This project has moved and is read-only. For the latest updates, please go here.

All data became inaccessible

Topics: Technical Issues, Users Discussion
Apr 7, 2016 at 3:49 PM
Edited Apr 7, 2016 at 3:55 PM
Hi! Yesterday, everything was OK. Today, I have a BIG problem. Please, help me out!
I am using VeraCrypt 1.17 (64-bit) under Windows 8.
I encrypted a whole external 1 TB USB HDD by creating both a a normal volume and a hidden volume.
Everything was OK: I was able to mount both volumes with their respective passwords.
However, suddenly, THIS happened:
The volumes can still be mounted (normal = 931 GB and hidden = 929 GB), but when I right click on them and select "Open" from the menu, this error message appears: "You need to format the disk in drive N: before you can use it". Also, the HDD is not seen by Windows Explorer. Please, see the attached images.
I had valuable information inside the HDD. Could you please help me out?

Image
Image
Apr 7, 2016 at 6:38 PM
can you please try mounting these to a different letter.... try L:
Apr 7, 2016 at 7:25 PM
Thank you for your reply!
I tried with several different letters, including L, always with the same results.
Any other idea?
Apr 7, 2016 at 7:27 PM
did you try rebooting ?

what do you get if you right click on the mounted partition within VC and select Properties?
Apr 7, 2016 at 8:57 PM
Yes, thank you! Rebooting was the first thing I tried.
The mounted volume has the following properties:

Location: \Device\Harddisk3\Partition0
Size: 998579765248 bytes
Type: Hidden
Read-Only: No
Hidden Volume Protected: N/A
Encryption Algorithm: AES
Promary Key Size: 256 bits
Secondary Key Size (XTS Mode): 256 bits
Block Size: 128 bits
Mode of Operation: XTS
PKCS-5 PRF: HMAC-SHA-512
Volume Format Version: 2
Embedded Backup Header: Yes
Data Read since Mount: 135 KB
Data Written since Mount: 0 B

Please, see also the attached image: http://i.imgur.com/49TwJbc.jpg?1
Any idea of how to fix it?
Apr 7, 2016 at 9:04 PM
it all looks perfect! i am puzzled as to how is it possible that you cant access it. can you please open windows disk management (right click computer, then manage, then Disk Management on the left).... can u post screenshot of what is there?
Apr 7, 2016 at 10:12 PM
Edited Apr 7, 2016 at 10:15 PM
Thank you for your new reply. Sure, please find the screenshot below (Disk3 is the mounted one):

Image

Here is the full size image: http://i.imgur.com/y4XgFzX.jpg
Any idea of what's going on?
Apr 8, 2016 at 7:27 AM
Edited Apr 8, 2016 at 7:31 AM
I am afraid i can not suggest anything at that point. It must be some problem with the drive itself. Other users may be able to suggest something in this case. Enigma2iillusion?
The only thing i can now think of is that the drive needs to be initialized, which suggests it might be a hardware issue. It is quite possible that the USB port is lacking power. I would really urge everyone here to read this post and suggest a solution as this is a case where someone really needs help!
Apr 8, 2016 at 11:23 AM
What external USB disk you use and with 2.0 or 3.0 port ?
Apr 8, 2016 at 12:12 PM
Yes, I would say initialize the disk, but I'm not sure if it is the right thing to do here and whether or not it might risk data.

In terms of data, everybody has backups right?????? You can't be putting things in to a VC container and not expect that it is possible that your hard disk or USB stick isn't going to fail you. Backups, backups and more backups... ;-) Then you can experiment and try to fix things that are broken if they are and maybe be able to try something that might help.
Apr 8, 2016 at 4:11 PM
Tulip91 wrote:
What external USB disk you use and with 2.0 or 3.0 port ?
Thank you for your reply!
It's a WD Elements (Western Digital) model WDBPCK0010BBK-01 (USB 3.0 and USB 2.0 compatibility): http://www.wdc.com/wdproducts/library/AAG/ENG/4178-705191.pdf
Apr 8, 2016 at 4:16 PM
affinity wrote:
Yes, I would say initialize the disk, but I'm not sure if it is the right thing to do here and whether or not it might risk data.

In terms of data, everybody has backups right?????? You can't be putting things in to a VC container and not expect that it is possible that your hard disk or USB stick isn't going to fail you. Backups, backups and more backups... ;-) Then you can experiment and try to fix things that are broken if they are and maybe be able to try something that might help.
Thank you for your new message!
Unfortunately, not really: precisely, all data became inaccessible some just before starting the backup process (the HDD contains fresh material that was going to be backed up in that moment). Any other idea?
Apr 8, 2016 at 4:20 PM
Alex512 wrote:
I am afraid i can not suggest anything at that point. It must be some problem with the drive itself. Other users may be able to suggest something in this case. Enigma2iillusion?
The only thing i can now think of is that the drive needs to be initialized, which suggests it might be a hardware issue. It is quite possible that the USB port is lacking power. I would really urge everyone here to read this post and suggest a solution as this is a case where someone really needs help!
Thank you so much for you reply and for urging everyone here to read this post and suggest a solution. That's really kind of you.
Yes, after reading affinity's comments, I didn't try to initialize the HDD, since this may involve an unrecoverable loss of data.
I would REALLY appreciate further help!
Apr 8, 2016 at 6:55 PM
Edited Apr 8, 2016 at 7:00 PM
does your usb HD get power from the usb cable alone or is it also plugged into the wall?

Can you post screenshot from the disk management when the volume is NOT decrypted?

what is certain is that the header is ok as VC reads the properties of the partition after its being decrypted. From there onwards, something goes bad... maybe the partition tables? Come on guys, there are so many of you knowing about this stuff! This question is much more important, although for one person only, than "is AES secure?"....
Apr 11, 2016 at 10:13 AM
This is what I'd do:
  1. buy another HDD of the same (or rather bigger) size and backup the whole disk to the new disk 1:1 prior trying to do anything!
    I'd do this from a linux live cd using "dd if=/dev/sdb of=/dev/sdc bs=100M") where sdb is old drive and sdc is new. DOUBLE CHECK you know which drive device is which (external drives are usually sdb, sdc, sdd, etc), but BEWARE, you can easily confuse them, so at this step you can practically overwrite your original data disk with zeros, so make sure you know which drive is which!! To avoid confusion, disconnect your drives, run "ls /dev/sd*", see what devices you have, now connect original, run "ls /dev/sd*" again, note which device has been added, connect copy drive, and "ls /dev/sd*" again to note the copy drive device letter, now you can safely make your copy using dd command, which will take several hours, but if you have only usb 2.0, it will take half a day. Make sure your drives are properly powered, I recommend to use usb Y cables.
  2. reboot to windows, disconnect original drive and leave only the copy drive connected
  3. mount the copy drive, run (as administrator) cmd.exe (command prompt)
  4. from elevated command prompt run chkdsk x: /f (where x is your mounted letter) - see if this can fix your damaged file system
If chkdsk will fail, you can try some third party tool(s) for repairing filesystem, or you can extract your data using recovery software such as recuva etc.

Notes: 1. Be sure to recover your data to another physical medium! 2. Never try to repair your original disk, always work with a copy! If your efforts fail and your data are more important than your privacy, you can always pay a technician or a recovery company. If you disobey, work with original and screw up (which is easy to do if you are not a tech guru), not even God will be able to recover any of your data!
Apr 13, 2016 at 12:54 PM
testoslav wrote:
This is what I'd do:
  1. buy another HDD of the same (or rather bigger) size and backup the whole disk to the new disk 1:1 prior trying to do anything!
    I'd do this from a linux live cd using "dd if=/dev/sdb of=/dev/sdc bs=100M") where sdb is old drive and sdc is new. DOUBLE CHECK you know which drive device is which (external drives are usually sdb, sdc, sdd, etc), but BEWARE, you can easily confuse them, so at this step you can practically overwrite your original data disk with zeros, so make sure you know which drive is which!! To avoid confusion, disconnect your drives, run "ls /dev/sd*", see what devices you have, now connect original, run "ls /dev/sd*" again, note which device has been added, connect copy drive, and "ls /dev/sd*" again to note the copy drive device letter, now you can safely make your copy using dd command, which will take several hours, but if you have only usb 2.0, it will take half a day. Make sure your drives are properly powered, I recommend to use usb Y cables.
  2. reboot to windows, disconnect original drive and leave only the copy drive connected
  3. mount the copy drive, run (as administrator) cmd.exe (command prompt)
  4. from elevated command prompt run chkdsk x: /f (where x is your mounted letter) - see if this can fix your damaged file system
If chkdsk will fail, you can try some third party tool(s) for repairing filesystem, or you can extract your data using recovery software such as recuva etc.

Notes: 1. Be sure to recover your data to another physical medium! 2. Never try to repair your original disk, always work with a copy! If your efforts fail and your data are more important than your privacy, you can always pay a technician or a recovery company. If you disobey, work with original and screw up (which is easy to do if you are not a tech guru), not even God will be able to recover any of your data!
Thank so you much for your detailed answer, but after following all steps, I got this error message: "The type of the filesystem is RAW. CHKDSK is not available for RAW drives." Any other idea?
Apr 13, 2016 at 2:52 PM
Edited Apr 13, 2016 at 2:53 PM
You will need to use recovery software. There are plenty of recovery tools with pretty GUI, but I have particularly good results with testdisk suite. Don't let the text GUI scare you, if you need just to extract your videorecordings and pictures, photorec is pretty easy to use (it is in the suite), but if you are about to do advanced stuff, please study the manual first, maybe there are even some instructions on youtube. REMEBER to work with a mounted copy and recover to another media!
Apr 13, 2016 at 3:24 PM
I think you have no option than to start again. Using recovery software, such as testdisk or photorec is probably not going to help. Those tools look at the raw disk images, where data is recognizable in plain text (so to speak), but you have an encrypted disk image and those tools will only see encrypted data.

If there was a way to use those tools via the decrypted path, then perhaps you would have a hope. I would be looking at seeing how you can mount the volumes on Linux and how tcplay or zulucrypt can provide you with a mapped device through (ultimately) dm-crypt, something like /dev/mapper/your_volume (decrypted), then perhaps try testdisk or photorec using that mapper device.
Apr 13, 2016 at 3:29 PM
Edited Apr 13, 2016 at 3:31 PM
Of course photorec will work ;-) As long as he will recover the mounted drive of course :o) He claimed he can mount, but he sees raw volume after mount...
Apr 13, 2016 at 6:15 PM
I am afraid affinity has a point in his last post....

what i am thinking.... if the system loads the VC properties data from the volume then it reads SOMETHING.... how? and why doesnt it read the rest?

if you try to make a backup header of the volume now? can you do that?

and another idea... if you try (from VC volume tools) the permanently decrypt option?
Apr 13, 2016 at 8:02 PM
External drives are just becoming RAW, try to search google. This surprisingly never happened to me, but I recovered data from RAW volumes for two people already (and I'm not doing this for living, just for friends), disks were not encrypted though.

It does not matter if the drive is encrypted or not, it just happens, not a lot, but sometimes. I think NTFS was not designed to be unplug and go, if you forget to properly inform windows, that you are going to disconnect, you may end up with a RAW volume. If armandosab can mount a volume using veracrypt, he is in the same situation, as if he would have unencrypted RAW drive, which is good news, so he should be able to extract his data using recovery tools.

Permanently decrypt should work. it is not that bad idea after all, as long as he will try it on a copy drive. It will not help him to see his data, but he can make recovery easier for a third party specialized in data recovery.
Apr 14, 2016 at 4:38 AM
Being "RAW" is just a partition type really, it should stop Windows form seeing an NTFS partition that isn't formatted and then offering to format it.
Apr 14, 2016 at 3:10 PM
Edited Apr 14, 2016 at 3:11 PM
testoslav wrote:
You will need to use recovery software. There are plenty of recovery tools with pretty GUI, but I have particularly good results with testdisk suite. Don't let the text GUI scare you, if you need just to extract your videorecordings and pictures, photorec is pretty easy to use (it is in the suite), but if you are about to do advanced stuff, please study the manual first, maybe there are even some instructions on youtube. REMEBER to work with a mounted copy and recover to another media!
Thank you so much! But I already tried, indeed, literally dozens of recovery software options, including: GetDataBack, R-Studio, Seagate File Recovery, Ontrack EasyRecovery, Recuva, MiniTool Partition Recovery, Wise Data Recovery, Active@ Partition Recovery, MiniTool Partition Wizard Home Edition, PhotoRec and TestDisk. None of these was able to recover one single file of those which were encrypted. Yes, I tried them on the VeraCrypt mounted hidden volume and, just in case, also on the physical HDD. Any other ida?
Apr 14, 2016 at 3:15 PM
Alex512 wrote:
I am afraid affinity has a point in his last post....

what i am thinking.... if the system loads the VC properties data from the volume then it reads SOMETHING.... how? and why doesnt it read the rest?

if you try to make a backup header of the volume now? can you do that?

and another idea... if you try (from VC volume tools) the permanently decrypt option?
Thanks a lot! Yes, that's exactly what I don't understand. If the volume can be mounted (see the attached photos above), why is not possible to read the rest?
No, I can't backup the header of the volume, but I can restore it (since it's embedded).
Yes, I tried to permanently decrypt the volume and I get this error: "Error: VeraCrypt can in-place encrypt only a partition, a dynamic volume, or an entire system drive. Please make sure the specified path is valid."
Any other clue?
Apr 14, 2016 at 3:24 PM
Thank you for all your replies!
Please see it for yourselves by watching this video I made for you:
http://sendvid.com/wcxxk0oh
Any other idea?
Apr 14, 2016 at 3:29 PM
affinity wrote:
I think you have no option than to start again. Using recovery software, such as testdisk or photorec is probably not going to help. Those tools look at the raw disk images, where data is recognizable in plain text (so to speak), but you have an encrypted disk image and those tools will only see encrypted data.

If there was a way to use those tools via the decrypted path, then perhaps you would have a hope. I would be looking at seeing how you can mount the volumes on Linux and how tcplay or zulucrypt can provide you with a mapped device through (ultimately) dm-crypt, something like /dev/mapper/your_volume (decrypted), then perhaps try testdisk or photorec using that mapper device.
Thank you! You are totally right: recovery software didn't work! Indeed, I also think that those tools only see encrypted data. That's the problem.
Yes, please: try to see that Linux solution. Maybe that should help. I don't give up yet. The information should be still inside the disk. Please let me know.
Apr 14, 2016 at 9:02 PM
Frankly speaking i am puzzled that with so many computer gurus and geeks here, nobody is in position to help armandosab.... The guy has even uploaded a video showing his desperate efforts.... Come on guys... VC reads something off that bloody disk.... then it hangs in mid air.... what can that be? Partition tables? Any other ideas?

After all, tomorrow it will be one of us sitting with his USB HD cursing the world for his whole life being stamped as RAW....
Apr 15, 2016 at 5:59 AM
Did you ever write files to the volume? If not, then simply format it as asked.

If the drive had files before the encryption process, then I expect they are long gone now, unless, perhaps you did zero wiping then those other tools outside Windows might help
Apr 15, 2016 at 9:09 AM
armandosab wrote:
Thank you! You are totally right: recovery software didn't work! Indeed, I also think that those tools only see encrypted data. That's the problem.
Yes, please: try to see that Linux solution. Maybe that should help. I don't give up yet. The information should be still inside the disk. Please let me know.
If veracrypt can mount, it sees legit data and so it decrypts, unless there's some bug we do not know about yet. Have you tried to mount using mount options - use backup header embedded?

Have you used the recovery software correctly and on the copy? If not, there can be now random data from your bad attempts. If you are working on a copy, maybe it's time to make another (fresh) copy now and try on it.

Are you telling us the whole truth? Recovery from mounted volume, even dead one, damaged, with bad sectors, or formatted, definitively works if done correctly, as long as you are able to mount. You can test it -create test volume, mount it, put 1 gig of photos on the volume, using dd owerwrite the first 50MB of the mounted drive, which destrys ntfs, dismount, mount again (you have raw now), then try photorec and it rescues the photos.

What recovery software "sees" you can find out using winhex - tools - open disk - choose mounted logical volume(!), which is K: in your video. If you try to open the encrypted physical media, you will see random data, it is useless to try to rescue data from unmounted media.

Most users should avoid encrypting the whole device and always encrypt partition(s) instead, because it is just too dangerous under windows, one wrong click leads to damage of the vc header, which not happened to you as it seems.
Apr 15, 2016 at 9:55 AM
affinity wrote:
Did you ever write files to the volume? If not, then simply format it as asked.

If the drive had files before the encryption process, then I expect they are long gone now, unless, perhaps you did zero wiping then those other tools outside Windows might help
Yes, I did. That's the problem: the disk was full of fresh data which became inaccessible before backing it up. That's why I need to recover it.
Apr 15, 2016 at 10:03 AM
testoslav wrote:
armandosab wrote:
Thank you! You are totally right: recovery software didn't work! Indeed, I also think that those tools only see encrypted data. That's the problem.
Yes, please: try to see that Linux solution. Maybe that should help. I don't give up yet. The information should be still inside the disk. Please let me know.
If veracrypt can mount, it sees legit data and so it decrypts, unless there's some bug we do not know about yet. Have you tried to mount using mount options - use backup header embedded?

Have you used the recovery software correctly and on the copy? If not, there can be now random data from your bad attempts. If you are working on a copy, maybe it's time to make another (fresh) copy now and try on it.

Are you telling us the whole truth? Recovery from mounted volume, even dead one, damaged, with bad sectors, or formatted, definitively works if done correctly, as long as you are able to mount. You can test it -create test volume, mount it, put 1 gig of photos on the volume, using dd owerwrite the first 50MB of the mounted drive, which destrys ntfs, dismount, mount again (you have raw now), then try photorec and it rescues the photos.

What recovery software "sees" you can find out using winhex - tools - open disk - choose mounted logical volume(!), which is K: in your video. If you try to open the encrypted physical media, you will see random data, it is useless to try to rescue data from unmounted media.

Most users should avoid encrypting the whole device and always encrypt partition(s) instead, because it is just too dangerous under windows, one wrong click leads to damage of the vc header, which not happened to you as it seems.
Thanks for the reply! I hope, indeed, this is due to a bug that can be fixed soon! Yes, the header is embedded and can be restored. I tried it several times.

Yes, I have used the recovery software correctly (dozen of different programs, see above) both on the mounted HDD and the physical disk.

Of course. Obviously yes. The truth is out there: see it for yourself by watching the video I already posted: http://sendvid.com/wcxxk0oh No recovery soft, including PhotoRec and TestDisk (https://www.cgsecurity.org) was able to recover a file.

The recovery attempts were done on the mounted drive and also on the physical disk (see above).

Yes, as you can see, the VC header remains intact and embedded.

Any other clue?
Apr 15, 2016 at 10:08 AM
Alex512 wrote:
Frankly speaking i am puzzled that with so many computer gurus and geeks here, nobody is in position to help armandosab.... The guy has even uploaded a video showing his desperate efforts.... Come on guys... VC reads something off that bloody disk.... then it hangs in mid air.... what can that be? Partition tables? Any other ideas?

After all, tomorrow it will be one of us sitting with his USB HD cursing the world for his whole life being stamped as RAW....
Thank you so much for your comments, Alex512! I really appreciate them. Yes, I uploaded the video as a proof of my claims and, most important, so you can all see what's going on here. Indeed, VC reads something and then... nothing. Your final metaphor was perfect. That's how I feel. Thank you for your understanding.
Apr 15, 2016 at 7:03 PM
Edited Apr 15, 2016 at 7:10 PM
armandosab wrote:
Alex512 wrote:
Frankly speaking i am puzzled that with so many computer gurus and geeks here, nobody is in position to help armandosab.... The guy has even uploaded a video showing his desperate efforts.... Come on guys... VC reads something off that bloody disk.... then it hangs in mid air.... what can that be? Partition tables? Any other ideas?

After all, tomorrow it will be one of us sitting with his USB HD cursing the world for his whole life being stamped as RAW....
Thank you so much for your comments, Alex512! I really appreciate them. Yes, I uploaded the video as a proof of my claims and, most important, so you can all see what's going on here. Indeed, VC reads something and then... nothing. Your final metaphor was perfect. That's how I feel. Thank you for your understanding.
Thanks armandosab for your kind words,

I am still thinking... in your video... the usb disk (before you try to mount it) shows as UNALLOCATED.. mine (unencrypted) shows as RAW. Why might that be?

What if you rollback to VC 1.16? and try the mounting process again?
Apr 15, 2016 at 10:35 PM
So why don't you look onto mounted drive with winhex and post here? Do you see something more interesting than pure random data? If it is decrypted properly, there should be some continuous blocks of zeros, not only data looking like random.

Accidents do not usually happen per se. You might have higher chance if that's something that can be repeated. So what exactly did you do? You copied data onto disk, dismounted drive, disconnected using tray icon, unplug, put it into the drawer, take back, plug in, mount and raw volume?

When you made the copy or recovery, no errors have been reported? I'd yet try surface test of the drive using software like hdtune.
Apr 16, 2016 at 12:10 AM
Hi,

I will try to summarize the situation in order to come up with the right conclusions:
  • Disk was encrypted in RAW mode without any partition. Do you confirm?
  • Disk can be mounted using VeraCrypt, for both outer and hidden volume: this implies that the headers for both volumes are intact and they were not damaged or they were restored from embedded backup. Did you perform any header restore from external backup?
  • Windows doesn't recognize the filesystem on both volumes: this implies that the NTFS/FAT tables are damaged.
The origin of the issue is unknown at this stage. VeraCrypt will not damage NTFS/FAT tables on its own, so there must be something on the machine that wrote some data directly to the disk, overwriting the location where the encrypted NTFS/FAT tables are stored.

In such situations, a recovery software is the only solution and it should be applied to the mounted volume not to the encrypted disk.

Did you try R-Studio? it has proven in the past to be one of the best recovery tools. You can read this thread for more information: https://veracrypt.codeplex.com/discussions/646389#post1449277

Since you already made a helpful video, is it possible to make another one that contains the following:
  • Open the disk using the tool HxD (https://mh-nexus.de/en/hxd/) using the menu Extras -> Open Disk, and then scroll slowly from sector 0 until sector 80. This will help detect if any data was written to the disk outside of VeraCrypt control.
  • Show the output of TestDisk and/or PhotoRec. Maybe we can spot from details that could help assess the situation.
In all cases, if the disk layout did not change and if the disk content was not entirely overwritten, it should be possible to recover your data.
Apr 19, 2016 at 2:37 PM
Edited Apr 19, 2016 at 2:41 PM
idrassi wrote:
Hi,

I will try to summarize the situation in order to come up with the right conclusions:
  • Disk was encrypted in RAW mode without any partition. Do you confirm?
  • Disk can be mounted using VeraCrypt, for both outer and hidden volume: this implies that the headers for both volumes are intact and they were not damaged or they were restored from embedded backup. Did you perform any header restore from external backup?
  • Windows doesn't recognize the filesystem on both volumes: this implies that the NTFS/FAT tables are damaged.
The origin of the issue is unknown at this stage. VeraCrypt will not damage NTFS/FAT tables on its own, so there must be something on the machine that wrote some data directly to the disk, overwriting the location where the encrypted NTFS/FAT tables are stored.

In such situations, a recovery software is the only solution and it should be applied to the mounted volume not to the encrypted disk.

Did you try R-Studio? it has proven in the past to be one of the best recovery tools. You can read this thread for more information: https://veracrypt.codeplex.com/discussions/646389#post1449277

Since you already made a helpful video, is it possible to make another one that contains the following:
  • Open the disk using the tool HxD (https://mh-nexus.de/en/hxd/) using the menu Extras -> Open Disk, and then scroll slowly from sector 0 until sector 80. This will help detect if any data was written to the disk outside of VeraCrypt control.
  • Show the output of TestDisk and/or PhotoRec. Maybe we can spot from details that could help assess the situation.
In all cases, if the disk layout did not change and if the disk content was not entirely overwritten, it should be possible to recover your data.
Thank you so much for your reply, idrassi!

I tried PhotoRec already, many times, with no useful results. But I made the video you asked for: http://sendvid.com/shdrt3e3
  • During the first seconds of the video, you can see that I can still mount the VeraCrypt hidden volume and see its properties. But, at the same time, none of the following commands work: Open, Check Filesysten, Repair Filesystem, Permantently Decrypt.
  • During the last seconds of the video, I opened the HDD with HxD as you suggested. Please watch the video from beginning to end, because some "surprises" appear from block 241057 until almost the last blocks of the HDD.
Can you deduce from this new video what's going on?
Apr 20, 2016 at 6:37 PM
Hi armandosab, to me it looks pretty well, from block 241057 onwards is your data. It looks like encrypted, but its probably not as i dont think you only have plain text files that would be easily seen. What I think is that your data is decrypted perfectly fine (so its there), it is for some reason not visible to the OS (probably missing tables).
I hope that idrassi or the other guys will be able to tell you more so finally you will be able to access your data.
Apr 21, 2016 at 12:15 PM
Alex512 wrote:
Hi armandosab, to me it looks pretty well, from block 241057 onwards is your data. It looks like encrypted, but its probably not as i dont think you only have plain text files that would be easily seen. What I think is that your data is decrypted perfectly fine (so its there), it is for some reason not visible to the OS (probably missing tables).
I hope that idrassi or the other guys will be able to tell you more so finally you will be able to access your data.
Thank you for your kind reply, Alex512! That's really good news, indeed! :-) All data consists of videos and photos. I also hope that idrassi will find a way to access it somehow.
Apr 22, 2016 at 4:37 PM
Edited Apr 22, 2016 at 4:38 PM
Yes, the decrypted data look legit. If photorec does not work, maybe you are not using it properly.
Apr 22, 2016 at 4:53 PM
testoslav wrote:
Yes, the decrypted data look legit. If photorec does not work, maybe you are not using it properly.
Thank you, testoslav! Good to know that, according to your opinion, the data is still there.
Yes, I do: I normally use photorec. so I'm quite aware of it. Didn't work on this case, though.
Any other idea of why Windows can't open the mounted volume?
Apr 28, 2016 at 10:47 AM
Hi there, guys!
I was wondering if you had any new ideas regarding this issue.
I still have valuable data inside that HDD.
Could you please help me, idrassi?
Apr 28, 2016 at 5:13 PM
anyone? i would really LOVE to see this issue solved.... both for armandosab and vc as well :)
Apr 28, 2016 at 10:00 PM
The first question that I asked in my first post was never answered. So, I repeat it here:
Disk was encrypted in RAW mode without any partition. Do you confirm?
The answer is important since the the video shows that you are mounting \Device\Harddisk1\Partition0 and the HxD view confirms that the disk contains a GPT partition.

Also, are you able to mount the outer volume without checking the option "Mount using embedded backup header"?

Did you perform a manual restore of volume header?

Also, there is something strange in the video: you mounted the disk in K: but in HxD, the drive K: is not visible under "Logical Disks"...
Actually, I wanted you to open the mounted volume (K:) using HxD to see the state of data.