This project has moved and is read-only. For the latest updates, please go here.

Please help! File names on a mounted volume are turned into wing-dings and inaccesible

Topics: Technical Issues
Apr 15, 2016 at 7:30 PM
Hello. I created a volume and copied files into it and then dismounted it. Today I mounted the volume to access one of the files and found that all file names had been turned into 'wing ding' characters. When I try to click on the wing-ding 'name' the message 'the secified path does not exist' appears.
Is there anyway to retrieve this data?
I wanted to attach a screenshot but I don't seem to be able to.

Thaks in advance for any help.
Apr 15, 2016 at 11:54 PM
Did you create this volume with a hidden volume?

https://sourceforge.net/p/veracrypt/discussion/technical/thread/4f38e824/

Below are data recovery procedures that you can use:
  1. With the VeraCrypt volumes unmounted, make a sector-by-sector backup image of the damaged disk/partition.
  2. Restore the image to another disk.
  3. Using Windows Disk Management, remove the OS assigned drive letter from the RAW partition. Windows will consider the encrypted disk/partition as RAW format.
  4. Mount the VeraCrypt volume on the cloned disk.
  5. Use various data-recovery tools such as R-Studio, GetDataBack, File Scavenger, Photorec, TestDisk etc. in read only mode on the mounted volume in order to recover as much data as possible without altering the volume.
  6. Use filesystem repair tools (which write to disk) such as TestDisk, chkdsk etc. to try to repair the volume's broken filesystem on the hopes of recovering more data.
  7. When you've recovered all that you can, mount and format your original volume and copy your recovered data back into the original volume.
Skip steps 1 through 4 if your data is not that important and you are willing to accept more risk.

Some users skip to step 5 and attempt to repair the filesystem. However you can sometimes do more harm than good and you might recover less data.
Apr 16, 2016 at 3:22 AM
Hello and thanks for the reply.

I didn't create a hidden volume.

Thanks for describing a procedure that might help. It is far more advanced than I know how to handle but I will take each step in turn and see if I can learn and proceed.
By 'sector-by-sector backup image of the damaged disk/partition' do you mean a backup image of the Veracrypt file (volume)? The disk (on which the volume is stored) is 1TB which seems to be too big to make a back up.

I really can't understand why this volume has turned to 'wing dings'. I have other volumes which work without problems.

Best regards
Apr 16, 2016 at 4:11 AM
Is it perhaps leading to this:
http://www.techspot.com/news/64415-petya-ransomware-cracked-here-how-get-data-back.html

I believe it encrypts the NTFS file system data.
Apr 16, 2016 at 4:37 AM
Edited Apr 16, 2016 at 4:51 AM
@paulc2626,

Did you create a file container or did you encrypt an entire disk or partition?

Example of creating a file container.

https://veracrypt.codeplex.com/wikipage?title=Beginner%27s%20Tutorial
Apr 16, 2016 at 6:14 AM
Hello.

I created a file container and then copied a number of 'ordinary' files into it. I didn't encrypt an entire disk or partition.

I don't think this problem is related to 'ransomware' as my computer seems to be generally ok.
Apr 16, 2016 at 10:07 AM
In case it is of any use. When I mount the file container the contents look like this.

http://imgur.com/IfN3M1Z
Apr 16, 2016 at 2:40 PM
Edited Apr 16, 2016 at 2:42 PM
Below are data recovery procedures for file containers that you can use:
  1. With the VeraCrypt file container volumes unmounted, make a copy of the file container which will be referred to as the clone.
  2. Mount the cloned VeraCrypt file container volume.
  3. Use various data-recovery tools such as R-Studio, GetDataBack, File Scavenger, Photorec, TestDisk etc. in read only mode on the mounted file container volume in order to recover as much data as possible without altering the volume.
  4. Use filesystem repair tools (which write to disk) such as TestDisk, chkdsk etc. to try to repair the volume's broken filesystem on the hopes of recovering more data.
  5. When you have recovered all that you can, mount and format your original file container's volume or create a new file container and copy your recovered data back into the original or new file container volume.
Apr 16, 2016 at 4:32 PM
Super. Thanks for the instructions. I'll follow them and see what I can do.

Best regards,
Paul