TrueCrapt?

September 26, 2012 2:53 PM

Any thoughts on recovering lost data from TrueCrypt volume?

I recently started using TrueCrypt for work files. I've been saving the mountable file on a flash drive and periodically backing up by copying and pasting it to my pc. Everything has been going swimmingly until today, when the (considerable amount of) work I did last night is no longer there- as in pre-existing files that I updated are missing the new data, and new files that I created are no longer there.

Any thoughts on recovery?

posted by jimmysmits to Computers & Internet (7 answers total)

Best answer: I you pulled the drive from your computer without unmounting it first, odds are good those bits never actually hit the drive, so there would be nothing to recover.
posted by mhoye at 3:49 PM on September 26, 2012

Best answer: I'm sorry to say this, but as someone who's done data recovery professionally, I think your screwed. Encryption is the bane of data recovery (as it should be). You can try mounting the drive, running a data recovery program like recuvah, but I don't give you very good odds. In the future, if you're going to use encryption, try Windows 8 Pro/Enterprise with BitLocker and File History. Works like a charm.
posted by GnomeChompsky at 5:32 PM on September 26, 2012

Have you tried asking on the TrueCrypt forums? They know better than anyone what your options are.
posted by vasi at 8:49 PM on September 26, 2012

More information would be helpful---what platform are you running on, what format are the filesystems on the TrueCrypt volume and the host, and so on. TrueCrypt volumes are virtualized imitations of real hard disks (with blocks and sectors and so on); file recovery options that work for physical disks with your filesystem on your platform should work for the volume. My understanding of your question is that you haven't lost the passphrase to the volume: you can still decrypt and mount it, it's just that your files are missing. If you don't have the passphrase you're pretty much screwed.
posted by nerdinexile at 10:01 PM on September 26, 2012

mhoye: If he's using Win7 or Vista, write caching is disabled by default on external disks, so he would not be at risk of losing data unless he pulled the drive in the middle of a write.
posted by nerdinexile at 10:12 PM on September 26, 2012

When you set up truecrypt you can create a recovery disk for the purposes of decrypting the volume (you still need to know your password) and running standard recovery tools. Have you tried this?
posted by dgran at 5:31 AM on September 27, 2012

Response by poster: Update- found an earlier draft that helps somewhat with recuvah, but there is no indication of any work from that evening anywhere. Will try my luck with the TC forum.

Thanks all.
posted by jimmysmits at 3:51 PM on September 27, 2012