This project has moved and is read-only. For the latest updates, please go here.

Veracrypt 1.17 Win10x64 Mount Fails

Topics: Technical Issues
Apr 2, 2016 at 1:17 AM
The 300GB disk image was created locally as a file on my machine with Veracrypt, secured with a password.

It was working fine for a few weeks, and then one day suddenly stopped working.

Whenever I try to mount it using the password I specified during creation, this error occurs:

Auto-mount failed due to one or more of the following:
  • Incorrect keyfile(s)
  • Incorrect password
  • Incorrect Volume PIM number
  • Incorrect PRF (hash)
  • No valid volume found.
I've tried mounting the embedded backup header to no avail
Error MountVolume:7336

I've tried restoring the volume header with the built-in tool in Veracrypt
Error RestoreVolumeHeader:9730

Do you guys have any other ideas? Thank you in advance.
Apr 9, 2016 at 5:39 PM
I have the same error code win10-x64 when I try to convert a TrueCrypt (TC) volume to a VeraCrypt (VC) volume by changing the password.

The error occurs when you try and mount the VC volume after VC has completed whatever it does when you change the password. I was using the same password for the new password as was used on the original TC volume.

Good job I tried it on a copy first.
Apr 9, 2016 at 7:39 PM
I just tried and created brand new VC volume, then changed the password and could mount it with the new password without problems. On Windows 7 though.
Apr 28, 2016 at 8:07 AM
Bumping. Still at a standstill on this.
Jul 12, 2016 at 4:42 AM
Edited Jul 12, 2016 at 4:43 AM
charliedaemons wrote:
Bumping. Still at a standstill on this.
The only hope I see is if previously you made an external backup of the header to a file using the Tools option "Backup Volume Header". Did you previously make an external backup of the header?
Jul 12, 2016 at 5:20 AM
I did not make a backup header from what I recall, but I'll check to be sure.

If only I knew the importance of data when I was making the archive... I may end up using something like FTK Imager and try to do some data carving; I have 800GB of free space left on that drive.

Is there any way to brute force/manually reconstruct a header? I'm ready to get down and dirty at this point.
Jul 12, 2016 at 3:58 PM
Edited Jul 12, 2016 at 4:13 PM
I assume you have enabled displaying the password/PIM to make sure that the characters being typed on your keyboard are the same characters being received in the login screen.

Some users have accidentally manage to change their keyboard language or layout causing password failure.

Are you selecting the correct PRF (hash)? Have you tried Autodetection for the PRF (hash) in case you are selecting the wrong hash?

If you are using keyfiles, do you have a backup of the keyfiles to attempt the mount?

If you are using Windows 8 or higher, make sure to disable Fast Startup.

http://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html

Fast Startup issues I am aware of are:
  • Prevents System Favorites from working.
  • Windows does not shutdown completely leaving security issues by not prompting password for VeraCrypt volumes and leaving VeraCrypt volumes mounted.
charliedaemons wrote:
Is there any way to brute force/manually reconstruct a header?
I do not know.

What I find strange is normally, only the primary header is damaged since the embedded backup header is at the end of the volume. Somehow, both the primary and embedded backup headers are not allowing you to login. I am wondering if there is a hardware issue.
Jul 14, 2016 at 3:29 AM
Thanks for the reply, Enigma.

I ended up typing my password into Sublime Text to verify that I was typing it correctly, and the keyboard is set to US English, which is correct.

I am selecting autodetect as the hash.

I do not have a keyfile, sadly.

I have disabled fast startup as of now.

I unplugged the HDD that my veracrypt archive is located on since yesterday; I will be using a write blocker with FTK Imager to capture the HDD just in case I manage to recover anything.

Once I have an image of the drive, I am going to move the archive to my laptop via UNC path and try to mount it from there and see if that works. I'll be back here with an update within a few weeks.

If you think of anything in the meantime, feel free to post :).
Jul 14, 2016 at 4:41 AM
I look forward to your update with hopefully good news.

charliedaemons wrote:
I do not have a keyfile, sadly.
I think you are misunderstanding what a keyfile(s) are in VeraCrypt. The first 1 MB of the keyfile(s) is read and combined with the password. See the link below for more details.

https://veracrypt.codeplex.com/wikipage?title=Keyfiles%20in%20VeraCrypt
Aug 6, 2016 at 12:29 AM
Yeah, I did not select a keyfile when I created my archive to my knowledge.

I have recovered quite a few things I've deleted, but I'm not sure that I recovered anything super important from the archive. It took three days to image and carve my 2TB drive, which had my 300GB veracrypt archive on it.

I also moved the archive to my laptop and I'm encountering the same errors with Veracrypt (also veracrypt 1.17, win10x64)

I'm wondering if I somehow managed to change my password and not remember at this point, but that seems as unlikely as the header and backup header getting damaged.

I'm out of ideas at this point besides brute forcing my volume, which I may do.