Corruption Problem Veracrypt

[trhfg]

So, i have been battling a corruption issue for 7 months. Reinstalled windows. Nothing worked.

After many many hours of troubleshooting i came up to the conclusion that veracrypt corrupts files (not all) let's say 1/100'000 file will have the wrong hash after writing data to the drives.

I have made a backup script that copies files and checks for the hash (source and destination), copies fine and hashes match. I run the script again and the hash changed.

This problem does NOT happen on bitlocker. I have tried many different drives.

Any ideas ?

Corrupted files look like 2/3rd of an image greyed out or video pixelisation/corruption.

the files are NOT corrupted on the source drive but become corrupted on the veracrypt drive/container.

File systems are ok. Drive Caching is OFF.

It happens with explorer copy/paste, robocopy, any other kinds of copy methods. I made the script to find where the problem was and it's 100% a veracrypt problem. No issues without encryption or with bitlocker.

I also tried multiple different veracrypt settings like mount as removable media etc

Version : 1.26.24

[Enigma2Illusion]

Can you post your scripts?

I have made a backup script that copies files and checks for the hash (source and destination), copies fine and hashes match. I run the script again and the hash changed.

Are you stating that the initial copy from source followed by initial hash checking match the destination of the VeraCrypt volume is successful with no anomalies?

But if you run your hash script again, then there is a mismatch on certain files.

Are the mismatched files always the same file type like jpg, etc?

[trhfg]

Exactly, first pass = fine, second pass after unmouting or a few minutes / hours later = hash mismatch

Here is my script. Keep in mind my dataset is over 700GB of copied data and about 1/100'000 has a mismatch, but its annoying enough when you work with Machine learning models that needs to be perfect.

The problem appears to be mostly, jpg,png,mp4 and also .pth model files (2/3rd of the image greyed out) also video corruption/pixelisation

I have added extra info on the original post

Due to this problem i am forced to use ''mode 2'' on the script to see if anything i attempt worked (to stop the corrutpion) and it takes forever but always points to an issue with veracrypt drives since running the exact script on unencrypted or bitlocker drives works fine

Here is the script (ps1)

$SRC = "source"
$DST = "destination"
$MAX_RETRIES = 3

Write-Host "Select mode:"
Write-Host "1 = Skip existing (fast, but verify new copies)"
Write-Host "2 = Always verify + overwrite mismatches (safe)"
$mode = Read-Host "Enter 1 or 2"

$useHashCompare = $false
if ($mode -eq "2") {
$useHashCompare = $true
Write-Host "Mode: SAFE (hash compare + overwrite)" -ForegroundColor Cyan
} else {
Write-Host "Mode: FAST SKIP (only copy missing + verify new files)" -ForegroundColor Cyan
}

$total = 0
$copied = 0
$skipped = 0
$failed = 0
$totalRetries = 0
$startTime = Get-Date

$failures = @()
$correctedMismatches = @()

Get-ChildItem -Path $SRC -Recurse -File | ForEach-Object {

$srcFile = $_.FullName
$relPath = $srcFile.Substring($SRC.Length).TrimStart('\')
$dstFile = Join-Path $DST $relPath

$total++

$exists = Test-Path $dstFile
$mismatchDetected = $false

# =========================
# MODE 1: FAST SKIP LOGIC
# =========================
if (-not $useHashCompare -and $exists) {
    Write-Host "SKIP (exists): $relPath"
    $skipped++
    return
}

# =========================
# MODE 2: SAFE HASH CHECK
# =========================
if ($useHashCompare -and $exists) {
    try {
        $srcHash = (Get-FileHash $srcFile -Algorithm SHA256).Hash
        $dstHash = (Get-FileHash $dstFile -Algorithm SHA256).Hash

        if ($srcHash -eq $dstHash) {
            Write-Host "[MATCH - SKIP] $relPath" -ForegroundColor Green
            $skipped++
            return
        } else {
            Write-Host "[MISMATCH - OVERWRITE] $relPath" -ForegroundColor Red
            $mismatchDetected = $true
        }
    } catch {
        Write-Host "[HASH ERROR - WILL COPY] $relPath" -ForegroundColor Yellow
    }
}

# Ensure folder exists
$dstDir = Split-Path $dstFile
if (!(Test-Path $dstDir)) {
    New-Item -ItemType Directory -Path $dstDir -Force | Out-Null
}

# =========================
# COPY + VERIFY (BOTH MODES)
# =========================
$retry = 0
$success = $false
$failReason = ""

while ($retry -lt $MAX_RETRIES) {

    Write-Host "Copying: $relPath (Attempt $($retry+1))" -ForegroundColor Yellow

    try {
        Copy-Item $srcFile -Destination $dstFile -Force -ErrorAction Stop
    } catch {
        $failReason = "Copy error"
        $retry++
        $totalRetries++
        continue
    }

    if (!(Test-Path $dstFile)) {
        $failReason = "Missing after copy"
        $retry++
        $totalRetries++
        continue
    }

    # ALWAYS VERIFY HASH AFTER COPY
    try {
        $srcHash = (Get-FileHash $srcFile -Algorithm SHA256).Hash
        $dstHash = (Get-FileHash $dstFile -Algorithm SHA256).Hash
    } catch {
        $failReason = "Hash error"
        $retry++
        $totalRetries++
        continue
    }

    if ($srcHash -eq $dstHash) {

        if ($mismatchDetected) {
            Write-Host "[MISMATCH FIXED] $relPath" -ForegroundColor Cyan

            $correctedMismatches += [PSCustomObject]@{
                File   = $relPath
                Status = "Mismatch corrected successfully"
            }
        } else {
            Write-Host "[MATCH - COPIED] $relPath" -ForegroundColor Green
        }

        $copied++
        $success = $true
        break

    } else {

        Write-Host "[MISMATCH - RETRY $($retry+1)] $relPath" -ForegroundColor Red

        $failReason = "Hash mismatch"
        $retry++
        $totalRetries++
    }
}

if (-not $success) {

    $failed++

    if ($failReason -eq "") {
        $failReason = "Max retries reached"
    }

    $failures += [PSCustomObject]@{
        File   = $relPath
        Reason = $failReason
    }

    Write-Host "FAILED: $relPath ($failReason)" -ForegroundColor Red
}

}

=========================

SUMMARY

=========================

$duration = (Get-Date) - $startTime

Write-Host ""
Write-Host "==================== SUMMARY ===================="
Write-Host "Total files : $total"
Write-Host "Copied : $copied"
Write-Host "Skipped : $skipped"
Write-Host "Failed : $failed"
Write-Host "Retries : $totalRetries"
Write-Host "Fixed mismatches : $($correctedMismatches.Count)"
Write-Host "Duration : $duration"
Write-Host "================================================="

=========================

FAILED FILES

=========================

Write-Host ""
Write-Host "================ FAILED FILES ================" -ForegroundColor Red

if ($failures.Count -eq 0) {
Write-Host "None 🎉" -ForegroundColor Green
} else {
foreach ($f in $failures) {
Write-Host $f.File -ForegroundColor Red
Write-Host " Reason: $($f.Reason)" -ForegroundColor DarkRed
}
}

Write-Host "==============================================="

=========================

CORRECTED MISMATCHES

=========================

Write-Host ""
Write-Host "=========== CORRECTED MISMATCHES ===========" -ForegroundColor Cyan

if ($correctedMismatches.Count -eq 0) {
Write-Host "None" -ForegroundColor Green
} else {
foreach ($m in $correctedMismatches) {
Write-Host $m.File -ForegroundColor Yellow
Write-Host " Status: $($m.Status)" -ForegroundColor DarkYellow
}
}

Write-Host "============================================"

[Enigma2Illusion]

Which version and patch level of Windows OS? (winver command)

Are you properly unmounting your VeraCrypt volume using the VeraCrypt GUI or VeraCrypt hotkey?

EDIT
Are you having to Force Unmount due to files or directories still are in use?

https://veracrypt.jp/en/Normal%20Unmount%20vs%20Force%20Unmount.html

END EDIT

Are you using the VeraCrypt options in Preferences > Auto-Unmount? Post screenshot.

Using Windows Administrator account, have you run chkdsk on the source and destination drives?

Have you run chkdsk via the VeraCrypt GUI on the mounted VeraCrypt volume both before and after the mismatches?

Did you confirm that the source files are not corrupted by opening them when discovering the hash mismatches?

Are you using Windows Defender or provide name the third party AV/Malware program?

Have you checked your AV/Malware provider's logs for corrective action taken on scans?

Do you use any software program that scans for certain file types to index them into the software's library or that may modify the file metadata?

[trhfg]

here is where we are with claude

System shows intermittent silent file corruption only on external drives mounted through VeraCrypt. Files copy successfully and SHA256 hashes verify correctly immediately after copy, but later some files mutate and fail hash checks. Re-copy fixes the files immediately.

What was ruled out:

• Multiple external drives tested
• Multiple USB cables tested
• Different USB ports and PCIe USB card tested
• H2testw passed (~400GB tested)
• Internal NVMe/C: drive never corrupts
• BitLocker on same external drives does NOT corrupt

• RAM tested:

• 192GB configuration

• lowered to 4200 MT/s
• XMP disabled
• OCCT Memory Large/Extreme/Core Cycling passed
• Windows Memory Diagnostic passed
• Write caching changes did not help

Current strongest suspicion:

• VeraCrypt-specific issue involving USB/UASP storage stack, caching, or power-state transitions
• Possible interaction between VeraCrypt filter driver and UASP/ASPM/USB selective suspend behavior
• Corruption appears post-write/post-verification during idle periods, not during active copy

[trhfg]

version 25H2 OSbuild 26200.8246

yes properly unmouting using the GUI.

No force unmounts

No auto unmount.

Chkdsk is FINE from veracrypt and also windows

Source are NOT corrupted, as shown when copying to unencrypted or bitlocker drive

I set an exception on defender for ALL my drives a long time ago while trying to figure out the problem. So all my drives are excluded from defender. (external drives)

No malware scans

I have file indexing and thumbnails caching disabled.

I am truly lost, i have tried literally everything assisted by claude for months and nothing has ever fixed my issue besides switching to bitlocker (which i dont trust as much)

I even bought a PCIE usb card expension thinking the my usb ports were bad, but having it work with bitlocker makes this a non issue

[Enigma2Illusion]

Something unique about your software and hardware that is causing the problem.

You mentioned external drive.

What brand and model?

Some brands or models have built-in encryption that may be causing this problem.

My Western Digital has encryption that I have disabled via their software utility to prevent any conflicts with third party encryption.

[trhfg]

The don't have any encryption, WD Black drives 2 + 6 tb, and also a 24tb Ultrastar datacenter drive.

Also tried USB drives and SD cards same issues

Also happens on my SECOND samsung SSD

[trhfg]

FriendlyName : Samsung SSD 870 EVO 4TB
Manufacturer :
Model : Samsung SSD 870 EVO 4TB
SerialNumber : Moderator Removed
Size : 4000787030016

FriendlyName : Samsung SSD 990 PRO 4TB
Manufacturer :
Model : Samsung SSD 990 PRO 4TB
SerialNumber : Moderator Removed
Size : 4000787030016

FriendlyName : WDC WD40EZAX-00C8UB0
Manufacturer :
Model : WDC WD40EZAX-00C8UB0
SerialNumber : Moderator Removed
Size : 4000787030016

FriendlyName : WD Game Drive
Manufacturer : WD
Model : Game Drive
SerialNumber : Moderator Removed
Size : 2000365289472

FriendlyName : WDC WD40EZAX-00C8UB0
Manufacturer :
Model : WDC WD40EZAX-00C8UB0
SerialNumber : Moderator Removed
Size : 4000787030016

PS C:\WINDOWS\system32>

MOD EDIT: Redacted Serial Numbers

[Enigma2Illusion]

After the initial source to VeraCrypt destination copy with hash values between source and destination matching, have you left the volume mounted and while the volume is still mounted after the successful copy a few hours later, checked again that the hash values between source and destination have not been changed?

Also, run the hash script prior to manually via VeraCrypt GUI unmounting the volume.

Check each time you mount and unmount the volume.

The goal is to determine what is happening on your system, perhaps a background process of the OS or other third party software that is making the data changes to the mounted VeraCrypt volume.

VeraCrypt is not going to be performing any changes to the volume unless some other OS or other software commands a data change to the file(s).

[trhfg]

I have tried to run the script immediatly after copy, also after leaving the drive mounted a few hours, unmounting the drive for 5 minutes and days too.

Always the same problem. It's truly a mistery what's going on. I believe it was a hardware problem, but bitlocker having no issues on the same drives would make no sense.

I do not have any programs that should read anything or modify any files in these drives while IDLE.

If you want me to run some commands on my system to give you my settings please give me some i will give you the results

I have nothing but a normal debloated windows 11 pro build with bitlocker on the main windows drive.

[Enigma2Illusion]

Just to cover other possibilities, have you run the hash script back-to-back to make sure the script is not the culprit?

[trhfg]

yes back to back many times. like i said i've been troubleshooting since last year and finally decided to come here out of desperation

I've tried normal copy, robocopy, backup software, and scripts

[Enigma2Illusion]

Sorry if my ideas seem unhelpful, but I am thinking outside the box ideas.

I remembered that many years ago that Western Digital drives have an internal setting for drive sleep mode after N minutes of no drive activity.

If I was rebooting or shutting down the PC, I would sometimes corrupt some data in the mounted VeraCrypt volume due to the drive was not able to get online quick enough to Auto-Unmount (Preferences > Auto-Unmount > Entering power saving mode and Force auto-unmount even if volume contains open files or directories) before the PC shutdown.

Depending on which model WD drive, you can use their Western Digital's Drive Utilities tool to turn-off the built-in sleep timer.

Your Windows OS may be allowing USB connected devices to power down. Google search for Windows "USB selective suspend setting" and set to Disable.

Also, be sure that Fast Startup and Hibernate are disabled in Windows OS.

[trhfg]

Yeah all you are thinking ive also done with Claude so far, preventing USB drives from going to sleep etc etc nothing works. I always properly manually unmount my drives

[风之暇想]

I think it is a problem with the script or disk cache. Please try verifying after the copy is complete and the disk has fully written, or use another verification software for testing.

[trhfg]

Nope. Like my post says every ways i copy will always lead to corruption. Without write caching.

[风之暇想]

It is recommended to use the Windows Memory Diagnostic tool to check for memory issues.

[trhfg]

I have already done all the memory tests, read my previous posts

[Enigma2Illusion]

Were you able to disable the Western Digital internal sleep mode for your external drives?

Always check for hash matching without copying which your script currently does not perform:

Write-Host "1 = Skip existing (fast, but verify new copies)"
Write-Host "2 = Always verify + overwrite mismatches (safe)"
$mode = Read-Host "Enter 1 or 2"

You can try a program called FreeFileSync set to Update mode for Synchronize.

Scan for file changes before volume unmount.

When the corruption occurs, determine if any processes are using the volume.

https://sourceforge.net/p/veracrypt/discussion/technical/thread/e31656dc7c/?limit=25#caa0

Does the user community know of a program that can monitor a mounted volume for processes accessing the volume?

[trhfg]

I tried that with procmon and absolutely nothing is touching the drives. And also tried freefilesync. was the same thing

[Enigma2Illusion]

Per the link I provided in my post above, I would also try Handle.

When the file gets corrupted, have you checked the file properties to see if the Modified & Accessed dates have changed?

The Accessed date will change anytime something accesses the file.
NOTE: When you right click on a file to check its properties will cause the Accessed date to change to current time if you check it again.

The Modified date will change anytime something writes to the file.

[trhfg]

Nothing appears to access them via procmon. and the dates match the copy date

[Enigma2Illusion]

Promon and Handle are two different MS Utilities. Have you tried Handle?

[Enigma2Illusion]

and the dates match the copy date

This is very confounding that the file is corrupted without any date modifications.

EDIT:
What about the Modified & Accessed times being different from the original?
END EDIT

Is your BIOS up-to-date and all OS and third-party software drivers?

EDIT 2:
Is all your drives updated to their latest firmware?
END EDIT 2