?
You are TOTALLY right, doing nothing isnt going to teach me anything. Its not even like its anything super important on the drive, was more just curiosity. Once I understand what is meant, I will do exactly that, and you know what, at least I have learned a lot!
Thank you again and apologies for all the questions!
As stated before, you are always welcome to ask if you are in doubt.
I will try to condense the steps you could take:
1. In case, the entire device was encrypted (not a partition):
- Format the device, quick mode, no partitioning (empty).
- Try to mount the device in VC following the steps of https://sourceforge.net/p/veracrypt/discussion/technical/thread/2ebaf9581c/?limit=25#1bfa/55a5/09d4/2ab2/c130 starting at "Then you could try again to mount the device[...]".
2. In case, one or more partitions were encrypted on the device:
- Format the device, quick mode, partitioning GPT or MBR; must be the same as it was before disaster.
- Recreate the lost partitions using quick mode and raw (none) filesystems. You have to know exactly know the positions and sizes of the lost encrypted partitions.
- Try to mount the partition in VC following the steps of https://sourceforge.net/p/veracrypt/discussion/technical/thread/2ebaf9581c/?limit=25#1bfa/55a5/09d4/2ab2/c130 starting at "Then you could try again to mount the device[...]".
That's the gist of it. Now it's up to you to decide which way to go.