01 June 2010

Recover a TrueCrypt volume after quick format

Background: I have an encrypted RAID0 array for storing data, and a SSD to install windows on. I had some problems with windows, so i decided to reinstall it. I did this without disconnecting the RAID-drives. (I mean, why should i have to?)

So, during a windows installation my encrypted data-drive got quick formated. Since an encrypted drive looks like random data when it is not mounted, I guess windows saw it fit to initialize my apparently unformatted RAW-drive without asking me..

The encrypted drive looked like a normal newly formated drive in windows, and i could mount it with truecrypt using the same password as before, but i was not able to read the drive that was mounted. It was unformatted according to windows.

Solution:

I used my rescue disc and restored the file header. I have no idea if this in necessary, but it did not take long and did not hurt, so i might as well write it here. I then used the data recovery program R-Tools to scan the mounted drive for files. Just like a normal drive. I have used Zero Assumption Recovery before, but i think R-Tools was much faster with equal results. Just took 4-5 hours to scan my 1.2TB drive.

After the scan it was just a matter of restoring the data on the damaged drive to another drive, and then copy it back again.

1 comment :