This project has moved and is read-only. For the latest updates, please go here.

VeraCrypt file container header corrupted


Hope you can help me. I have a VeraCrypt file container ("filea.vvv") of 45 GB encrypted on a micro SD card. Somehow it became corrupted. I plugged the card into my Windows 8.1 machine and it said the volume was corrupted. It asked to run a disk repair and I allowed it to run (probably a mistake). Now, File Explorer and VeraCrypt both show 0 (zero) files on the card. However, when I click on "Properties" for the drive it shows that 40 GB is used of a 60 GB drive. So, somehow Windows thinks the space is taken up by something.

I tried unsuccessfully to mount the device which shows in VeraCrypt as:
Removable Disk 2: 59.6 GB
\Device\Harddisk2\Partition1 Drive E: 59.6GB

I tried both Removable Disk 2 and \Device\Harddisk2\Partition1 with the mount option "use backup header embedded in volume if available". It still failed with "Incorrect password or not a VeraCrypt volume". I am absolutely certain the password is correct - I copy it from a password manager.

I also tried restoring the volume header from the one embedded in the volume. No luck.

The data is out there. Is there any way to rebuild the FTOC to get a filename to mount?


Enigma2Illusion wrote Sep 24, 2015 at 10:26 PM

In your case, since the encrypted volume is a file container, there is no reason to attempt mounting the \Device\Harddisk2\Partition1 or Removable Disk 2 since this is the device.

You can try to use file recovery tools in attempt to recover the file container that you named "filea.vvv".

Safest approach is to clone the micro SD card and perform all of your repair attempts on the clone. Trying to repair the filesystem can actually make things worse. Using a clone of the removable drive will let you start again by making a fresh clone to try various data recovery methods without impacting the original micro SD card.

You can try various tools data-recovery tools such as GetDataBack, R-Studio, Photorec, TestDisk etc. in read only mode on the clone in order to recover as much data as possible without altering the volume.
Use file system repair tools (which write to disk) such as TestDisk, chkdsk etc. to try to repair the volume's broken file system on the hopes of recovering more data.