Accidentally initialized mounted TC drive - what happens next ?
Open source disk encryption with strong security for the Paranoid
Brought to you by:
idrassi
Menu
▾
▴
Instead of a wiped USB flash drive, 3TB drive was initialized in Computer management panel. Didn't double check, and just hit enter.
Drive was already and still is mounted in Veracrypt (Truecrypt partition) and I am currently making a backup of inside data onto a spare medium.
I already have a slightly less organised, but basically same copy of data on another drive.
What happened is; disk initialization "So logical disk manager can access it" and as far as I see, as MBR
Non messed up disk shows as "Non Initialized" and part as "Unallocated"
Messed up disk identifies as "Basic" and there are two blank parts (non-partitions), of part 1 of 2TB limit of filesystem and another of the rest of about 800GB. No partitions have been made, volume is just split
Q1: Do I correctly assume that by unmounting the drive, volume will be lost and become unmountable ?
Q2: Can I make a backup of a partition header and data, while the volume is mounted or will the volume unmount ?
What will the backup actually create, backup of working set or of corrupted set or backup from memory of what is mounted ?
Q3: What is the integrity of data I am now copying. Everything is still there, did it get silently corrupted ?
Q4: If things are mountable: Can I use the volume or will everything get corrupted, unreadable etc. with continued use. Preferably, I finish the sorting work I did on it and then copy everything onto other drive.
Favourably, I don't need another 3 days to wipe and redo encryption on the drive if it just continues to work.
TLDR; Messed up, have backup, looking for options
Last edit: Adrian 2016-03-23
You should be able to mount the volume again using the embedded backup header. However, I would not dismount the volume until you have completed copying your data to the other drive.
No. You have to dismount the volume in order to make an external file backup of the header. Since the primary header is likely damaged, it would not be advisable to make an external backup of the header at this point.
If you only initialized the volume, then only the primary VeraCrypt header should be impacted.
You will have to determine if there were files that are incomplete by opening them and compare existing files on your backup with your copies made to the other HDD.
Once you have copied the data to the other HDD, you can dismount the volume and attempt to restore the primary header using the embedded backup header. Click on Volume Tools button.
After successful recovery of the primary header, I would mount the volume and perform a Repair Filesystem within the VeraCrypt GUI. You can right-click on the mounted volume within the VeraCrypt GUI and select the option.
If no errors are reported or all issues resolved, you can continue to use the volume.
Otherwise, recreate the volume. However, since you previously encrypted the drive or partition and if you use the same size parameters, you can select Quick Format if you are not concerned that someone has managed to get your old encryption key to attempt brute attacking the volume or they have the password to retrieve the areas of the disk still encrypted with the old key.
I have now dismounted drive.
Mounting without using backup header throws error, Invalid volume
Mounting with using backup header works.
Application warns me of a neccessary dismount, I didn't want to prod it before and I asked rather than sacrificed, you were correct.
Ok, no backup of current header. It seems to have gotten overwritten.
Things look ok. I have checked only a small portion of files, it appears file structure and integrity is ok. Things open and work. I honestly have no idea how data corruption goes within encrypted volume or if it is even noticable until it is too late. I have had my share of bad experience with lost data on dying SSD and HDD, so far, none of those effects are noticable (dissapearing files, partially corrupted jpg, empty text files, jerky and skippy movies, slow reads and writes, defrag further corrupts files) .
I will keep an older backup around for quite some time, just in case.
Going to MD5 check files when I am at it again.
*Restoring TrueCrypt headers in veracrypt 1.16 does not work.* Truecrypt option is greyed out.
I used truecrypt install to do it. Works flawlessly.
I should update veracrypt too. I assume it has been resolved in newer versions.
*Warning of: Old password and keyfiles from when volume was created may be used should be more noticable, not until you already restored it. Dangerous stuff.*
Didn't know about that. Apparently it starts chkdisk. No problems found.
Disk is still split, but it works. All I need for now. More of an astethical problem.
Hopefully, no wipe was created where it was split other than in the HDD header section or FAT table.
I will blank the HDD with DBAN. Will take a couple of days but it is more secure.
Recovery is easier and safer on blanked drives.
After that, I will use veracrypt's format option.
Will go to the store for a new HDD, gonna save it in a friends place in case of future troubles.Having 2 backups is almost mandatory.
TLDR; Works
FYI: VeraCrypt provides you with wipe options which is secure.
Last edit: Enigma2Illusion 2016-03-23
Results:
Copies are ok. There is some minor data loss. May be related to rights or actual filesystem troubles. Nothing serious for now and it is manageble.
I will try the wipe tonight. Thank you for assistance.
Problem that I have noticed:
External drive doesn't mount at all if it is plugged as an internal one. Might do something with offset tho I have no idea. Neither does it work with backup header. Something is off as it works just fine back in external case.