Anyone have experience with WinHex and recovering lost TrueCrypt partitions...

Quick question, did you boot from the disk(number 1)?

Does this look OK?

Not sure what you mean. TrueCrypt? I encrypted the entire drive, including the host-protected area.

I have used Winhex when I had truecrypt issues before. Not sure what issue you're having but in my case winhex was used just to verrify that indeed my data was still on the device. Turn out my problem was that the device lost it's partition table somehow when I plugged it into my new computer. All I had to use winpart to manually put it back, copy pasting the numbers from the forum thread I was following. The forum in is probably where I found my solution. Not sure what thread exactly; it was a miracle I was able to find the thread with my exact problem.

Please, if you remember the exact steps you took, please let me know

what happens when you select the device to be mounted?

Gives this error, even if I delete the drive letter so it's no longer recognized by Windows

ok. create a screenshot of windows disk management

I am almost certain this is the thread that solved my problem. Give it a read as see if it seems applicable to yours.

wilderssecurity.com/threads/corrupted-truecrypt-partition.327959/

...

Ok first.
1. It is mounted at e:

However it seems you formatted the drive with NTFS .........., when did you do this?

I didn't format anything. I did mount it as "e:" though to try to get TrueCrypt to recognize it.

You can't, for full disk encryption you mount the device, that is why you get the error that it is in use. So remove the drive letter. When you select the device then you must get prompted with a password by truecrypt.

My memory on Truecrypt is somewhat fragmented now, but you should be able to mount the disk directly without selecting a partition. Selecting the first parition will not work because of it being formatted with NTFS, your only bet is that your header is still intact within the 101 unallocated part.

HAHAHAHAHAHAHAHAHAHAHA
HAHAHAHAHAHAHAHAHAHAHA
HAHAHAHAHAHAHAHAHAHAHA
I ALREADY KNOW WHAT YOUR PROBLEM IS AND I HAVE ZERO KNOWLEDGE WITH HEX/DATA RECOVERY
LMAO

JUST INSTALL LINUX AND DITCH WINDOWS HONESTLY

windows probably formatted the drive during the install on the second drive

OKAY FAGGOT

WINDOWS DOESN'T RECOGNIZE ANY PARTITION BUT THE FIRST IF IT WAS NOT CREATED BY THEM (SO ONLY THE ORIGINAL INSTALLATION CAN HAVE MULTIPLE PARTITION THAT IS RECOGNIZED AS SEPARATE ENTITY )
YOU HAVE YOUR DATA ON THE SECOND PARTITION OF THE DISK, THE 100MB BLACK PART OF THE DISK IS THE FIRST PARTITION WITH A PARTITION LABEL/ID THAT IS NOT RECOGNIZED BY WINDOWS (WINDOWS ONLY RECOGNIZES FAT AND NTFS: THATS TWO OUT OF 100+ LINUX/BSD RECOGNIZEDS)
YOUR FIRST DISK PARTITION IS PROBABLY NOT CORRUPTED BUT THE SPACE HEADER
WINDOWS ALSO PLACES ARBITRARY RESTRICTIONS ON ITS DISK MANAGEMENT ON ITS USER, ONE OF THE MOST ANNOYING ONE WAS UNABLE TO CREATE A FAT32 PARTITION THAT'S BIGGER THAN 32GB

on linux you can select a drive letter like

:/E as :/E1

what is happening is that you need to mount your volume as :/E1 instead of :/E
maybe you're selecting :/E on the GUI instead of :/E1 as you're supposed to

this would look like

/dev/sdb: 700GB
/dev/sdb1: 100MB
/dev/sdb2: 698.54GB (select this one on the GUI)

on a linux live USB

DOWNLOAD LINK: dl.amnesia.boum.org/tails/stable/tails-i386-2.3/tails-i386-2.3.iso

You can only recover a TrueCrypt partition with winhex if the header and only the header is damaged. Even then, unless you have a backup laying around it won't do much good.

One option is to attempt to fix the filesystem of the encrypted partition in question, however this doesn't always work and AFAIK only Veracrypt has that functionality.

I'd just let go of the data user. You aren't getting it back.

This is wrong, his partition is formatted with NTFS.

He said he used Full disk encryption, the fact that there is a NTFS parition is already a huge red flag that something went horribly wrong. That should not be there.

The header would be in the 101 MB unallocated part so he would have to select /dev/sdb.

There is also the option of using the rescue disk that you are forced to make by truecrypt which contains the header. If he has that he could save most of his data. But something tells me he does not have the rescue disk.....

Actually bro just use the braindead guide

tails.boum.org/install/win/usb/overview/index.en.html

simplify =

step 1.
download the image with the addon
step 2.
download the .iso
step 3.
download UUI USB Installer
step 4. burn it onto a spare USB with atleast 4GB

this might be very very hard for you but you need to change boot order in the BIOS

lolno

sage

Actually, Windows 7 sees a drive with random data as a RAW drive that needs formatting.

In this case that he can access the drive at all means it was probably reformatted somewhere along the way.

**these people are trying to scare you
do as i say your header is most likely fine**

run a liveCD linux and try it there with truecrypt
follow my post and instruction

symantics

Anyway, OP,

Last ditch effort
- Make a bootable usb with tails
- once booted go to the console
- type: lsblk
- in the overview look for the device name of the 700GB drive (sda or sdb etc)
- type the following command: cryptsetup open --type tcrypt /dev/sda myvolume
-type: mkdir /mnt/myvolume
-type: mount -o uid=1000 /dev/mapper/myvolume /mnt/myvolume

If there are no errors you are good, go to the filke manager in the gui.

we don't know that

You're BLIND
IN the picture OP posted he clearly have two partition within his 700GB (720GB) drive

in any unix system it would show up as /dev/sdb, sdb1, sbd2

look at the picture again dip shit, it is a 700GB drive with only one partition, the first 101MB is unallocated the other parition has 699GB! Linux would only see sdb and sdb1

Have you ever used Unix or Encryption software before?
Ever used diskpart on windows or fdisk/gparted on linux?

;)

op take the redpill and come join the free world of coding hacking rice loli

M$ is not $AFE $OFTWARE, they have your key and password and you're a $lave to them

if you cannot post try posting from sys.8ch.net/tech/res/588659

Wish I could, but it doesn't show up. Also, mounting the drive says there's no TrueCrypt data BUT mounting the partition says it's still in use, even after de-lettering the drive

click on device/harddisk1/partition 1

and not harddisk 1:

i notice it doesn't have a drive letter - you might need to give it a drive letter on diskpart

I get this error:

If you ever leave M$-D0$ you should rewatch the matrix: know that supporting non-free programs will lead to a designer AI that no one can stop.

All these doomsday scenarios would not actualize with true free software/hardware. While computering is still dimensionally primitive, and people with some societal autonomy can still interact with physicality of machines and its blueprint, eventually there will be no such lone team/engineer that can fix closed CVE and rid a major problem - and we wouldn't even have such an individual to place hope on.
We get one chance and one chance only!

So apparently even removing the drive letter AND restarting won't get rid of the "Already in use" error I get when I try to mount the partition. Nothing is using it. Why am I getting this error?

Ctrl + Run
diskpart.exe

assign drive letter

if you still can't get it to work, boot a livecd - i know you haven't done it, after you've downloaded one and booted it, you'll need to download a copy of a truecrypt linux program 7.1, if you use tails, you'll need a i386/32bit program to run it

this drive letter nonsense is courtesy from microsoft... and by the way no other operating system on earth call their system partition a boot partition and their actual boot partition a system partiton - only microsoft does this

...

I don't think this is right, it's asking me for Linux, not TCplay:

At this point this is a tech support thread, fuck off if you cannot even operate windows or assign drive letters in that horrible fucking operating system.

well fuck