- Aug 23, 2007
- 16,829
- 3
- 0
I had a Truecrypt encrypted Maxtor 500gb drive (the whole drive) that I had quick formatted to NTFS and overwritten about 1/3 of... But then I realized I needed the data on it. I tried mounting it in Truecrypt and it worked, using the backup header stored at the end of the partition. No files were visible though, since the MFT was overwritten.
Before I did anything else I unmounted it and backed it up with Driveimage XML using raw mode. Then I mounted in Truecrypt and tried to restore the header. Well apparently that was a mistake because I got a message saying "access denied". Maybe since the drive was mounted by Windows, Truecrypt wasn't able to write to the beginning of the partition... IMO that should result in no data being changed on the drive, but it resulted in the partition being unmountable. I should have just checked for retrievable files as soon as it was mounted.
So the next thing I did was restore from my backup image with Driveimage XML. Everything seemed normal and the unencrypted files were visible like before. But when I tried to mount with Truecrypt, it said it wasn't a Truecrypt volume. I tried removing the drive letter and also deleting the partition from Administrative Tools, but no matter what Truecrypt wouldn't mount it.
So now I'm trying to restore the image again, but Driveimage XML says that the partition doesn't have enough sectors. I tried reformatting it to exFat but that doesn't work. I would try deleting the partition and just restoring to the empty drive, but DXML needs a partition to restore to.
Am I missing something? How can I restore my partition? Shouldn't the backup Truecrypt header be part of the raw image?
Before I did anything else I unmounted it and backed it up with Driveimage XML using raw mode. Then I mounted in Truecrypt and tried to restore the header. Well apparently that was a mistake because I got a message saying "access denied". Maybe since the drive was mounted by Windows, Truecrypt wasn't able to write to the beginning of the partition... IMO that should result in no data being changed on the drive, but it resulted in the partition being unmountable. I should have just checked for retrievable files as soon as it was mounted.
So the next thing I did was restore from my backup image with Driveimage XML. Everything seemed normal and the unencrypted files were visible like before. But when I tried to mount with Truecrypt, it said it wasn't a Truecrypt volume. I tried removing the drive letter and also deleting the partition from Administrative Tools, but no matter what Truecrypt wouldn't mount it.
So now I'm trying to restore the image again, but Driveimage XML says that the partition doesn't have enough sectors. I tried reformatting it to exFat but that doesn't work. I would try deleting the partition and just restoring to the empty drive, but DXML needs a partition to restore to.
Am I missing something? How can I restore my partition? Shouldn't the backup Truecrypt header be part of the raw image?
Last edited:
Facebook
Twitter