decrypt truecrypt system partition with lost recovery disk (still mountable under other OS)

2

I have a truecrypt system partition which the OS (Win8) no longer boots (get's stuck on "booting..." after entering credentials ( bad update to checkout 8.1 )

I can use a USB thumbdrive to boot into Ubuntu and succesfully mount the partition with truecrypt and browse it's contents....but, I can't for the life of me figure out how to decrypt the entire drive so I can run the windows recovery against the drive

the truecrypt recovery disk is lost but considering I can mount the drive and browse it's contents I would think there's some way to create a new one? surely?

damndiddlydamn

Posted 2013-09-21T05:00:46.440

Reputation: 21

Answers

1

If the partition is mounted, linux sees it as an actual drive - I'd suggest imaging the mounted, decrypted partition and restoring it back as an unencrypted drive somewhere, then running windows 8's recovery against it. It'll probably need more space, but thats the only logical way I see to do it.

Journeyman Geek

Posted 2013-09-21T05:00:46.440

Reputation: 119 122

huh. so.... I'm not super familiar with using linux for things like this. assuming it's mounted at /media/truecrypt1 - could I use dd for this?

dd if=/media/truecrypt1 of=/(some USB storage drive)/hdd.bak

and then take the output of that and write it back?

dd if=/(some USB storage drive)/hdd.bak of=/dev/sda1 ? – damndiddlydamn – 2013-09-21T05:38:17.617

I have some idea how to do it, though I don't have time this weekend to do a test environment - and I'll probably do it in windows 7 rather than 8 if I did. I'll update in the next week, depending on whether I can find time - I'm unfamiliar with truecrypt, but the theory seems sound. – Journeyman Geek – 2013-09-21T07:27:42.163

hmm, truecrypt seem to have a decrypt system drive option. It also seems to insist you create a rescue disks - can you check either of them? – Journeyman Geek – 2013-09-21T11:02:17.627

well, the rescue disk is lost. – damndiddlydamn – 2013-09-21T17:14:29.713

so I went looking for decrypt system option, and I'm not sure if Linux version of truecrypt is limited, or that the fact that I'm not booted into the system drive but attaching it as a volume means Truecrypt doesn't offer the option. I suppose the real lesson is that ugpradeing from 8 to 8.1 in place is not as harmless as I'd imagined and don't lose the rescue disk – damndiddlydamn – 2013-09-21T17:22:22.350

looks like to use dd to make an image I have to grab it from /dev/mapper/truecrypt1

I don't have much to lose since I think I've backed up all the files I need - so I'm ready to give this a try. The only thing I wonder about is when I write it back to sda1 should there be some staring offset? or just start at the beginning – damndiddlydamn – 2013-09-21T18:38:10.697

there might be a copy of the rescue disk stored in system – Journeyman Geek – 2013-09-21T23:32:20.493

I've not had to worry about a starting offset when I worked with dd - so, I don't think so. – Journeyman Geek – 2013-09-22T00:13:54.467