Menu

Deleted MBR/GPT- how to recover encrypted partition?

nayo165
2015-12-20
2015-12-20
  • nayo165

    nayo165 - 2015-12-20

    At first, let me thank for this awesome program!

    Sadly I have a problem at the moment:

    I encrypted an usb hdd 2 tb with veracrypt (1.16 32bit). At first I formated it with one logical ntfs partition, then I encrypted the whole partition and copied a lot of data on it.
    Two days later windows xp sp3 got a bluescreen and destroyed the GPT of the drive.

    Sadly I have no backup of my data as I'm reconfiguring my whole system at the moment. Therefore I tried to make a new GPT with Linux (gpart and testdisk), but I still couldn't access the partition. At last I initialized the drive once again with windows and added a ntfs partition - exactly in the same way as the first time before the encryption.
    I hoped that this would only affect the GPT and not the encrypted data itself. Sadly VC still can't mount the drive - neither in the normal way nor with the backup header.

    Checking with WinHex the partitioned area seems to be untouched and encrypted. Only the GPT area has new data and at the end there are a few kb filled up with Zeros.

    I found this thread, where there is a talk about an update for testcrypt:
    https://sourceforge.net/p/veracrypt/discussion/general/thread/0e4ffe86/
    Does anyone know if there already exists a version which can find vc headers?

    If not, do you maybe have another idea how I can mount the partition with VC?

    Thanks in advance for the help!

     

    Last edit: nayo165 2015-12-20
  • nayo165

    nayo165 - 2015-12-20

    Found a solution:

    Initialise the hard disk and create with sfdisk a partition:
    start sector: 63
    end sector: last one
    file system: 0700 ntfs

    Once you did that you can mount the partition (used the option "use backup header if possible").
    If you can't open it in your browser, run "repair filesystem"

    Found a couple of errors but afterwards I could access and copy the files. I guess at least most are undamaged. :)

     

Log in to post a comment.

MongoDB Logo MongoDB