Recover a TrueCrypt Volume
TrueCrypt is a popular on-the-fly encryption for Windows - it is also available for Mac OS X and Linux. It can create a file-hosted container or write a partition which consists of an encrypted volume with its own file system (contained within a regular file) which can then be mounted as if it were a real disk. TrueCrypt also supports device-hosted volumes, which can be created on either an individual partition or an entire disk. Because presence of a TrueCrypt volume can not be verified without the password, disk and filesystems utilities may report the filesystem as unformatted or corrupted that may lead to data loss after incorrect user intervention or automatic "repair".
Corrupted Standard Volume header
The standard volume header uses the first 512 bytes of the TrueCrypt container. It contains the master keys needed to decrypt the volume. If the header gets corrupted or the container reformatted, TrueCrypt will display
Incorrect password or not a TrueCrypt volume..
Using a backup of the volume header is the only possibility to recover the data.
Corrupted Hidden Volume header
The 512 bytes hidden volume header is stored 1536 bytes from the end of the host volume. It's very unlikely that it becomes corrupted but as previously stated, using a backup of the volume header is the only possibility of recovering the data.
Corrupted Standard Volume file system
Sometimes both Standard Volume header and filesystem boot sector are partially overwritten. After recovering the volume header using a backup, the volume can be accessed but the filesystem is still corrupted.
Recovery under Windows
Recovery using whole decryption
Another method is to permanently decrypt the damaged system partition/drive. You can use the TrueCrypt Rescue Disk and next use TestDisk. Run TestDisk, select the drive letter or partition corresponding to the damaged volume, go in the Advanced menu, force the type if necessary and choose Boot (FAT or NTFS) or SuperBlock (ext2/3/4). TestDisk can repair the FAT/NTFS boot sector, ext2/ext3/ext4 superblock.
Recovery under Linux
Find the fuse device and run TestDisk on the volume device.
$ ./truecrypt -t --filesystem=none /data/data_for_testdisk/truecrypt.dd Enter password for /data/data_for_testdisk/truecrypt.dd: Enter keyfile [none]: Protect hidden volume? (y=Yes/n=No) [No]: Enter system administrator password: $ mount ... truecrypt on /tmp/.truecrypt_aux_mnt1 type fuse.truecrypt (rw,nosuid,nodev,allow_other) $ sudo testdisk /tmp/.truecrypt_aux_mnt1/volume
Corrupted Hidden Volume file system
If too much data has been stored in the standard volume or if you have tried to defragment the standard volume without protecting the hidden volume (
truecrypt --protect-hidden), the hidden volume file system may be partially overwritten. TestDisk Advanced menu can be used to rebuild the missing FAT or NTFS boot sector.