6

I had a regular TrueCrypt volume that contained data that I actually wanted to keep. Well, like a complete moron, I decided to experiment with hidden volumes and, of course, I used that existing volume as the guinea pig. The outer, unhidden volume's password was AAAA (it wasn't really, but you get the point here). I then created a hidden volume with the same password. When I attempted to mount it afterward, all my data was gone.

Further reading about hidden volumes revealed to me that not only do passwords with TrueCrypt serve to access the volume, but also to identify it. First, TrueCrypt tries the password to see if any hidden volumes exist that match the entered password. If so, it mounts the hidden volume. Otherwise, it sees if any regular volumes exist and, if so, mounts that one.

Therefore, it is my understanding that using the password of AAAA for both volumes essentially causes TrueCrypt to always mount the hidden volume. I think the data from the outer volume is still there, but just not accessible due to the order of events TrueCrypt follows.

However, to complicate things, I attempted to change the volume's password from AAAA to BBBB thinking that it would identify the hidden volume and then change its password to BBBB, thus allowing me to once again access the outer volume with AAAA. The password change appeared to have worked, but I am still not able to see any data when I mount the volume with AAAA. When I mount with BBBB and open the volume in Windows Explorer, I am told that the volume needs to be formatted.

I really hope I didn't lose that information, so, hopefully, someone can tell me how to recover it or let me down the hard way my advising that it's not possible :(.

  • I hope you've been keeping backups. – Michael Hampton Dec 07 '13 at 04:02
  • It would be nice if TrueCrypt could warn you about this when you create that hidden volume - but I suspect there's a good reason why it can't. I could make some guesses, but it would be nice to get an authoritive rationale. –  Dec 08 '13 at 00:49
  • Definitely don't do anything else unless you have a copy of the volume... Are you saying that you can successfully (in terms of TrueCrypt) mount the volume both by using AAAA and BBBB now? If so, both volume headers seem to exist. Maybe you only damaged the file system. If you are unlucky though, it wrote the key from one of the headers to both of them or did something equally silly, which would mean your data is gone unless you have a backup of the volume headers. – Jan Schejbal Dec 08 '13 at 01:29

1 Answers1

3

Jan Schejbal's comment gave me an idea. I already suspected that the data was still there, but the mention of volume headers caused a light bulb to go off in my head.

I mounted the outer volume and used Restorer2000 Pro, a data recovery application, to do a full scan of the entire volume. To my amazement, all of the data files were there! I recovered all files to a new TC volume and learned my lesson never to repeat this mess again.

Jawa
  • 3,649
user280279
  • 31