This project has moved. For the latest updates, please go here.

Recover data from partitioned encrypted external HDD

Topics: Technical Issues
Mar 14, 2015 at 3:16 PM
Hi! I have a problem. I have a external usb drive with 2 partitions . 1st partition is FAT32 (P:) (maybe 40 MB big) and NOT encrypted ... just to save veracrypt. The other partition was formated WITH VERACRYPT (R:) (~460 GB). Afterwards I selected the mounted drive and formated the NTFS to exFat. That was 6 months ago and everything was okay. Today when I startet my computer and mounted the partition with VeraCrypt it accepts the password but the new drive (X:) shows no info like a unallocated partition and windows wants to format it. Well this is, like I heard a common problem when the power supply suddenly is interupted. I searched for a tool for rebuilding the file system BUT I am only able to select P:\ OR R:\ , AND NOT X:\ WHICH I NEED. Is there a way to decrypt this NON-SYSTEM partition like a common VC system partition? I backed up the headers and everything but can't find an option. Have you maybe a suggestion what I may do to recover my data? TIA!!!!
Mar 14, 2015 at 5:02 PM
Today when I startet my computer and mounted the partition with VeraCrypt it accepts the password but the new drive (X:) shows no info like a unallocated partition and windows wants to format it.
.
When you used the Select Device button and selected the partition that is encrypted, what drive letter in VeraCrypt was selected? X or R? Since you can mount the partition using drive letter X, the drive letter being assigned is what you selected in the VeraCrypt main program. You may not have realized that it was mounting to X when you meant to mount to R drive letter.

When the encrypted partition is unmounted, make sure Windows does not have a drive letter already assigned to the unmounted encrypted partition. Use the Disk Management for the unmounted volume from Windows using the Change Drive Letter, then Remove.

.
Is there a way to decrypt this NON-SYSTEM partition like a common VC system partition?
.
Currently not possible. A request has been created to allow in-place decryption of non-system drives/partitions. You can vote-up the request at the link below.

https://veracrypt.codeplex.com/workitem/35

.
I backed up the headers and everything but can't find an option.
.
Since you can already mount the volume successfully in VeraCrypt to drive X letter, restoring the header keys will not fix a corrupted filesystem. However, here are the procedures for future reference.

Using Windows OS in the main window, select your device partition that has been encrypted.

First try to mount using the embedded backup header. When you click the mount button, you will get another pop-up window with a Mount Options button. Click that button and check the box for "Use backup header embedded in volume if available". Then enter your password and click OK.

If you are still unable to mount the volume and you have the external backup of the header keys as a file, then you can restore the header keys by selecting your device partition, click the Volume Tools button and select Restore Volume Header.

Once you can mount the encrypted volume, you may need to use software recovery tools to fix the filesystem and/or recover files.
Mar 14, 2015 at 10:19 PM
Edited Mar 14, 2015 at 10:29 PM
I added Screenshots and hope you now know what I described.
I can mount without problems but the partition shows me NO file system if it weren't allocated.. but before my reboot it worked, I didn't delete or format anything.
I can't reach the virtual TC drive X: for fixing file system....
But I really need this files :/
Please help me if you can!
Thank you so much!
http://abload.de/img/tc324633487286pvuk5.jpg

http://abload.de/img/tc32463286uvuxn.jpg
Mar 15, 2015 at 1:46 AM
Problem 1

Thank you for the pictures. In the future, you can include the pictures in your post when you click on the reply by clicking on the square box with the sun rising over the mountains inside the square. Some people will be leery of clicking on links to see pictures.

Before you get started, clone the drive to another drive with the volume unmounted from VeraCrypt.

It appears that you have left the Windows drive letter on the partition since the R drive is showed in the drive listings of VeraCrypt. The device for VeraCrypt should not already have a drive letter.

Please remove the Windows drive letter from the partition using the instructions I included in my post above.

Recovery

The following is information I kept from the TrueCrypt forum member Dan who is the expert in recovery with encryption.

If your volume's file system has been damaged such that your operating system can't find any files then you have to deal with that issue separately. The job becomes one of data recovery.

I'll sketch out a approximate procedure you might want to follow:
  1. Make a sector-by-sector backup image of the damaged partition.
  2. Restore the image to another disk.
  3. Mount the copy of the volume.
  4. Use various data-recovery tools such as GetDataBack, R-Studio, Photorec, TestDisk etc. in read only mode on the mounted volume in order to recover as much data as possible without altering the volume.
  5. Use file system repair tools (which write to disk) such as TestDisk, chkdsk etc. to try to repair the volume's broken file system on the hopes of recovering more data.
  6. When you've recovered all that you can, mount and format your original volume and copy your recovered data back in.
Skip steps 1, 2 and 3 if your data is not that important and you are willing to accept more risk.

Some users even skip step 4 and jump right into repairing the file system, but be warned that you can sometimes do more harm than good and you might recover less data that way.
Mar 15, 2015 at 5:58 AM
Edited Mar 15, 2015 at 1:31 PM
In my case the sector-by-sector copy should be made of R: , right?

Well I'll try. Thank you.
Mar 15, 2015 at 2:23 PM
Edited Mar 15, 2015 at 2:23 PM
In my case the sector-by-sector copy should be made of R: , right?
Correct.
Mar 15, 2015 at 7:07 PM
hmm with ease US todo backup I tried a sector-by-sector copy of R: but after 6 hours it was still at 0%. very strange!
Mar 16, 2015 at 11:10 AM
I tried photorec and it works but was very slow.. in 90 minutes I recovered 3 jpgs. It showed me a remaining time of 2000 hrs! Rebuilding of the file system wasn't sucsessful so I quick formated the drive and now run File Scavenger. In 8 hrs I recovered 39000 files.
Mar 16, 2015 at 6:17 PM
Were you unable to clone the partition to perform the recovery tasks?
Mar 18, 2015 at 2:44 PM
Yes, cloning the partition failed, testdisk, photorec, recuva etc. failed. (photorec kind of worked but too slow ~2 hrs for 3 files... 2000 hrs is crazy) I did a quick format and kind of build a new file system. Then the recovery worked and took about 8 hrs in total.