TestCrypt recovery - not sure of next steps

[ed181]

Hi

I have an external 3TB USB HDD encrypted with TrueCrypt that unfortunately was connected when I installed Windows 8 preview release as dual-boot alongside Windows 7. Afterwards, TrueCrypt failed to mount the drive, reporting "Incorrect password or no TrueCrypt volume found".

Running Disk Management in 64-bit Windows 7 indicates that the drive currently has the following structures:
349.32 GB RAW Healthy (Primary Partition)
1698.68 GB Unallocated
746.52 GB Unallocated

After online research I came upon TestCrypt. I rebooted, hit F8 and selected the option to disable driver signing requirements, then ran TestCrypt. The Analyzer Result found both a normal header (0/8/9-364801/74/9) and an Embedded Backup Header.

I tried right-clicking both rows and selecting the option to Mount, but get the error "Unable to mount the volume: "DeviceIoControl" API call using I/O-Control "TC_IOCTL_MOUNT_VOLUME" failed (30)."

Could you please recommend next steps to try to recover my encrypted drive or the data it contains? Many thanks in advance; I really appreciate your help!!

 

[Simpson474]

The error code 30 returned by the TestCrypt driver is defined as ERR_PARAMETER_INCORRECT. This value is reported in the driver source code at the following location:

// Validate sector size
if (bRawDevice && Extension->cryptoInfo->SectorSize != Extension->HostBytesPerSector)
{
	mount->nReturnCode = ERR_PARAMETER_INCORRECT;
	ntStatus = STATUS_SUCCESS;
	goto error;
}

As a first guess I would say the issue is caused by the fact, that the external USB enclosure fakes a sector size of 4096 bytes instead of 512 bytes in order to be able to use a MBR instead of a GPT partition layout for such a large disk. When creating a TrueCrypt volume the sector size of the disk is stored inside the TrueCrypt header and when mouting a TrueCrypt volume the sector size reported by the disk is compared to the sector size stored in the TrueCrypt header. The question is now why the sector size reported by the disk does not match anymore the sector size stored in the TrueCrypt header. Is the disk still used as external USB disk or has the disk been directly connected to the SATA connector on the mainboard?

 

[ed181]

Ah yes, I had failed to mention that! The first symptom of trouble after the Win8 installation was that the external HDD (a Buffalo DriveStation) failed to power up; I assumed that this was an unrelated failure. A replacement power supply also didn't work; the drive simply never spun up. So I then removed the HDD from the enclosure and connected it via an external USB3-to-SATA adapter, which then seemed to work. So it's still connected via USB3, but with a different controller than that used when the TrueCrypt volume was created. I can certainly connect it directly to the SATA connector on the mainboard if that would help.

 

[Simpson474]

Unfortunately only an USB/SATA-bridge would help which reports to the operating system a sector size of 4K: all consumer hard-disks up till now will always report a sector size of 512 bytes to the operating system when directly connected to the SATA-port on the mainboard regardless whether the physical sector size is 512 bytes or 4K. The only exception are a few USB/SATA-bridges which fake the 4K sectors just to be able to use a MBR instead of a GPT partition table: most probably such controllers are currently only sold together with disks bigger than 2TB. Maybe Ernst@at has better idea than finding another USB/SATA-bridge because he had already some issues here on the forum even without using TrueCrypt encryption.

 

[Ernst@at]

welcome, ed181!

As simpson474 mentioned above, the reason for this fault is the emulation of 4K sectorsize by the box, while the HDD at the SATA interface presents the usually 512Byte size.
The most steady way to get back normal access is to buy another Buffalo DriveStation of the same model number and exchange the HDDs
External HDDs of all vendors with >2TB capacity have specific programmed code inside the bridge controller firmware to accept nothing but a subset of HDD vendors and shows model/capacity dependence, so the result of using one of them is unpredictable.

Afaik the only external case with this 4K feature is the ICY BOX IB-RD3219, a 2-bay case that can also be configured in JBOD mode. It emulates larger disks (2TB too) in 4K sector mode, smaller ones in 512B.
This was ascertained definitively in this troubleshooting thread last month. This guy got into same trouble but in the other way round, when he tried to move internal crypted disks to this ext. case.
I guess this will help to fix this problem

 

[ed181]

Thank you both so much! I had not even considered the issue that you have both diagnosed.

Is it too much to hope that the encrypted volume may still be perfectly intact and that the sole problem may be the different bridge controller?

It sounds as though my next step should be to purchase either a second Buffalo DriveStation or the Icy Box you highlighted and swap in the original disk. Are you confident that the Icy Box would work just as well, or is there a element of doubt to that, and I ought really to just go with the Buffalo?

Also, out of interest, is this issue specific to TrueCrypt-encrypted data or might I have encountered problems moving an unencrypted disk from the Buffalo enclosure to a different USB or mainboard SATA controller?

Thanks once again for all your wisdom!

Ed

 

[Ernst@at]

The Buffalo is the more expensive (good selling strategy!) choice.
This Icy Boy works in exactly the same manner, without any limitation to vendor/model of used hard disk (unlike Buffalo).
The 4K Sector emulation of these bridge chips works regardless of raw or crypted data and inhibits the retention of data when swapping the HDD between ext. case and internal usage in both directions. Unencrypted volumes might be recovered to the other sector size in handwork, encrypted can't be handled this way, because the mount fails and atm it's not realizable (but possible) to manipulate the 2 encrypted Sectors containing the essential information that must be changed.

With a little bit of luck the HDD data stayed fully intact.

349.32 GB RAW Healthy (Primary Partition)
1698.68 GB Unallocated
746.52 GB Unallocated

A closer look to my glass sphere and my calculator shows
349.32[GiB]*8=2794.56[GiB]=3[TB] partition size from erroneous interpreted partition size in sectors
2[TiB]=2048[Gib]-349.32[GiB]= 1698.68[Gib] means Your OS is unable to handle HDD's >2TiB in MBR mode with 512Byte sector size, therefore
2794.56[GiB]-2048[GiB]=746.52[GiB] is permanently unadressable in MBR mode.

So, if the controller didn't fail in operational mode(they mostly get broken when plugging in the power cord or switching on) while writing data, no destruction of the filesystem took place.
Putting it back into a proper case emulating 4K sectors it will show the partition size of 2794.56 in MBR mode, partition is TC mountable and sense of pleasure may take place.

 

[ed181]

Well, that is extremely encouraging! I shall purchase the Icy Box and cross my fingers, toes, and everything else!

I can't tell you how much I appreciate your generosity in taking the time to respond with such detail. It's really kind of you. Thanks again.

Ed

 

[Ernst@at]

Good luck, and don't forget to give us feedback even if it works fine in this prefigured manner.
We need a reference case for similar problems.

PS: I forgot: Before mounting the HDD into this enclosure, it would be recommended to make a backup copy of the contents of the MBR, although it should work non-destructively in switch-selected JBOD mode.

 

[newbie54]

Hi,

I found this thread as I have the same problem as the original poster, my 3TB external HDD fails to mount in Truecrypt after the external USB drive enclosure failed and I switched the drive to another (non-Icybox) USB drive enclosure

When I run Testcrypt on the HDD connected through this "non-icybox" enclosure it finds the embedded backup header at 16/113/34 - 364801/66/1, but when I try to mount it in Testcrypt I get the same error message as the original poster : "Unable to mount the volume: "DeviceIoControl" API call using I/O-Control "TC_IOCTL_MOUNT_VOLUME" failed (30)."

After finding this thread I purchased the IcyBox model listed here below, but now when I run testcrypt with the HDD connected to the Icybox USB drive enclosure it doesn't find any headers at all (normal nor embedded)...what am I missing?

Also the 3TB hdd is detected in Truecrypt as a 2.7TB HDD (with no partition) when connected to the Icybox but when connected to the other "non icybox" USB drive enclosure it is detected as a 2.7TB HDD with a 2TB partition.

I feel there should be something that can be done as Testcrypt is finding the embedded header when connected to the "non-Icybox" USB disk enclosure, but I have no idea how to proceed, any help would be greatly appreciated

Thanks

 

[Simpson474]

There is no official release for TestCrypt supporting 4K sectors but only a link to a special version here in the forum: please try this version with the Icybox USB drive enclosure.