Recovering corrupt Truecrypt Disk

Question

I have a 2 TB external hard drive that I've encrypted using Truecrypt.

I made a complete backup of all my data to it, and wiped my hard drive and reinstalled my operating systems.

Once I reinstalled windows, I managed to mount the Truecrypt partition, even though it took a few tries. Once I managed to mount it, I could not view anything inside of it.

I have it mounted now (i.e., I know the password and truecrypt has 'decrypted' it and assigned it a drive letter), but chkdisk cannot do anything with it, windows says I have 0 bytes out of 0 bytes free on the partition, and using the "Fix Disk Errors" option on disk properties results in a "The disk check could not be performed because Windows can't access the disk"

When running CHKDSK, I get the error "Corrupt master file table. Windows will attempt to recover master file table from disk. Windows cannot recover master file table. CHKDSK aborted" Windows claims that the disk is "unformatted" but truecrypt see's one partition on it.

The disk was formatted as NTFS and encrypted using AES and a passphrase.

It shouldn't be a bad disk because it's brand new, and I tested it before backing everything up to it.

How can I make my disk readable again?

Answer 1

Unfortunately there is probably very little that you can do. It might be worth mounting the truecrypt volume under Linux, to see if the filesystem checking tools available there can by some fluke do something the other tools you have tried could not but you are most likely out of luck there too. Before trying each recovery method it is recommended that you backup the volume (yes: backup the corrupt volume (the truecrypt file, not the apparently corrupt filesystem within it) in case the attempt makes things worse (so you can go back to the bad-but-not-quite-as-bad state in order to try something else).

When you say mounting the volume "took a couple of attempts", what happened in response to the failed attempts? Any error message or status information output at all? And what commands did you try (and which eventually got you as far as you are now)? This information might trigger a memory in the mind of a passing truecrypt expert, that could be useful to you!

If you thought that last paragraph was a little preachy _{[detailed error reports (well, error reports with missing detail) are something I get a bee in my bonnet about as anyone who has worked with me will testify!]} I apologise in advance for the next one...

You should really have tested the backup after making it, as well as checking the disk for physical problems before hand. A backup is not a good backup until it has been tested, no matter how recently it was made and what checks were made of the backup system/medium beforehand. In an instance like this, for example, I would suggest trying to mount the backup volume on another machine (before wiping the one the backup is from) to make sure it mounts successfully, and perhaps verifying some of the content while it is mounted there (running a checksum of some of the files there and on the original location and comparing, or perhaps using rsync --dry-run between the two machines, if they can see each other over the network, which would be a relatively efficient way to see if there was any big chunk of the data that looks different or missing on the backup).