Comments on: TrueCrapt?

Question: TrueCrapt?

jimmysmits — Wed, 26 Sep 2012 14:53:20 -0800

Any thoughts on recovering lost data from TrueCrypt volume?

I recently started using TrueCrypt for work files. I've been saving the mountable file on a flash drive and periodically backing up by copying and pasting it to my pc. Everything has been going swimmingly until today, when the (considerable amount of) work I did last night is no longer there- as in pre-existing files that I updated are missing the new data, and new files that I created are no longer there.

Any thoughts on recovery?

By: mhoye

mhoye — Wed, 26 Sep 2012 15:49:57 -0800

I you pulled the drive from your computer without unmounting it first, odds are good those bits never actually hit the drive, so there would be nothing to recover.

By: GnomeChompsky

GnomeChompsky — Wed, 26 Sep 2012 17:32:52 -0800

I'm sorry to say this, but as someone who's done data recovery professionally, I think your screwed. Encryption is the bane of data recovery (as it should be). You can try mounting the drive, running a data recovery program like recuvah, but I don't give you very good odds. In the future, if you're going to use encryption, try Windows 8 Pro/Enterprise with BitLocker and File History. Works like a charm.

By: vasi

vasi — Wed, 26 Sep 2012 20:49:37 -0800

Have you tried asking on the TrueCrypt forums? They know better than anyone what your options are.

By: nerdinexile

nerdinexile — Wed, 26 Sep 2012 22:01:12 -0800

More information would be helpful---what platform are you running on, what format are the filesystems on the TrueCrypt volume and the host, and so on. TrueCrypt volumes are virtualized imitations of real hard disks (with blocks and sectors and so on); file recovery options that work for physical disks with your filesystem on your platform should work for the volume. My understanding of your question is that you haven't lost the passphrase to the volume: you can still decrypt and mount it, it's just that your files are missing. If you don't have the passphrase you're pretty much screwed.

By: nerdinexile

nerdinexile — Wed, 26 Sep 2012 22:12:07 -0800

mhoye: If he's using Win7 or Vista, write caching is disabled by default on external disks, so he would not be at risk of losing data unless he pulled the drive in the middle of a write.

By: dgran

dgran — Thu, 27 Sep 2012 05:31:40 -0800

When you set up truecrypt you can create a recovery disk for the purposes of decrypting the volume (you still need to know your password) and running standard recovery tools. Have you tried this?

By: jimmysmits

jimmysmits — Thu, 27 Sep 2012 15:51:42 -0800

Update- found an earlier draft that helps somewhat with recuvah, but there is no indication of any work from that evening anywhere. Will try my luck with the TC forum.

Thanks all.