I read that it was one of the characteristics of TrueCrypt. The flash drive size is 32 Gb and my container file has 3 Gb. I'm still not comfortable but I can do some actions. Since, I've learned a little bit more about WinHex. I understood that the only way to hope recovering my container file is to use WinHex. Many thanks for offering your help ! I don't want to annoy you though. I suggest you practice on a non-essential drive, and to play it safe, make sure "Option: Edit Mode" is set to "Read Only mode".
Specifically, play with "Navigation: Go to Offset: Relative to current position", try manually selecting blocks up to about 20KB in size, "Tools: Analyze Block" (and see if you can notice the difference between encrypted data and plaintext data), "Edit: Copy Block: Into new file", "Search: Find Hex Values: 0000000000" (both up and down) and more.
Veracrypt delete volume how to#
In the meantime, I suggest you start learning how to use WinHex.
Veracrypt delete volume free#
When I get some free time I will post the steps in this thread. We can stay in touch via Wilders' private message. Still interested? If so, give me awhile to get through my current backlog of projects. Do you have the time and the inclination to learn how to use WinHex?Īlso, be aware that the evaluation copy is ok to get you started, but if we do manage to find your lost file and you want to recover it (by copying it, or some of it, to another disk) then you'll need to have a licensed copy, as the eval copy can't copy large blocks of data. You'll need to become an experienced user. I can post the steps, but there's a lot of decision-making involved, so you can't just follow them blindly. You said earlier that you weren't comfortable with WinHex, so I have been somewhat hesitant to spend several hours (and that's really how long it will take me) to assemble and post a detailed procedure, much of which will involve showing you how to use WinHex and what to look for, just on the admittedly slim chance that it might actually work. It might also be fragmented (especially on a flash drive), which makes matters much worse, as it's often hard to find the endpoints, and the reassembly of the file needs to be exactly right or it won't work. It's much harder to recover a lost TrueCrypt container file than a lost TC partition, as it can be located practically anywhere on the drive and it's not easy to identify.
You can try doing it manually, but it will involve following a fairly lengthy WinHex/TrueCrypt procedure, and there can be no guarantee of success. I haven't found a good automated solution for you yet. I don't know how to find the 1st sector of my container file and what to do and how to recover it.Īs the container file is protected by a password, is it possible to recover some files hosted in this container? I select "Org.BS" but it says it can't overwrite FAT32 boot sector. it says "Boot Sector ok" "Backup Boot sector bad". I quit because because I'm afraid making things worse. When I continue (enter) then I can write or quit. I select "Quick Search" and "Deeper Search".
Then I went to "Analyse", the warning disappears but I still have Bad relative sector. So I came back and choose "Geometry" and "Heads" and enter "128". warning: number of heads/cylinder mismatches 128 (FAT) !=255 (HD) With TestDisk, after choosing "Analyse", it says: I've tried Recuva and many files are found, even some deleted ones, but not the container file. When I extract (with 7Zip) the content of this image, it creates a folder with 10 000 chk files of 32Kb size and nothing else. This image has the size of USB Flash Drive, 28.86 Gb.
I've tried R-Studio and created an image.
0 kommentar(er)
