Data Recovery- mounting former system hdd as external hdd to recover data
Open source disk encryption with strong security for the Paranoid
Brought to you by:
idrassi
Menu
▾
▴
My computer quit working after it fell. My system hdd was fully encrypted. I have removed the hdd and attached it to a second computer via USB as an external drive. However, Windows wants me to formate the disk. Veracrypt will not recognize it for me to mount it. Have I lost my data or is there a way to recover data from when a compter fails?
Thanks.
First of all don't do anything drastic. Your data may still be savable. Don't do anything that writes to that drive. If you can, create a full disk image of it before you do anything else.
Tell me the exact steps you are going through where VeraCrypt is failing from the point where you plug it into your computer on, including all messages you get, and exactly when you get them.
Kurt,
Thanks for any help that you can give me. Here's what I've got:
It is a SATA drive that came out of a Win 7 64-bit laptop. It only had the one main partition which was encrypted with "encrypt system partition". (Forgive me for not being highly computer-savy. My experience is only in formating and installing Windows. Most of the acronyms and all are beyond my experience.)
The computer fell off of the night stand, damaging the case and preventing the power jack from working, so no power. Since it was due for a replacement, I bought a newer Windows 10 laptop. I also bought an external SATA drive case to allow me to attach the old hard drive externally in hopes of reclaiming some files.
Here's what I've done:
Looked to see if anyone else has done this, without finding good guidance.
Attached the SATA drive externally to my USB port.
Here's what happens:
A window states "You need to formate the disk in drive E: before you can use it. Do you want to format it?" (I've canelled that message.)
A window states "E:\ is not accessible. The volume does not contain a recognized file system. Please make sue that all required file system drivers are loaded and that the volume is not corrupted." (Closing that window causes File Explorer to close as well.)
Next:
I pulled up Veracrypt since one post mentioned that I should use the "auto-mount device."
Whether that is right or wrong, Drive E: and F: both are missing from the list of drives on VeraCrypt as long as the SATA is connected.
I am able to use the hardware manager to disconnect the SATA which is assigned as Drives E & F. Once it is disconnected from the computer, Those drive designators do appear on VeryaCrypt list.
Incidentally, with the drive attached, File Explorer does show them, but selecting them results in the same message to format.
I appreciate any help anyone can give me. Thanks again.
Coyote
From: Kurt Fitzner kfitzner@users.sourceforge.net
Sent: Thursday, July 4, 2019 5:24 PM
To: [veracrypt:discussion]
Subject: [veracrypt:discussion] Data Recovery- mounting former system hdd as external hdd to recover data
First of all don't do anything drastic. Your data may still be savable. Don't do anything that writes to that drive. If you can, create a full disk image of it before you do anything else.
Tell me the exact steps you are going through where VeraCrypt is failing from the point where you plug it into your computer on, including all messages you get, and exactly when you get them.
Data Recovery- mounting former system hdd as external hdd to recover datahttps://sourceforge.net/p/veracrypt/discussion/technical/thread/869958770c/?limit=25#f2a5
Sent from sourceforge.net because you indicated interest in https://sourceforge.net/p/veracrypt/discussion/technical/
To unsubscribe from further messages, please visit https://sourceforge.net/auth/subscriptions/
Kurt,
Thanks for any help that you can give me. Here's what I've got:
It is a SATA drive that came out of a Win 7 64-bit laptop. It only had the one main partition which was encrypted with "encrypt system partition". (Forgive me for not being highly computer-savy. My experience is only in formating and installing Windows. Mostof the acronyms and all are beyond my experience.)
The computer fell off of the night stand, damaging the case and preventing the power jack from working, so no power. Since it was due for a replacement, I bought a newer Windows 10 laptop. I also bought an external SATA drive case to allow me to attach theold hard drive externally in hopes of reclaiming some files.
Here's what I've done:
Looked to see if anyone else has done this, without finding good guidance.
Attached the SATA drive externally to my USB port.
Here's what happens:
A window states "You need to formate the disk in drive E: before you can use it. Do you want to format it?" (I've canelled that message.)
A window states "E:\ is not accessible. The volume does not contain a recognized file system. Please make sue that all required file system drivers are loaded and that the volume is not corrupted." (Closing that window causes File Explorer to close as well.)
Next:
I pulled up Veracrypt since one post mentioned that I should use the "auto-mount device."
Whether that is right or wrong, Drive E: and F: both are missing from the list of drives on VeraCrypt as long as the SATA is connected.
I am able to use the hardware manager to disconnect the SATA which is assigned as Drives E & F. Once it is disconnected from the computer, Those drive designators do appear on VeryaCrypt list.
Incidentally, with the drive attached, File Explorer does show them, but selecting them results in the same message to format.
I appreciate any help anyone can give me. Thanks again.
Coyote
Ok, what your describing sounds normal so far. First I'll describe what's happening and why, and then how to get at your data.
When you connect the drive, Windows is seeing the partitions but when it goes to try and look at the filesystem formatting it just looks like random garbage because it's encrypted. Windows doesn't understand the encryption, so it's saying that it needs to be formatted.
Windows doesn't think it's formatted, but it is still attaching a drive letter to the partition. When it attaches the drive letter, that drive letter becomes unavailable to VeraCrypt, which is why that drive letter is disappearing off the list. That list is just a list of possible places where you can attach an encrypted drive. Windows is taking that drive letter so VeraCrypt can't use it. This is normal.
Here is what you need to do:
1. Attach the drive.
2. Click "no" or "cancel" on anything Windows asks you about formatting it
3. Bring up VeraCrypt
4. Click on an open drive letter. Doesn't matter which one.
5. Click on "Select Device..."
6. You will see a list of partitions. The one you want is probably the largest one on Harddisk 1. It will probably also have a drive letter beside it - the drive letter that Windows assigned to what it thinks is the "unformatted" partition. Click on that one then OK.
7. Click "Mount"
8. Click "Mount Options..."
9. Select "Mount volume as read only" (this is just for safety so that nothing gets written) and also select "Mount partition using system encryption without pre-boot authentication". This last one just tells VeraCrypt that it's not a normal partition, that it's a system encryped partition. Now click OK.
10. If you have been using a PIM click "Use PIM". Otherwise leave it. Now type in your password and PIM if required and click OK.
VeraCrypt should now mount the drive and you should be able to access all the data from the drive letter you selected in step 4.
Let me know how it goes. Good luck!
That Did It!
Please receive my heart-felt thanks. I'm copying over my important files now, much elated and relieved thanks to you and your selfless assistance.
Thanks again.
Ok, that Did get me access to the drive and the root directory where I had some files. However, it didn't give me access to my files within my user account. "you do not have permission to access this folder." I was not able to change the access settings under Security because all of the files seem to be write-protected. I guess that means it cannot "write" new security permissions to the directory.
Can I decrypt the disk/ folder now? Would that give me the ability to access or at least change the security permissions?
Thanks again.
The reason you can't change the permissions is that I suggested (in step 9) that you mount the VeraCrypt partition as read-only. This was to protect against inadvertant damage or changes until you could see if it was going to work. You can change this and mount it writeable and remove that limitation if you need to. You don't need to decrypt it to change the permissions.
Keep in mind if you intend to ever boot from this device again that messing with the user permissions for the user folders might make that difficult. If you don't intend to boot from it again and just need the data off it before you reformat it for reuse as a data drive or something, then don't worry about this.
I don't think VeraCrypt can decrypt a system-encryption drive if you haven't booted from that drive (ie: a sysrtem encryption drive mounted the way you mounted this one as "without preboot authentication").
(EDIT: Late here heading to bed - will check for messages in the morning before I head to work in case you have more questions)
Last edit: Kurt Fitzner 2019-07-08
Thanks again Kurt. I'll try it now. Hopefully, you'll wake up to a message of success and appreciation again.
Kurt,
I got it all done thanks to your gracious help. I hope you have a good day and know that you've really helped a fella out of a jam. Thanks, Coyote