Even after full drive decryption, the partition looks encrypted and i cannot...
Open source disk encryption with strong security for the Paranoid
Brought to you by:
idrassi
Menu
▾
▴
I decided to install a new operating system, so i had to decrypt the disk via the recovery USB. I decrypted the drive as tought by the tutorials and everything looked good. When i rebooted i saw the Windows boot error, so i thought that the decryption, in some way, damaged the boot files. Spending all the day trying to understand what was happened, i realized these things:
1) The hard drive looks still encrypted, because using WinPE with a data recovery software, i saw that the 870GB partition is full of huge SWF files, but not data, so i realized that these are the data stil encrypted. I tryied the decryption twice, and twice the USB rescue said "DONE. Not ready", i don't know what "not ready" stays for.
2) Looks like there's no way to open the partition, because i tried every way to open the device: using the header backup, using the "mount without pre-boot authentication", trying to reset the volume header three times, trying to permanent decrypt the hard drive several times, trying to mount the device read-only... Nothing of these ways helped.
3) I managed to MOUNT (but not open) the partition with the "mount without pre-boot authentication" option, but if i try to open the partition, Windows says that "the volume is corrupted and unreadable".
There are some specifications:
1) obvs, because the drive was protected at the boot, there's no key-file required,
2) I tried the CHKDSK tool in order to recover the master file table, but without success,
3) The partitions supposed to be encrypted were 3 before everything started, but because i had to test a recovery way (without success), there's now only 1 partition RAW, the partition with the OS, my data and my programs. I don't know if it changes something.
4) Every time i try to mount the device without the "mount without pre-boot authentication" option, the password is wrong, even if i flag the "use the header backup if exists",
5) If i try to do everything else with the device, VeraCrypt says that the device does not appear to be encrypted,
I am a bit concerned about my partition, because i tried every topic i was able to find here...
I still have the USB rescue disk, if needed.
I absolutely need to decrypt this device, i didn't imagine that something like this would be able to appear...
If anybody had the same issue, pls answer me. The only way to have my partition back is to format it definitely...
Many thanks
Last edit: theVirus00 2017-08-09
UPDATE AFTER 15 HOURS
I tried this night for the third time to decrypt the partition, hoping this time something would have been better than yesterday. Same as yesterday, everything "good".
When i opened the WinPE system and installed VeraCrypt, i tried to open the partition but something new appeared:
"The coding process was not completed. It must be completed first".
I tried to recover the process with the menu "Resume interrupted process" but nothing. Encryption and Decryption are not willing to continue as "VeraCrypt didn't found any encryption process" for the encryption, and "Password wrong" for the decryption.
I am going to cry... If someone can help, please say anything.
I am willing to open the partition even read-only, beacuse i have an HD that can used as a temporary backup.
Thanks
You didn't specify what data recovery software you used when your first boot attempt failed (after decryption), but from your description, it sounds like those huge SWF files were written by that data recovery program to the same partition that you were trying to recover. If "using WinPE with a data recovery software" (from your first post) was what created those SWF files, that recovery program may have made any further recovery attempts useless. Data recovery programs often overpromise and underdeliver. I may have misunderstood you, but it sounds like your time is better spent finding ways to replace your data rather than continuing down this dead-end street. If you decide to continue using disk encryption, backing up with reliable software like Acronis True Image or Macrium Reflect should be an absolute must, assuming you value your data. This is exactly where you'd be if your SSD drive had suddenly failed (minus a usable drive), so data risk isn't just about encryption. Encryption merely compounds the risk.
I absolute want to recover my data, even copying from the read-only partition...
All i need to know now is HOW to mount AND read the partition.
I used MiniTool Power Data Recovery and EaseUS Data Recovery and both show these SWF files. I wish to know how to backup in another drive the data contained in the partition, obvs, or even a tool that force the decryption of the drive, once i give it the password.
I wish to know, also, why my rescue disk didn't and don't work, because i tried to recover the header several times and decrypt (as i said above) three times, obviously without success, because the at the boot the password is good (except if i do the "boot via rescue disk" option, in that case the password will be wrong) and the decryptions gone "good".
I'm out of options...
EDIT: i got also a Hex Editor, so if is needed, i can edit the hex values of the partition
Last edit: theVirus00 2017-08-10
Is it possible, that You used the wrong recovery image. Inthat case all data is lost.
Why didn't You use the built in system decryption from within the GUI, then there wouldn' have been the chance of making this mistake.
Andreas
i realized it obviously after, that i made a maybe big mistake, trying to decrypt via boot... Sadly i cannot go back, so i try the best i can with what i got.
I think your repeated decrypting attempts have "encrypted" the data.
There is a known bug in 1.19 Rescue Disk that you can read about at the link below.
https://sourceforge.net/p/veracrypt/discussion/general/thread/d7d2a042/
I thought it too, but the data was unreadable even after the first decrypt... So i decrypted a second time hoping to see a change.
I'm gonna use the tool i found in the link you sent above. I'm gonna update this thread.
OK, i used the updated rescue disk and i did follow the procedure.
I answered "yes" when it asked me if i used 1.19v of rescue and it said that everything was completed, partition restored. I am now in the windows repair tool, using the CMD and DISKPART. The partitions appear to be still RAW, i have to do something else or can i try to use a data recovery software?
The 1.19 Rescue Disk bug is only applicable if you were using the 1.19 version Rescue Disk. Unless the previous decryption attempts you performed did absolutely nothing to decrypt your system encryption, you are making it worse since the multiple decrypting is using the encryption key to reverse the encryption. Each time you perform the decrypt process, you are in essence, encrypting the data due to the encryption key is being used multiple times will not result in decrypted data.
Data recovery tools will only work if you were able to mount the encrypted volume.
Last edit: Enigma2Illusion 2017-08-10
Good... so i just freaked everything out... I did the decryption 3 times, if i try to encrypt the drive 2 times, do i have some chance to restore everything?
i know, i'm messing everything up, but i didn't know about the bug and i saw other people having a rescue disk that didn't anything, so i thought mine did the same...
Encryption creates a new encryption key. Sorry to say, no.
no no no no no god.....
But why after the first decryption windows just got unreadable? I didn't know how VeraCrypt work, so i just did everything that was supposed to be made, so decrypt and reboot. "Windows cannot be started, boot files are missing". I go via CMD to see the C: drive and is RAW. I cannot explain this...
EDIT: Sorry, i forgot about the bug in the rescue disk TT_TT
Last edit: theVirus00 2017-08-10
Anyway, now if i try to mount it, it gets my password good, but it says "encryption process has not been completed. Must be completed first", but i decrypted all night the drive... I cannot get anything else from this software
I'm going to proceed with formatting the entire drive. Many thanks for your time and help.
Have a good weekend.