This project has moved. For the latest updates, please go here.

Restoring Header / Copying Header Manually for partially overwritten volume

Topics: Users Discussion
Mar 17 at 8:48 PM
I have several Veracrypt volumes that are all copies of an original volume, but inside each volume I have changed the files. So all my veracrypt volumes have the same encryption, password, salt, etc., just the content is different.

I accidently deleted one volume and partially overwrote it, but managed to recover it using TestDisk.
The recovered file is the same size as the original, but because it is partially overwritten I cannot mount it in Veracypt. I assume this is because the headers are corrupted.

I made a back up header using one of the copies and tried to use Restore Volume Header on the restored file. This doesnt work. I assume because a different salt is used,

I have 2 questions:

1) Is there a way to back-up and restore a volume header without changing the salt?

2) Could it work if I use 'dd' in Linux to copy the header from the original file to the restored copy? If so, any idea of the block size I need to use?

Any help would be appreciated!
Mar 18 at 12:30 PM
1 - salt place is start of header (it does not affect restore/backup)
2 - dd is possible.

Main header sector - 0 ordinary, 128 hidden
Backup header - end of volume minus 255 is ordinary, end of volume minus 127 is hidden

To bruteforce sectors tool is DcsFV (better from entire DCS package)
Mar 21 at 8:54 PM
Kavsrf thanks for the clarification and the link, although I am not sure what DcsVF does.