Vas Das

I scanned the mounted/decrypted partition, what I get: The size of the entire veracrypt volume partition is /tmp/.veracrypt_aux_mnt/volume 1892220416 sectors, of which there is completely random data only in 1847707648, the rest 44512768 (21735M) is zeros and NTFS headers at the end. How could something corrupt 900GB+ of data in a few seconds (from the moment the USB nvme box is plugged in until the password is entered into veracrypt) without touching the headers (main and backup)? After all, the...

I scanned the attached decrypted partition, what I get: The size of the entire veracrypt volume partition is /tmp/.veracrypt_aux_mnt/volume 1892220416 sectors, of which there is completely random data only in 1847707648, the rest 44512768 (21735M) is zeros and NTFS headers at the end. How could something corrupt 900GB+ of data in a few seconds (from the moment the USB nvme box is plugged in until the password is entered into veracrypt) without touching the headers (main and backup)? After all, the...

I found the backup header file. It's a proper backup, I'm 100% sure. I used the command to restore the header veracrypt -t --filesystem=none --restore-headers -k "" --protect-hidden=no disk.raw entered a password that worked. I entered 320 random characters. Everything ended successfully. However, after trying to mount the volume, everything remained unchanged - garbage in all data (900GB+) except the end of the disk - there's an NTFS header(?) there, as in the screenshot above. I have no idea what...

I found the backup header file. It's a proper backup, I'm 100% sure. I used the command to restore the header veracrypt -t --filesystem=none --restore-headers -k "" --protect-hidden=no disk.raw entered a password that worked. I entered 320 random characters. Everything ended successfully. However, after trying to mount the volume, everything remained unchanged - garbage at the beginning, zeros and NTFS headers(?) at the end, as in the screenshot above. I have no idea what happened or what can be...

Here's what I found out. If I connect a Veracrypt volume with the correct password, the last sectors of the volume look like this (see attachment). However, this is the only data that can be recognized. All other data is garbage.

The computer had a veracrypt volume partition on an m.2 disk (samsung pm981a). Windows 11 system and Veracrypt v1.26.7 (updated the other day) I bought a new disk, took out the old disk and inserted it into an m.2-nvme external box to copy data from it. When I tried to connect the veracrypt volume, veracrypt detected corruption and suggested using the embedded header copy. But this did not find the file system, the disk was seen as RAW. I manually in the veracrypt program chose to restore the header...