Permanently decrypting a non-system drive fails at 100 %
Open source disk encryption with strong security for the Paranoid
Brought to you by:
idrassi
Menu
▾
▴
Yeah well as the topic states,
it was originally a truecrypt container, but converted it and successfully mounted it for a couple of weeks.
It fails with the following error:
The parameter is incorrect:
Source: volTransformThreadFunction:2680
Hope anyone can help, this really stinks :/
In your post you state that the volume is a file container. However the title says you are trying to decrypt a non-system drive which fails.
As far as I know, you cannot decrypt a file container. Merely mount or dismount a file container.
I think OP is indeed decrypting a partition/disk but he just used the wrong word (container) to describe his issue. At least the error code is located in the function that performs in-place decryption.
The error you have is obviously not normal and it doesn't happen in normal situations: all drive data has been decrypted and the error occur when VeraCrypt tries to update the volume header before removing it.
Just a question: did you try restoring TrueCrypt header of the volume before performing decryption with VeraCrypt?
It is difficult to know for sure what is happening in your case but it has to be with the last step of decryption that removes all header from disk.
Other questions: are you able to see the content of the disk/partition after removing it and inserting it back? What was the filesystem used by the volume (FATor NTFS)? What encryption algorithm are you using?
If the data are not visible, did you try resuming decryption?
Hopefully with your answers, I can find what is wrong in your situation.
Hi, and thanks for the response,
First of sorry about the confusion: The problem is a partition / disk
I dont recall having restored the volume headers.
The partition is listed as RAW in disk management (Should be NTFS), so im afraid i cant access the data, ive tried several times to resume the decryption process all with same result. The encryption algorithm is AES if i remember correctly.
So if the data is decrypted, would it then be possible to just remove the partition and place a new NTFS partition (And not formatting the new partition ofc.)?
Once again thank you for your responses :)
Of course, the issue is with the NTFS master file table that is missing or unreadable.
There is a possibility that I can solve your issue: VeraCrypt conceal the first 8 KB of the drive using a simple XOR during the drive encryption to make it unreadable by Windows and when the drive is decrypted this XOR is removed so that the drive view in Windows is restored.
One possibility is that something happened during the decryption that made VeraCrypt not restoring the original data. To test that, I will write a small tool that will simply perform the VeraCrypt XOR of the first 8 KB of the drive: you can run it to see if it solves your issue. If not, simply run it again and we can try other option.
I will try to send you the tool tomorrow.
(the other option is to perform a quick format on the partition and then use recovery tools like GetDataBack, R-Studio, File Scavenger, Photorec, Recuva, TestDisk...)
Hi,
Here is the tool I promised (attached below). I called it ConcealDrive and it is intuitive in its usage: just click "Select Device", select the partition where the issue exists, and then click apply and most importantly remove the disk (or reboot Windows) to make Windows see the changes.
The transformation is a simple XOR so if this doesn't help you, just apply the tool a second time on the partition to go back to your initial state and the proceed with the other option I described previously.
The tool is digitally signed by IDRIX SARL so be sure to check it first. It also asks for administrative previliges upon startup to be able to have low level access to disks.
Mounir, thanks a ton! Your program solved my issue. I believe i was getting the 2715 error when trying to continue resuming my encryption on my storage drive on laptop. I had to reformat and reinstall windows on my primary drive. and the error started up when i tried to resume. but low and behold, your program has solved this! Greatly recommend. Going to store this cool little prog away for future. Thanks again +rep! almost thought i lost everything! lol
Hi mounir, thanks for the tool, although it didnt solve the problem.
It seems the partition is unrecoverable, however i can restore data using easeus data recovery.
Thank you so much for your time and effort :)
Just curious on which version of VeraCrypt were you using on your PC?
1.16, tried upgrading to 1.17
now:
The parameter is incorrect:
Source: volTransformThreadFunction:2715
Hello, I have successfully decrypted a veracrypt volume, but now the drive is not available, and I'm afraid that I may have lost 4TB of data, is there anyone on this forum who can assist me
got decryption problems on my windows 7 machine too
works perfectly on my Windows 10 pc
but after reading about all these errors reported on this forum I'm considering not using it anymore on my Windows 10 pc either. Too much of a risk. Doesn't look VeraCrypt is compatible with fully updated windows operating systems anymore. It's a shame really, it used to be such a nice program.