Can I recover a veracrypt volume that started to be be rewritten by cloning
Open source disk encryption with strong security for the Paranoid
Brought to you by:
idrassi
Menu
▾
▴
I had 2 copies of my Veracrypt HDD, One of them failed and I decided to clone the copy. I started the cloning and after 5-10 secs, I realize the disks are in the wrong order and I clone an empty disk to my Veracrypt HDD. I stop the cloning.
The Veracrypt volume is a full disk encryption without hidden volume. I know the password.
When I load this volume with Veracrypt, it loads it but I see an empty disk which Windows said that I should format to use.
I believe all my data is still there, but not accessible.
I have seen some information about such case, but I am not sure it applies to my case, and I am not sure how to start.
This data is very important for me. Can you help me to recover it?
Thanks
Eric
Since you have already data overwritten, I assume that you checked the mount option to use the volume's backup header?
As long as Windows still detects a "raw" partition, there is still hope to retrieve some data. You should mount the volume in read-only mode to prevent further damage. Then set your preferred data recovery software on the damaged, now "raw" partition. In most cases, the more information you can provide to data recovery software, like the former filesystem used, the better the odds to get data back.
Good luck!
Greets
Thanks. Yes, the first thing I did is to restore the backup header.
I used a raw recovery tool that did not see anything, so I guess that there is something that prevents Veracrypt from actually decrypting the volume. Tools that analyze the logical disk do not see any file on it (I let them analyze about 5%, they did not find anything.
I am currently cloning the disk because I don't want to further damage the disk by trying to fix it... It is a 12 Tb disk, so it is long.
I am using Windows 11, The disk is a full disk created by Veracrypt without hidden volume.
I believe there must be some partition table issue of some kind...
Data recovery software must be set on the mounted volume, not the disk directly. So, first mount the volume and point your data recovery software to the mounted volume.
That is what I did and there is no result. I try the data recovery on the mounted volume to benefit from decryption... but it does not find any file. I went 5% ahead and found nothing (it took about 1 hour, the disk is 12 Tb), thinking that my 10 secs of cloning cannot create such damage.
I see that others had similar problems and solved their issue by fixing the partition table.
Try using various data-recovery tools such as EaseUS Data Recovery, R-Studio, GetDataBack, File Scavenger, Photorec, TestDisk etc. in read only mode on the drive in order to recover as much data as possible without altering the volume.
I tried, but no result. I have analyzed 30% of the logical hard disk opened with Veracrypt and there is not a single file that is found. I believe it is decrypted but with an offset, it is why windows does not see anything and requires formatting the volume. I believe nothing can be read on the volume as is.
I have seen that some people talked about fixing the veracrypt partition table, and they were successful, but I don't know how to do it.
Windows' prompt to format the drive is most likely meant for the physical drive, not the mounted volume.
I just did some testing with a Windows 10 virtual machine and found, that current versions of Windows' Disk Management seemingly won't recognize mounted VeraCrypt volumes but only the encrypted drive itself.
I highly recommend trying again using a Linux live system. Live means it has not to be installed, so the main system remains untouched. As Linux actually recognizes and treats virtual disk devices (= mounted VC volumes) almost like physical devices, chances of getting data back is much better this way.
Furthermore, I'm currently working on a guide, how to possibly get something done in case of disaster. Until it's finished, please be patient or feel free to fuddle on your own in read only mode.
Greets
Last edit: RealTehreal 2022-01-22
I believe the data is not really decrypted because without the partition table, Veracrypt starts decoding from a wrong location, so I cannot do anything with the mounted volume.
I have read that some people calculated an offset with winhex, changed something and retrieved their file. I have seen some user called Dantz mentioned there. Can someone help me.
I am very nervous because I lost a lot of very valuable data.
Hi Eric,
The problem is the Windows filesystem information of the mounted volume has been destroyed. I am surprised that none of the data recovery tools where able to fix the filesystem information.
Out of curiosity when you created the volume, did you select NTFS format?
Hello, thanks for your help, I feel not alone,
YES, I selected NTFS and exFAT. The tool identified here and there some files of unknow nature, bot nothing useful.
I am sure most of my data is still there. In 10 secs of cloning, I could not really erase a lot on a 12 Tb disk.
Any idea?
Hello, thanks for your help, I feel not alone,
YES, I selected NTFS and exFAT. The tool identified here and there some files of unknow nature, bot nothing useful.
I am sure most of my data is still there. In 10 secs of cloning, I could not really erase a lot on a 12 Tb disk.
Any idea?
I do not understand your response since you can format a given volume using only one type of format.
Just like I said, after doing some testing, it seems like Windows has issues recognizing a damaged but mounted VC volume as an actual media drive. So I can just repeat my recommendation to at least try out data recovery on the mounted volume using a Linux live system. I also think that it should be possible to get data off the drive.
I will try again and send you some screen copies, so you understand what I see.
I mount the volume with Veracrypt. I started UFS Explore Professional Recovery and I scanned the mounted volume seen through Veracrypt mounting.
The disk is supposed to be 90% full. What I see is this:
So I suppose it does not decrypt.
When I use a product like winhex, I don't see a single string that makes sense.
I believe it does not really decrypt the volume.
The fact is that whatever I do, I cannot see anything on the disk, even though it is mounted.
Would you be so kind to provide a screenshot of VC's "Select Device..." screen while the drive is connected? This would things make more clear. Thank you.
Any news on this? I got the same problem....