VeraCrypt encrypted external USB drive no longer shows partitions
Open source disk encryption with strong security for the Paranoid
Brought to you by:
idrassi
Menu
▾
▴
I made the mistake of setting up full disk encryption on my external USB hard drive. It was working fine that way for a year until this past week when the partition no longer shows up. It's a normal drive encryption (no hidden containers). I can still type in the VeraCrypt password, and mount the drive, but I can't access it.
Here are screenshots:
Harddisk 1 no longer shows any partitions:
I can still mount it in VeraCrypt by entering the correct password:
Once mounted, I get this error:
Then I get this error:
Windows 10 Disk Management shows disk 1 as Not initialized and unallocated
Any suggestions? I am no expert and have no idea where to start. I do NOT have any recovery files or backups. My fault. Lesson learned. How can I access this disk again without too much trouble?
Last edit: Ramzi 2017-05-04
$100 reward if someone can solve this.
I think I made matters worse. I went to Diskpart and typed "Create partition primary offset=1024" -- Now it has a Partition1 which cannot be mounted at all in Veracrypt.
Anyone can help me solve this? I would offer a $200 reward if someone can solve it.
You destroy file system. The only way is recovery tools like R-Studio.
Steps:
Mount USB to drive letter (e.g. W)
Run R-Studio and select to scan drive letter W (not partition) VeraCrypt will decrypt data on fly and R-Studio will try to restore files.
The problem is that I can no longer mount the USB drive in Veracrypt anymore. I went to Diskpart and typed "Create partition primary offset=1024" -- since I did that, now when I try to mount it, I get this error:
"Operatino failed due to one or more of the following reasons:
- Incorrect password.
- Incorrect Volume PIM number.
- Incorrect PRF (hash).
- Not a valid volume."
Source MountVolume:7763"
I used to be able to mount it before I played around with Diskpart and typed that command. Is there any way to undo that so that I could mount it in Veracrypt and try R-Studio?
If this works, I would happily pay you $200. My data is worth more than that.
Main volume header is damaged. Try backup. It is at the end of the disk.
try option: mount->Mount options->Use backup header
Do you try to mount the volume using the option of the embedded backup header?
My hope is that diskpart command did not format the entire volume and only destroyed the primary VeraCrypt header but left the embedded backup header untouched at the end of the volume.
For the embedded backup header to work, the partition size must be exactly the same size as the original size.
If you can mount the partition in VeraCrypt, then likely you need to run R-Studio to attempt to recover salvageable files.
Last edit: Enigma2Illusion 2017-05-15
I selected Hardisk 1 (not partition 1) in VeraCrypt, and clicked on "use backup header" under mount options, and this time it mounted again. So now that it's mounted, I'm doing the R-Studio scan. Will report back in 4-5 hours once the scan is complete. R-Studio shows the actual drive starting at 0 Bytes up to 1.82 TB. And it shows a "Volume" starting at 1 MB and up to 1.82 TB. I did the scan on the actual drive. It's running now. If it doesn't find anything I could try the scan on the "Volume" portion too.
Last edit: Ramzi 2017-05-15
R-studio is safe. It does not modify original disk. It copies files restored only.
By the way, since this happened -- I do not want to use Veracrypt to encrypt an external drive in the future. What is the proper way to have encryption on an external USB drive without destroying the file system? It seems using an extrenal drive, maybe Veracrypt is not safe to use? Or maybe I did not set it up correctly. How should I encrypt external drive in the future without losing my data?
As always, have backups of your data due to hardware failure, software issues or user error can cause loss of access to the volume even when you are not using encryption.
Provided my opinion on the thread you created below:
https://sourceforge.net/p/veracrypt/discussion/technical/thread/ced7d060/
Last edit: Enigma2Illusion 2017-05-15
Well R-Studio scan finished. It found 24 files -- and they don't even look familiar. This drive is supposed to have at least 10,000+ files on it. I think I lost my data for good. Any other ideas?
Were you able to mount the \Device\Harddisk1\Partition1 using the backup header and scan it with R-Studio?
No. Partition1 doesn't mount, even using the backup header. Error:
"Operation failed due to one or more of the following reasons:
- Incorrect password.
- Incorrect Volume PIM number.
- Incorrect PRF (hash).
- Not a valid volume."
Source MountVolume:7763"
When this issue first started happening, Parition 1 completely disappeared. And it just showed Harddisk1 -- which I could mount. After I played with Diskpart and typed that command (see above), then Parition 1 re-appeared, but I couldn't mount anything at all. Later, once using the backup header, I can mount Harddisk1, but not Parititon1.
Last edit: Ramzi 2017-05-15
Ramzi, one special and open source tool helped me in countless occations: Try Testdisk! ;-)
I'll try it. What function should I run in Testdisk?
You've chosen partition. (not volume via mounted letter)
Post your screen with veracrypt mounted and r-studio start screen.
Screenshots:
Last edit: Ramzi 2017-05-16
select "G:" to scan.
Ok scanning G: now. The one that says 512 Bytes.
Last edit: Ramzi 2017-05-16
Correct. If r-studio cannot find files it means data position modified. Complex situation. It will require deep investigation and programming.
It only found 138 files, and all of them are *.swf files
Example:
0001.swf
0002.swf
0003.swf
I don't even know what these are. I never had these files on my drive. Is it a lost hope? Or is there any other chance to recover my files?
Any other suggestion or is it safe to assume I lost all my data?
Any other suggestion before I give up and format the drive?
Probably you have keys and password. So decryption is possible. I guess - there is sector number disorder => wrong decryption. Recovery possible but it is not easy. e.g. for me it can take several days to investigate.