Use TestCrypt to recover corrupt TrueCrypt partitions
One of the worst things that can happen when it comes to encryption is data corruption. The problem here is that corruption may prevent you from accessing the data at all.
When it comes to encryption software that you can use to encrypt entire hard drives or partitions, corruption could result in total data loss as you may not be able to mount the data anymore.
TrueCrypt, despite the shut down that happened recently, is still a popular encryption software. I have used it in the past to encrypt partitions on hard drives to protect the data stored on them, for instance when the computer is stolen.
One of the things that can happen is that the TrueCrypt software fails to recognize the encrypted partition. This in turn means that you cannot mount it anymore.
If you have created a backup before, you may try and use that to recover the data but if you have not, you may be able to recover the partition with the help of the TextCrypt program for Windows.
TestCrypt is a free program for Windows that is available as a 32-bit and 64-bit edition. Note that you need to load its unsigned drivers on startup if you are using a 64-bit version of Windows Vista or newer. If you don't, some functionality is not available.
The program requires the Microsoft .NET Framework 2.0 and the Microsoft Visual C++ 2010 Redistributable Package as well so keep that in mind.
The program displays a warning message on start if the drivers have not been loaded but allows you to continue anyway. A list of all hard drives is displayed in the interface afterwards.
You need to select one of the drives that you want to scan for TrueCrypt volumes. A click on next displays advanced parameters that you can configure. Basically, what you can do here is change the beginning and end of the partition that you want scanned. If you don't know what this is about, set it to automatic or leave it at don't analyze instead.
The screen afterwards provides you with options to set the same for the beginning and end of the volume. Again, if you don't know what to enter here keep the do not analyze option or set it to automatic instead to let the program handle that for you automatically.
After that you are asked to enter the password or add keyfiles that are used to decrypt the partition. It is necessary to do that as you won't be able to continue if you don't enter the password or keyfiles. Note that pre-boot authentication is not supported by TestCrypt.
A summary of the information is displayed on the next screen. If you click next here, the scan starts. It may take a while depending on the size of the volume and speed of the drive.
A volume scan of a fast 120 GB SSD drive took about 27 minutes for example. Volumes detected this way can be directly mounted so that the data can be accessed again.
Closing Words
TestCrypt has been designed as an emergency tool to recover TrueCrypt partitions if they are not found anymore by the encryption software.
I suggest you use the header backup and restoration method first before you use it but if that fails, it may be your last option to get the data back.
From what I can tell, it does a good job at that even though it should be clear that recovery depends on a number of factors that it does not control.
This is precisely why I don’t believe in whole-disk (or whole-partition) encryption – the possibility of data corruption destroying large amounts of data. It’s also a massive waste of time – very little on most systems is so critical it needs to be encrypted. Just encrypt the files that need to be encrypted.
If one uses any form of encryption, make sure you utilize any data-recovery options or external key storage options the system allows – and keep multiple copies.
Of course that merely shifts the security issue from the encrypted contents to the keys and recovery options…which is one reason encryption is not a panacea. Most failures of encryption in the wild have been problems of implementation and key management.
I had a TrueCrypt problem like this. It’s TrueCrypt version 7.1a running on Windows 7. I created a container file on Windows 7. The container file is created on one of the disks on Windows 7. I made the file readable to the home network.
One day, I ran a TrueCrypt version 7.1a installed on Windows Vista to access that file. It took forever to mount. I realized something might be wrong. So I killed the TrueCrypt process on Vista. And then run TrueCrypt on Windows to mount that file. It took my password and opened the file. But all the files in the container file are gone.
Don’t know if there is anyway I can recover the files.
Thanks,
Gao