S
S
stuck2016-07-28 07:49:06
Hard disks
stuck, 2016-07-28 07:49:06

How to rollback disk formatting with two "RAW" TrueCrypt partitions?

Description of the tragedy:
I ​​decided to use the HPUSBFW program to format the USB flash drive, since Windows refused to do it using standard tools.
In parallel, an external hard drive was connected, which should not have participated in the process in any way. The disk contained two partitions with externally RAW data, each containing TrueCrypt volumes, one of which was mounted at the time of the incident.
When trying to format the flash drive, HPUSBFW gave an error that the flash drive was write-protected and (!!!) performed some actions with the external drive mentioned above, as a result of which 2 RAW partitions were merged into one and TrueCrypt, of course, stopped recognizing and mounting them.
Considering that everything happened instantly, and also that the quick format option to FAT was selected for the flash drive, I suspect that HPUSBFW half did a quick format of the hard drive, deleting the data responsible for separating partitions from each other, and the drive itself remained RAW, I cherish the hope that the data on it did not suffer much and the disk can be restored to its original form. Also, the disk became "Active" (status in Computer Management -> Disk Management) and appeared in the list with the rest.
Unfortunately, superficial googling did not yield results on my problem. Basically, recovery software focuses on recovering files, which in my case, of course, are not in open form.
Ask for help from the community. I would like to find a way, firstly, to find and restore the partition separation point, and secondly, it worries that TrueCrypt does not see the "volume header" of at least the first partition. I really hope for your help.

Answer the question

In order to leave comments, you need to log in

6 answer(s)
P
Puma Thailand, 2016-07-28
@opium

To be honest, it’s already clear here that you’ll have to manually shamanize the partition table with almost a hex editor, or somehow look for where the beginning and end of your files were and dump them, all this is manual long and dreary work, it’s obviously easier to restore with backups

A
Artem @Jump, 2016-07-28
curated by the

How to rollback disk formatting with two "RAW" TrueCrypt partitions?
No way.
Restore data from a backup.

A
Alexey, 2016-07-28
@skazi_premiere

As an option, take the software from R-Drive to scan the entire disk and burn the scan image, then deploy it to the hard drive. In fact, only the table was demolished.

Y
Yuri Chudnovsky, 2016-07-28
@Frankenstine

1) We do not write anything to the disk, we just remove the image completely.
2) We load Linux and torture testdisk until it finds the necessary partitions. Write the changes to the partition table.
3) Check TrueCrypt. If everything is in order - we rejoice, otherwise, it cannot mount - it was not restored. We roll the captured image onto a disk and return to step 2
4) If all the options for the partitions found are sorted out or testdisk does not find anything, pour some vodka and drink for the peace of the data.

S
SergeySL, 2016-07-28
@SergeySL

diskpart, Partition Magic, etc.

S
Sergey, 2016-07-28
@edinorog

Popados. It's embarrassing right? Very embarrassing? Lost a lot of data? Do tears well up in your eyes? Count not Putin's fault! And you yourself. Alas, there is no quick solution (with your qualifications). So master the basics of markup and go ahead and restore everything with handles.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question