5

I have a truecrypt file that contains an ext3 file system. Not sure exactly how to word this, but is there a way I can mount the truecrypt volume without actually mounting the filesystem within it so I can attempt to repair it with fsck?

So I have (ext3 filesystem(TrueCrypt File( Ext 3 Filesystem ))). I want to run the check on the one in bold.

I have of course made a copy of the file already. I can still mount it, but I have deleted files and df still shows as full, so I am thinking there is maybe a bad superblock?

Kyle Brandt
  • 82,107
  • 71
  • 302
  • 444

3 Answers3

4

Followed the instructions in http://www.cgsecurity.org/wiki/Recover_a_TrueCrypt_Volume. The only thing is that I had to recover from one of the backup super blocks. You can use the testdisk program described in that page to find the other superblocks (there are other methods), and then you just specify it like:

/sbin/fsck.ext3 -b 24577 /tmp/.truecrypt_aux_mnt1/volume
Kyle Brandt
  • 82,107
  • 71
  • 302
  • 444
2

I found that one can simply do the following:

truecrypt /data/mycrypt.true
umount /media/truecrypt1
fsck /dev/mapper/truecrypt1
artsiboch
  • 21
  • 1
1

Easiest solution would be to mount it as read-only (option "ro"). Then just run fsck on the mounted volume. Of course fsck will complain that the volume is mounted, but you can safely override that, as an ro mount cannot interfere with fsck.

Note: Make sure to not access the mount point and immediately unmount after fsck completed (then remount). fsck messing with the filesystem might confuse regular filesystem access at the same time, which could even cause a system crash.

sleske
  • 9,851
  • 4
  • 33
  • 44