So, I did a thing - accidentally selected my 5TB external NTFS hard drive (encrypted with VeraCrypt) as the target for writing an ISO. The moment I noticed that “Impression” had switched the drive letter, I immediately killed the process. But yeah… damage done.

Now, the situation:

  • Currently shows up as:
    • 6 MB FAT
    • 4.3 GB
    • 2 TB unallocated
    • 2.6TB unallocated
  • The VeraCrypt volume obviously no longer mounts.
  • Drive was somewhat crucial - lots of structured data I’d really prefer to recover with the original file system intact.

I know chances are slim, especially with encrypted volumes, but has anyone had luck recovering from something like this? I’m open to commercial recovery tools or command-line wizardry. Would love to hear from anyone who’s been down this road.

Any thoughts or recommendations?

  • Majestic@lemmy.ml
    31·
    14 hours ago

    Veracrypt has back-up headers located elsewhere in the volume that are unlikely to have been overwritten.

    First thing’s first I would strongly recommend copying the drive as it currently exists bit for bit to another drive of equal or larger size. Don’t work on the original if you can help it.

    Now with this copy, you should try to check the option to use the backup header when mounting and try again. If the partition is gone and veracrypt doesn’t see it you’ll need to try using something that recovers partitions and doesn’t mind encrypted partitions or partitions or file system types it doesn’t understand and use that to ON THE COPY recover and recreate the partition (this will write data and can cause the possibility of further loss or worsen your ability to recover which is why it is important to perform it on a copy). Testdesk may work for this but there are other options that probably are better.

    See this list: https://old.reddit.com/r/datarecovery/wiki/software and choose something from there if this data is truly important. Again only work on a copy on another drive. Some of these software examples actually work against the original drive and make a copy elsewhere and should be safe to use on the original drive so long as they have you select a target drive to push the recovered data to but read the documentation. Testdisk absolutely must be used on a copy.

    You will incur data loss and likely should run one of the file recovery software mentioned on the drive once successfully mounted in veracrypt to attempt to recover as much as possible.

    • anarchoilluminati [comrade/them]@hexbear.net
      4·
      2 days ago

      Thank you so much, this is really helpful.

      I have a slightly different issue where I have several VeraCrypt vaults on an external that seem corrupted and don’t recognize the correct passwords anymore. I’m making note of your advice to work on mine too. Is there anything particularly different you would recommend?

      • Majestic@lemmy.ml
        4·
        1 day ago

        The only thing I would note is -IF- your volumes are not partition or disk based BUT -files- based there is the possibility that corruption of the host file system of the disk the files containing the volumes are on could result in pieces of those files being marked unreadable by the disk and it’s POSSIBLE one way to solve this would be a file system check utility.

        HOWEVER such activities carry a -large- risk of data loss so I would advise a bit for bit copy of the disk and doing the repair on that so if it goes wrong you’re not worse off. -IF- you cannot make a copy then I would advise at least trying to mount using backup headers before doing that and copying off anything you can salvage as file system checks can really mess up data recovery and should only be used in certain circumstances.

        You’re much better off trying the recovery software I linked in fact than doing a file system check as it will tend to have better results.

        You can also use the option to mount as read only in VC to prevent writes to a suspected failing disk.

        Let me know if you need further advice.