Lost access to volume after Windows Error Checking.
Open source disk encryption with strong security for the Paranoid
Brought to you by:
idrassi
Menu
▾
▴
Hello. I recently lost access to a volume after running Windows Error Checking on it without thinking about it. I was wondering if there was any way I could get access back. It's an external drive that contains all of my data.
My computer has an SSD drive as my main drive, which is encrypted with veracrypt. This volume is fine, and I can boot my computer normally.
Usually when my computer boots, veracrypt with automatically decrypt my external HDD since it is added to my system favorites. This morning I noticed a bunch of issues on my computer, and a quick check showed me that my D:\ drive wasn't present. Then I remembered I had run error checking the night before (Which found no errors), so I got veracrypt and tried to mount it. Unfortunately, none of my attempts have worked.
I'm certain I have the correct password, it's the same one that opens the C:\ drive I'm using right now. I have a PIM, but I know what that is as well. I've tried the option to use the embedded backup header, but that fails as well.
Viewing my system favorites still lists the D:\ drive, but says Device Disconnected.
Update:
I'm certain I have the right password and PIM, I checked it using DcsFV. Windows lists the drive as unallocated, instead of RAW. Could I have lost partitions somehow? How could I restore them?
Last edit: Dakota Mullins 2017-06-30
You might wanna try this: Restore Volume Header. Alternatively, you ideally have made a backup of the volume header residing elsewhere as a file.
If the mounting in VeraCrypt works, but no partition shows up in Windows, TestDisk may be able to recover a lost partition. Otherwise, you may need to try file-oriented data recovery (TestDisk has such features, otherwise see alternatives on linked page).
The recovery strategy will also depend on whether you encrypted the whole drive or just a partition. VeraCrypt warns against encrypting whole drives, because Windows or other software may try to be "intelligent" and overwrite small, but important areas of the outer encrypted bytes.
A hex-editor that can view drives and partitions rawly can also be a relevant tool to assess the situation, e.g., to see whether some area at the beginning has been overwritten (VeraCrypt's encrypted data looks like random bytes, overwritten data will not look random). The hex-editor HxD can do that to some extent (drive numbers are +1 in that app toward the Windows Disk Management tool).
BTW: "Veracrypt encrypts in XTS mode, which means that data corruption in one block only affects that block." (source) And that data may, besides the volume header, be important data as the encrypted file system header to my understanding. But, at least, the following encrypted data does not depend on the integrity of the encrypted data before, according to the quote; so, data recovery after successful mounting may be possible, even if there's no browsable partition, yet.