worselin
asked on
how to recover formatted truecrypt partition
Hi, recently I did a factory recovery on my lenovo laptop and I did in an unusual way, I did the recovery from the Windows XP rescue and recovery dvd (originaly there was a Windows 7 OS on my laptop) and I was kinda suprised that the recovery process formated the entire physical drive instead of just C:\ (system volume).
Thing is that there was one small truecrypt partition (E:\) with a valuable data on it and now I want to get it back! I am looking at the drive in some recovery software, I can see all the data from my data volume (D:\) and they are just ok but I do not want to touch the drive in any way till I get the idea how to recover the truecrypt partition.
I was already checking this site and found this https://www.experts-exchange.com/questions/23780932/How-would-one-recover-a-TrueCrypt-partition-inadvertently-deleted-during-Windows-XP-setup.html but it was of no use to me. The Norton Disk Doctor is really hard to find and it's functionability is, I guess, outdated. I also found out that from functional point of view programs such as GetDataBack and TestDisk are not for me at this point. Besides the question on that link is concerned on truecrypt volume that spanned the entire drive, which is not my case here.
The biggest problem here is that during the factory recovery process the drive was not only formatted but it also installed a new copy of windows XP, so, some files may have been overwrtitten (looking at the drive through, for example, GetDataBack, shows that the majority of files is still rescuable) and there is a new NTFS volume that span the entire disk.
So, my question here is how do I recover that truecrypt partition ? I am not concerned about anything else what was on this drive. Thanks.
Thing is that there was one small truecrypt partition (E:\) with a valuable data on it and now I want to get it back! I am looking at the drive in some recovery software, I can see all the data from my data volume (D:\) and they are just ok but I do not want to touch the drive in any way till I get the idea how to recover the truecrypt partition.
I was already checking this site and found this https://www.experts-exchange.com/questions/23780932/How-would-one-recover-a-TrueCrypt-partition-inadvertently-deleted-during-Windows-XP-setup.html but it was of no use to me. The Norton Disk Doctor is really hard to find and it's functionability is, I guess, outdated. I also found out that from functional point of view programs such as GetDataBack and TestDisk are not for me at this point. Besides the question on that link is concerned on truecrypt volume that spanned the entire drive, which is not my case here.
The biggest problem here is that during the factory recovery process the drive was not only formatted but it also installed a new copy of windows XP, so, some files may have been overwrtitten (looking at the drive through, for example, GetDataBack, shows that the majority of files is still rescuable) and there is a new NTFS volume that span the entire disk.
So, my question here is how do I recover that truecrypt partition ? I am not concerned about anything else what was on this drive. Thanks.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
noxcho
Even if you manage to recover the data it will be encrypted and your attempts to get that data readable will fail. Forget about the data and partition. Next time take backups of the data.
ASKER
nobus:
the software from www.pttd.com seems to be quite useful, I can see my data parrition (D:\) recoverable as whole and then there is a recoverable linux ext3 partition of 7mb size (that seems weird, I've never tried linux on this machine and the encrypted partition was 7-8gb big)
Now I am gonna try to recover data from the D:\ parition (not the partition itself) and then I will probably try to recover the partition itself and see, if my encrypted drive will show up.
the software from www.pttd.com seems to be quite useful, I can see my data parrition (D:\) recoverable as whole and then there is a recoverable linux ext3 partition of 7mb size (that seems weird, I've never tried linux on this machine and the encrypted partition was 7-8gb big)
Now I am gonna try to recover data from the D:\ parition (not the partition itself) and then I will probably try to recover the partition itself and see, if my encrypted drive will show up.
good luck !
ASKER
Gave up. I was actualy able to retrieve ALL the data from former D:\ drive but I can't get the table for the encrypted partition up and running. So I guess that it is all lost then.
Well, thank you and have a nice day.
Well, thank you and have a nice day.
Look, encryption is not done the way you could easily recover and decrypt the data. If it would be possible then Truecrypt has zero penny value. Nobody would trust it. That's why I mentioned that your attempts are useless.
ASKER
well I heard about cases where one was able to get the partition table up and running, that was my only goal. sure, the data would still be encrypted.
Amen
ASKER
I did not get all my data back, but I believe that was because I already wrote some data to the harddrive and therefore I destroyed the partition table.
tx for the feedback !