Recovering Corrupted TrueCrypt Data?

Question

I recently attempted to set up an encrypted TrueCrypt folder (non-hidden) on my USB Flash Drive. Before doing anything I copied all the files on the USB to my computer's harddrive. I then deleted everything on the flash drive, set up a TrueCrypt file on the drive (the file was 3.5Gb out of the 4Gb available), mounted the TrueCrypt file, and copied all the files from my computer back into that file. Everything seemed fine - it took a couple of minutes to move all the data into the TrueCrypt file on the drive, and I saw all the files were in the folder once the data had been moved. However, I did not look into each file folder to check that every subfolder had been moved, etc. I unmounted the virtual file, remounted it, and found that nothing could actually be opened and everything had a size of "Zero". By this time, however, I had stupidly deleted the original backup on my computer... So my data may be lost forever.

I'm curious if this is something that anyone else has encountered and whether there is any way to access the data again. I know the password and I'm fairly certain the files were moved at some point - perhaps they were deleted or something is wrong with the file system. Regardless, any help would be appreciated.

Answer 1

I had a similar experience with a TrueCrypt flash-based container; only the filesystem was not accessible at all after mounting.

This is why using USB flash drives for critical data is not a terribly good idea; I have since moved to USB hard drives.

An idea for recovery route:

• If feasible, create a backup of the flash drive (using a cloning tool; I believe, for Mac OS X that would be Disk Utility or a third-party tool) or of the TrueCrypt container. Just in case you damage it even more while doing the restoration work. Also, in many cases you can work on the clone-copy on your computer's drive which is much faster than accessing the file on the USB flash drive. I suggest you do not backup to the disk where the original backup has been; see below for the why.
• Mount the TrueCrypt container or its copy and use Disk Utility (First Aid -> Verify and Repair Permissions) on the mounted filesystem. This may fix the problem.
• Failing that, your next best bet would be to use a data recovery software specific to Mac OS X. I do not have any experience with Mac data recovery tools, so I cannot recommend a specific application; however, a quick search suggests there are tools to choose from.
• At this point, if your data recovery tool doesn't :) resort to training it on your hard drive where the original backup has been. In many cases it is possible to recover deleted files such as your backups. The probability of success here may or may not depend on the patterns of disk use after deletion, this is why I recommend against backup up the failed TrueCrypt container to that hard drive and, for that same reason, against doing any real work on the system when you are in a situation like this.

A quick note: when fixing a filesystem, make sure you do not mount it as read-only; when recovering files from a filesystem, the opposite holds.