This project has moved. For the latest updates, please go here.

data lost?

Topics: Technical Issues
Oct 19, 2015 at 9:40 PM
Edited Oct 19, 2015 at 9:41 PM
Hi,

I had to format und reinstall my Windows on the system drive (whole disk, one partition, C:). On the second hard drive (whole disk, one partition, D:) are my encrypted personal files. The whole volumn D is encrypted via Veracrypt.

After fighting with some issues regarding GPT partition and the system encryption, I managed to set up the new OS. But: My D: disk seems to be broken. After typing in the correct password the decrypted drive shows up in explorer as unformated drive. Explorer says I should format the volume. :-/

Windows' disk management tool doesn't list the decrypted D: drive at all.

In my panic I tried to restore the volume headers from an internal backup of the drive. It didn't do any difference.

But: Have I lost all my personal data? :(

Best Regards
santa
Oct 20, 2015 at 6:58 PM
Using Windows disk management, did you remove the assigned drive letter that the OS assigned to the encrypted but dismounted volume?

Have you tried mounting using the option of embedded backup header key?

To be clear, the D drive is a separate drive and not another partition of the system drive. Correct?

If you did not make an external backup file of the header key to attempt a restore the header key and the restore from embedded backup key failed to allow you to mount the volume, then you will not be able to access the data.
Oct 20, 2015 at 10:35 PM
Edited Oct 20, 2015 at 10:37 PM
Yes, I removed the drive letter and tried to assign a new one. That didn't help.

I tried mounting it using the embedded backup header, too. Without any difference.

You're right: D: drive is a separate drive, not a partition of the system drive.

I'm so desparate... I lost so many important files...

EDIT: How is it possible, that Veracrypt can check, if my password is correct, but is not able to decrypt my files correctly? Just to be clear: When I type in some string, Veracrypt responses with the typical wrong password message but when I type in my correct password, the "empty" and "unformatted" drive is mounted.
Oct 21, 2015 at 3:19 PM
Edited Oct 25, 2015 at 2:51 PM
The header key allows you to access your volume's contents by obtaining the encryption key for on-the-fly encryption/decryption. VeraCrypt is functioning properly if your password is being accepted and the volume is being mounted to a drive letter.

You have to attempt data recovery if your volume's filesystem has been damaged (in your case, partially overwritten) such that your operating system cannot find any files.

Below are data recovery procedures that you can use:
  1. With the VeraCrypt volumes unmounted, make a sector-by-sector backup image of the damaged disk/partition.
  2. Restore the image to another disk.
  3. Using Windows Disk Management, remove the OS assigned drive letter from the RAW partition. Windows will consider the encrypted disk/partition as RAW format.
  4. Mount the VeraCrypt volume on the cloned disk.
  5. Use various data-recovery tools such as GetDataBack, R-Studio, File Scavenger, Photorec, TestDisk etc. in read only mode on the mounted volume in order to recover as much data as possible without altering the volume.
  6. Use filesystem repair tools (which write to disk) such as TestDisk, chkdsk etc. to try to repair the volume's broken filesystem on the hopes of recovering more data.
  7. When you've recovered all that you can, mount and format your original volume and copy your recovered data back in.
Skip steps 1 through 4 if your data is not that important and you are willing to accept more risk.

Some users skip to step 5 and attempt to repair the filesystem. However you can sometimes do more harm than good and you might recover less data.
Marked as answer by santaklaus on 10/25/2015 at 6:49 AM
Oct 25, 2015 at 1:59 PM
You, Sir, saved my digital life. Thank you, thank you, thank you, thank you, thank you!!!

After fiddling around with TestDisk/PhotoRec I could restore at least 500 GB of my data. But it wasn't able to restore filenames or the directory structure. So I had ~ 1.5 mio files with bogus file names in consecutively named folders. At least it was more than nothing.

Though I didn't gave up and tried other tools like Recuva. But the breakthrough came from R-Studio. That single most beautiful piece of software was able to find nearly all my files AND their names and file structure.

At the moment R-Studio is restoring my files.

With your guidance and consulting now I haven't lost 10 years of my digital life. I can't thank you enough!

I haven't got much money, but if you want to, please contact me via PN or so and I'll see how I can refund your help.
Oct 25, 2015 at 3:06 PM
Edited Oct 25, 2015 at 3:47 PM
Hello,

I am glad you are able to recover your data and thank you for your feedback on the various recovery tools. Each situation is different and one tool may perform better than another tool for a given situation.

Let this be a lesson to everyone that you need to backup your data to an external HDD or Cloud due to hard drive failure, software issues or user error that is completely independent of using encryption. :-)

https://veracrypt.codeplex.com/wikipage?title=How%20to%20Back%20Up%20Securely

Thank you for your kind offer. Please make any donation to the VeraCrypt project to help the developer which you can locate on the home page.

https://veracrypt.codeplex.com/

Kind Regards.
Oct 25, 2015 at 4:33 PM
I just donated. ;) I will definitely backup my data now.