VeraCrypt volume mounts successfully, but mounted drive is empty after 9-hour encryption process

[iron1x]

Title: VeraCrypt volume mounts successfully, but mounted drive is empty after 9-hour encryption process

Hello everyone,

I am looking for advice regarding a VeraCrypt data recovery problem.

I used VeraCrypt on a SanDisk 1 TB SSD. The drive originally contained important data.

In VeraCrypt I selected the option to encrypt a partition/drive, selected the SanDisk SSD, chose a standard VeraCrypt volume, and the process ran for approximately 9 hours. It completed without any error message.

Now VeraCrypt can still mount the volume successfully. The password is accepted. VeraCrypt shows the volume as normal, around 931 GB, AES, and the volume properties show that an embedded backup header exists.

However, when the volume is mounted as drive B:, the drive opens but appears empty. The original data is not visible.

I have tried several recovery tools:

• TestDisk: did not find a useful original file system.
• DMDE on the mounted VeraCrypt volume B:: detects FAT32, but only shows System Volume Information and many MSI/tmp folders.
• DMDE raw scan: only a few raw signatures, no clear video/photo recovery so far.
• R-Studio scan on the SanDisk: no clear old FAT/exFAT/NTFS structure found, mostly raw signatures and false-looking file system detections.
• PhotoRec was also tried without useful results.

I have not formatted the drive after noticing the problem and have avoided repair/write operations such as CHKDSK or header restore.

Additional context: the data originally existed years ago on a Crucial 2 TB SSD and was later copied to the SanDisk SSD. The original folder on the Crucial SSD was deleted years ago. I am currently scanning the Crucial SSD as well, but since it is an SSD, I understand that TRIM may make recovery unlikely.

My questions:

1. If VeraCrypt mounts successfully and the password is accepted, does that mean the encryption layer is definitely intact?
2. Why would the mounted VeraCrypt volume show an apparently empty FAT32 file system after a completed encryption process?
3. Could this indicate that the file system inside the VeraCrypt volume was overwritten or newly initialized?
4. Is there any VeraCrypt-specific recovery step I should try before giving up?
5. Would restoring the embedded backup header make sense in this situation, or would that be risky since the volume already mounts?
6. Has anyone seen a case where VeraCrypt mounted normally but the expected files were missing after a completed drive/partition encryption?

Any advice would be greatly appreciated.

[Enigma2Illusion]

Are you mounting and accessing the mounted volume using the same Windows account that could access the files before encryption?

Have you tried using the Windows administrator account/privileges when mount and accessing the mounted volume?

This may be an Windows permission and/or ownership problem since the reinstall of Windows OS could result in different SIDs for the user accounts.

---

During the encryption of partition process, on the Volume Creation Mode screen there are two options:

• Create encrypted volume and format <- This will overwrite existing data
• Encrypt partition in place <- This will preserve the data while encrypting the partition.

.
Did you encrypt the partition in-place (preserving your data) or did you create an encrypted volume and format it which destroys existing data?

In my test on Windows 10 using the 1.26.29 version, selecting a disk partition, then in the Volume Creation Mode screen had the "Encrypt partition in place" already selected.

[iron1x]

Thank you for your reply.

I encrypted the correct partition. I did not accidentally select the wrong drive.

As far as I remember, I selected "Encrypt partition in place", because the goal was to preserve the existing data while encrypting. The encryption process ran for many hours (around 9 hours), which would also be consistent with an in-place encryption of a large amount of existing data.

The drive is a 1 TB SanDisk SSD. VeraCrypt can mount the volume successfully with my password and shows a valid AES/XTS volume. The mounted volume appears as a normal VeraCrypt volume, but Windows Explorer shows it as empty.

I have already tried mounting and accessing it with administrator privileges. The result is the same: the volume mounts correctly, but no files or folders are visible.

I also checked the mounted volume properties in VeraCrypt and the header appears valid. VeraCrypt reports that an embedded backup header is present as well.

Since the volume mounts successfully, I am wondering whether this could be a damaged or overwritten filesystem inside the encrypted partition rather than a VeraCrypt header problem.

Is there any way to determine whether the NTFS/exFAT filesystem inside the mounted volume still exists, or whether the data area was overwritten at some point?

Any suggestions would be greatly appreciated.

[Enigma2Illusion]

If the filesystem was missing or damaged, I would have thought the data recovery tools would have recognized that issue.

In the VeraCrypt GUI with the volume mounted, right click on the mounted volume and select Check Filesystem. This is a read-only check that completes quickly and will provide the type of filesystem at the top.

[iron1x]

Thank you for the suggestion.

I ran Check Filesystem from the VeraCrypt GUI. It reports that the filesystem is FAT32, and CHKDSK completed successfully with no errors found.

However, the mounted volume is almost completely empty. Windows reports only one small file and a few hidden system files, while approximately 976 GB are free.

I also scanned the physical SSD with R-Studio and DMDE. Neither tool found a previous FAT32 filesystem, deleted directories, or any recoverable files corresponding to the original data.

Does this suggest that the original filesystem was overwritten, or is there anything else you would recommend checking before I give up?

[Enigma2Illusion]

Based on the VeraCrypt using Windows (chkdsk) Check Filesystem results, the VeraCrypt volume is not damaged.

The key information is that the volume is FAT32 instead of NTFS for encryption in-place option.

VeraCrypt only allows encryption in-place on NTFS filesystem and will automatically select the "Create encrypted volume and format" option when the source disk is also formatted FAT32.

If you attempt to select the option for "Encrypt partition in place" and click the Next button, you will get an error along with explanation of remediation procedures.

I just tested encryption in-place option using the 1.26.29 version on my USB thumbdrive that is FAT32 and got the error.

The only encryption in-place filesystem allowed is NTFS.

https://veracrypt.jp/en/FAQ.html

Can I encrypt a partition/drive without losing the data currently stored on it?

Yes, but the following conditions must be met:

If you want to encrypt an entire system drive (which may contain multiple partitions) or a system partition (in other words, if you want to encrypt a drive or partition where Windows is installed), you can do so provided that you use Windows XP or a later version of Windows (such as Windows 7) (select 'System' > 'Encrypt System Partition/Drive' and then follow the instructions in the wizard).

If you want to encrypt a non-system partition in place, you can do so provided that it contains an NTFS filesystem and that you use Windows Vista or a later version of Windows (for example, Windows 7) (click 'Create Volume' > 'Encrypt a non-system partition' > 'Standard volume' > 'Select Device' > 'Encrypt partition in place' and then follow the instructions in the wizard).

Hence, I believe you used the "Create encrypted volume and format" option which overwrote all your existing data.

[iron1x]

Thank you for your detailed explanation.

That does seem to match all my observations.

One question remains: if VeraCrypt created a new FAT32 filesystem and formatted the partition, would you expect data recovery tools like R-Studio and DMDE to find remnants of the previous filesystem or deleted files on an SSD?

I performed full sector scans of the SSD, but neither tool found the original directory structure or recoverable files. Does that indicate that the format plus SSD/TRIM likely made recovery impossible?

[Enigma2Illusion]

One question remains: if VeraCrypt created a new FAT32 filesystem and formatted the partition, would you expect data recovery tools like R-Studio and DMDE to find remnants of the previous filesystem or deleted files on an SSD?

No since the default is to overwrite the entire partition including unused locations.

.

I performed full sector scans of the SSD, but neither tool found the original directory structure or recoverable files. Does that indicate that the format plus SSD/TRIM likely made recovery impossible?

Yes. No recovery.