Phantom mirror volume letter in recursive container

Topics: Technical Issues
Dec 4, 2015 at 9:26 AM
Please check this use case:
  • On drive C: of a Windows computer I mount (at L:) a VC drive based on a standard file container. It mounts OK and only L: volume appears on file explorer.
  • On the new drive L: I mount (at T:) a VC drive also based on a standard file container. It mounts OK and T: volume appears on file explorer. In this case a new drive T: appears at volume letter F: unexpectedly, and it seems a phantom mirror of drive T:
    Is this a bug?
    Tks a lot!
Dec 4, 2015 at 2:46 PM
Edited Dec 4, 2015 at 3:01 PM
Hello,

The problem does not occur on my Windows 7 Pro 64-bit OS using NTFS formatting of the two file containers with the one file container created inside the first file container. I am using VeraCrypt 1.17 Beta version.

I created a file container and mounted it to Q drive letter with a 100 MB size using NTFS formatting.

Then I created the second file container within the Q drive with a 10 MB size using NTFS formatting using the R drive letter.

In Windows Explorer, I do not have a duplicate/mirror drive letter for Q or the R.

Does the phantom drive letter show immediately or what is the length of time delay before the phantom drive letter shows in Windows Explorer?

When you dismount, are you manually dismounting starting with the innermost file container?

One possible cause is something inside the registry is causing this issue.

First upgrade to latest version 1.16 or higher.

With the all volumes dismounted, perform the following.

Using a modified version of Idrassi's instructions:
Check the registry key "HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices" using regedit. Scroll down and you'll find entries starting with "\DosDevices\" which indicate the drive letters that are taken by the system. Before mounting any volume, double click on each one and remove the ones contains the name "VeraCrypt" and "TrueCrypt".
Also, there are other entries whose name start with "#{" and "\??\Volume{": double click on each one of them and remove the ones whose data value contains the name "VeraCrypt" and "TrueCrypt".
.
Reboot PC.
Dec 6, 2015 at 10:13 AM
Hello,

Thanks a lot for your reply. Before checking registry I did some more tests and the rule to get a phantom/mirror volume letter appeared to be:
  • Just mount any VeraCrypt/TrueCrypt container at any available volume letter except F: and T:
  • Mount a second VeraCrypt/TrueCrypt container at volume letter T:
  • You will get a T: mirror at F: volume. It shows immediately on version 1.15 but you must look for it on version 1.16 in order to access it.
  • Just dismounting T: doesn't free up F:, you need to reboot in order to free it up.
(*) Tested on VeraCrypt 1.15 and VeraCrypt 1.16. Windows 10 Pro Toshiba Z30 laptop.
(**) TrueCrypt 7.1a worked OK with no mirror letter on another computer.
(***) Recursion appeared not to be involved.
(****) No other volume letters worked this way.

After these tests I tried to check the registry with regedit but I couldn't reproduce the issue. I seems as if you were right on mentioning that something in the registry could be the cause, as actually I can't reproduce the phantom/mirror letter any more

Thanks a lot!
Dec 6, 2015 at 3:15 PM
Using VeraCrypt version 1.15 causes this problem and there have been reports of old TrueCrypt entries in the registry causing this problem.

I am glad the issue has been resolved.