Results 1 to 3 of 3
Thread: how to recover truecrypt file
Enjoy an ad free experience by logging in. Not a member yet? Register.
- Join Date
- Sep 2004
how to recover truecrypt file
Precisely. I used TrueCrypt on my SUSE 10.0 to store some information in one encrypted volume (in fact one file, I was not a separate partition). Additionally the encrypted file was saved with no extension on EXT3 partition.
One day the partition where the encrypted TrueCrypt file was located crushed. MBR was overwritten and partition information was lost. I tried a couple of tools that claim they can recover EXT3 partitions or files from corrupted EXT3 partitions. First I tried with testdisk and photorec then R-linux, Active Partition Recovery, Easeus Data Recovery Professional, On-track Easy Recovery Pro, Kernel Recovery for Linux and Stellar Phoenix Linux.
I couldn’t recover the entire partition.
I couldn’t recover the encrypted file as well (despite the fact that some other files were recovered).
It seems that these tools cope with files types they now. The list is impressive but is rather limited to typical txt, audio-video, lib ant other typical formats. I guess they don’t understand TrueCrypt files or get mad if the file is too large on the typical extension is faked.
I also tried “manual” repairs of that partition by searching the backup superblock and making the fsck.ext3 by using that superblock. But again – that recovered all the files but not the TrueCrypted volume.
Do you have any idea what I can else do for recovering the encrypted TrueCrypt file?
Do you know any data recovery software that recognize and cope with encrypted TrueCrypt file?
Do you have similar experience?
Thanks in advance.
- Join Date
- May 2004
- arch linux
It might be possible if you have the proper passwords for the files, but otherwise I think you are out of luck. Even then, I'm not sure it would be easy. It's probably a good idea to make several copies of important files just in case they should become corrupted, damaged, or lost.
If I run across anything that might work, I'll post back.
Edit: I just found this on the TrueCrypt FAQ, but not sure it will help you:
Q: What will happen when a part of a TrueCrypt volume becomes corrupted?
A: In encrypted data, one corrupted bit usually corrupts the whole ciphertext block in which it occurred. The ciphertext block size used by TrueCrypt is 16 bytes (i.e., 128 bits). The mode of operation used by TrueCrypt ensures that if data corruption occurs within a block, the remaining blocks are not affected. See also the question 'What do I do when the encrypted filesystem on my TrueCrypt volume is corrupted?
Q: What do I do when the encrypted filesystem on my TrueCrypt volume is corrupted?
A: File system within a TrueCrypt volume may become corrupted in the same way as any normal unencrypted file system. When that happens, you can use filesystem repair tools supplied with your operating system to fix it. In Windows, it is the 'chkdsk' tool. TrueCrypt provides an easy way to use this tool on a TrueCrypt volume: First, make a backup copy of the TrueCrypt volume (because the 'chkdsk' tool might damage the filesystem even more) and then mount it. Right-click the mounted volume in the main TrueCrypt window (in the drive list) and from the context menu select 'Repair Filesystem'.
Last edited by oz; 09-10-2008 at 08:59 PM.oz
- Join Date
- Sep 2004
I've got the password and the key file. The problem is to find and recover the container. By the way - the hard-drive I'm trying to recover is a backup disk. Don't ask what happend to the operational HD.