Hi!
A few days ago I (foolishly) used Disk Management in Win7 to delete a volume which was encrypted with TrueCrypt whilst attempting to only 'remove' the drive letter designation. A few hours of anxious internet searching finally pointed me in the direction of the brilliant TestCrypt which allowed me to recover all my encrypted data without loss- Simpson474 is clearly a genius- thankyou!
My next step is to see whether I can repair the original volume back to how it was before- this is not really necessary since I do have all the data, but I'm keen to learn from my mistake. The volume in question is a 1TB external HDD attached via USB and it orignally had a single partition. A number of posts I have read seem to suggest that it may be possible to simply use Windows Disk management to create a new simple volume (without formatting etc) and hope/assume it creates the partition exactly where the old one used to be. A safer option would be to use a hex editor and try to identify where the old partition started and then manually create a new one in the same place.
Before I attempt either I am currently using TestCrypt to try to identify where the backup TrueCrypt header may be: TestCrypt found the original header fine, but so far has not been able to identify the backup so I am working my way backwards from the end of the disk to search for it. I would prefer to confirm it is there before I start playing with re-creating the partition since I gather that doing so may change the front of the file.
My questions:
- Is there a way in Testcrypt to take a backup of the TrueCrypt headers that it has found?
- Am I wasting my time and should I just try to re-create the volume using Windows Disk Management?
- If it is indeed a bit more complicated than that, could anyone post or link to a brief guide on what needs to be done?
Many thanks in advance, and thanks again to Simpson474 for TestCrypt- it is an excellent program which has turned my foolish mistake from a disaster to a valuable learning excercise!
A few days ago I (foolishly) used Disk Management in Win7 to delete a volume which was encrypted with TrueCrypt whilst attempting to only 'remove' the drive letter designation. A few hours of anxious internet searching finally pointed me in the direction of the brilliant TestCrypt which allowed me to recover all my encrypted data without loss- Simpson474 is clearly a genius- thankyou!
My next step is to see whether I can repair the original volume back to how it was before- this is not really necessary since I do have all the data, but I'm keen to learn from my mistake. The volume in question is a 1TB external HDD attached via USB and it orignally had a single partition. A number of posts I have read seem to suggest that it may be possible to simply use Windows Disk management to create a new simple volume (without formatting etc) and hope/assume it creates the partition exactly where the old one used to be. A safer option would be to use a hex editor and try to identify where the old partition started and then manually create a new one in the same place.
Before I attempt either I am currently using TestCrypt to try to identify where the backup TrueCrypt header may be: TestCrypt found the original header fine, but so far has not been able to identify the backup so I am working my way backwards from the end of the disk to search for it. I would prefer to confirm it is there before I start playing with re-creating the partition since I gather that doing so may change the front of the file.
My questions:
- Is there a way in Testcrypt to take a backup of the TrueCrypt headers that it has found?
- Am I wasting my time and should I just try to re-create the volume using Windows Disk Management?
- If it is indeed a bit more complicated than that, could anyone post or link to a brief guide on what needs to be done?
Many thanks in advance, and thanks again to Simpson474 for TestCrypt- it is an excellent program which has turned my foolish mistake from a disaster to a valuable learning excercise!
