Software :: Recovering A Truecrypt Encoded Hard Disk?
Jan 2, 2011
I have a few hard disks fully encrypted with Truecrypt. They have not been partitioned, just encoded right of the bat with Truecrypt. I just use Truecrypt command line to mount them, supplying password whe asked.
So from a linux standpoint, they show up as disks with unallocated space.
But I recently updated (moved) my linux from Ubuntu to Kubuntu. In the process, the partition manager asked where to install the new OS, I answered erase existing system and install there. But I noticed too late that the install program decided to install GRUB on another disk, one of my encrypted disks, instead of the system disk already selected. I don't know why, but it did. Now this disk shows up in linux as a disk with multiple partitions, and of course I can no longer mount it with Truecrypt.
I haven't done anything with the disk, except from trying to mount it in Truecrypt. So apart from the GRUB install, nothing else was touched on the disk.
I know Truecrypt place a backup header towards the end of the encrypted disk, so it should still be there intact, but since I now have multiple partitions, Truecrypt is certainly confused and cannot see the end of the disk since I now have 4 of them (partitions).
I am not a beginner but I am hesitant to attempt something that could kill all hopes of recovering the disk. It is a 2TB disk with a lot of data on it. I could probably make a copy of the entire disk but this means buying another 2TB disk....
One of the first idea was to kill the current partition setup to leave it "unpartitionned", so like it was before, maybe Truecrypt will now find the backup header. But before I do so, I would like opinion of real experts on linux.
I learned a couple of days ago why you should do regular backups. Left my laptop working for the day in hot weather. When I came back it had crashed. On reboot it no longer booted up. I could still access the BIOS and boot from alternative media but not from the hard drive. The laptop tried to access the hard disk for a couple of minutes (hard drive light was blinking) and then failed. I made an ubuntu live usb stick and am currently working from there, trying to access my hard drive so I could image my data on another disk before sending the laptop for repairs. All my data is on that disk including my passwords and the password for this site conveniently so I had to register a new account to post this thread.
The laptop is IBM Thinkpad X41. The hard drive is accessed during when boot options are presented, again when the live cd boots up and determines the hardware available and also when manually probing for hard disks using the script below. The hard disk however does not show up in dev. If I could get so far to get it there, I could use dd_rescue to image it away. My hope lies in that the drive still spins up and is accessed producing error messages, however indicating that the system still knows it exists. Excerpt from dmesg concerning the drive:
after installing Ubuntu on one WD 500 GB hard disk and after making mistake and pasting wrong code into Terminal:my OTHER WD 500 GB hard disk that was also in the system (I guess it was "hd1") - died.The problem must be, I guess, I typed wrong code: "hd1,1" instead of "hd0,0".)500 GB (NTFS) of data was on that other (non-Ubuntu) hard disk, and now I can not access it anymore. While booting, system gives "Hard Disk Error" warning and stops.One again: I installed Ubuntu od one hard disk and at the end of instalation I pasted wrong code for GRUB, giving address of another hard disk. Now that other hard disk has error and will not work
I have a sata 320 gb with mandriva linux 2009.1 on it.And it is what curently atached to my cpu. It is shown as 'sda' in the partition table.I also have another 40gb hard disk with windows xp installed on it.It is shown as 'hda' in the partition table . Now what i want to do is attach this 40gb hard disk to my pc and configure grub on my 320gb hard disk('sda') so as to boot windows xp(which is residing on the second hard disk,'hda')Can anyone tell me if what im doing is feasible or not? If it is feasible,can anyone suggest me how to get it working. I know i just need to add 2-3 lines to my grub.conf, but dont know what exactly i need to write.
I had a dual boot (windows 7 + debian), both of them installed in my internal hard disk, with the GRUB in it. I have recently installed a second linux distro (mint), but I put it in an external hard disk. Now the GRUB allows me to boot any of the three operating systems, but I need the external disk to do it. It seems that after the mint installation the GRUB is now working from the external disk (if the external disk is not connected, the machine does not boot.) �Is there a way to change the location of the GRUB, to the internal hard disk of my laptop?
I was using Terminal and browsing a directory in my home folder. My "home" directory is located on "/dev/sdb1". When in Terminal I typed "ls" in one of my directories and the output was garbage. The output didn't show the files in the directory. I think it said something like, "input/output error". Unfortunately, I didn't write the exact error down. Instead I rebooted.The hard disk with the problem is:
Code: $ sudo hdparm -I /dev/sdb [sudo] password for brian:
So what I want to do is encrypt my entire hard drive, but heres the thing.
I dual boot Ubuntu and windows 7, but I am afraid that if I use truecrypt to do the encrypting that it will wipe GRUB and not allow me to boot into any OS, is that a possibility and is there a way around it?
I have recently gotten hold of a device that helps me plug my old ATA/IDE hard drive to my computer and view my old files that I wish to recover. I am using Ubuntu and the harddrive that I wish to retrieve the data from also has an Ubuntu install on it. The files I wish to recover are old .doc files, which I want to keep to remember my old writings.
The problem I have encountered arises when I wish to open some of the files. The icon for some of the files, which happen to be my best writings, has an X on the top right, indicating that I cannot view the contents. When I click on the files, the following error message pops up: "Access to /media/c885571b-a6e5-4a2d-937a-78af7050910/george/Courses/hist388/Passion.doc was denied."
Now, I am guessing that I need to be able to log in as superuser or something to be able to access these files, so I logged in my terminal as super user by following the instructions outlined on this page: [url]
I still did not have the sufficient access required to be able to open the files that I would like to retrieve.
I wanted to format my Flash USB drive !! and by mistake i choose my external Hard Drive (NTFS) and formated the drive gain to NTFS later when i released that this is not the USB flash drive it was too late to abort or do anything
is there any way to recover my lost data ?! i mean i know about the tools like Recuva ! But the problems that it recover data mixed up in each other
I have 2 RAID1 hard drives with possibly hardware errors, (when I tried to mount them in a degraded array, they won't start, throwing some Buffer I/O errors) So I used ddrescue to make a disk image out of one drive, ran losetup to use the image file as loopback device:
Code: losetup /dev/loop0 imagefile.img
but when I tried to assemble a raid array including the /dev/loop0 device like:
it will complain that no superblock is found on /dev/loop0 device. With desperation, I tried to create a legacy raid array with following command, of course, including one of the bad drives:
Code: mdadm -B /dev/md0 --level=1 -n2 /dev/sdb1(bootable partition on the bad drive) /dev/loop0
I successfully created a new RAID1 array, but when I tried to mount it
[Code]....
Now the only thing I haven't tried is to clean the superblock by doing --zero-superblock, and not sure if that will solve the problem. Should I get a second drive to hold my broken drive image so that I might be able to assemble a good RAID1 array or should I continue working on the only disk image file I recovered from one of the broken drives?
I am trying to transfer files from a SATA hard drive with Windows Vista (Home Premium) installed on it. Some files I can easily copy over, others just say Access Denied.
I'm sure permissions is part of the issue, unofrtunately Windows is unable to boot at all (surpise surprise) so I can't adjust anything from within in. I know with XP drives I can easily copy and paste onto my Ubuntu machine. I'm using a SATA to USB converter that let's me plug it in and my desktop reads it like an external hard drive.
I've gone into the properties and under permissions it shows my account as having access to Create and delete files under folder access amd "---" under File access. My group and others show None and --- for Folder and File access. I can post a link to a screenshot tomorrow. I've tried to also select Read and Write for File access but it goes back to the dashes before I can apply it.
I am running 64 bit Ubuntu 9.10 and do not have the sharing aspect installed. Any questions please feel free to ask me.
I have an external USB hard drive that I need to recover some data from, but I see from fdisk -l that the partition uses LVM:
Code:
[root@localhost ~]# fdisk -l /dev/sdd Disk /dev/sdd: 160.0 GB, 160041885696 bytes 255 heads, 63 sectors/track, 19457 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes
[code]....
I've followed various lvm tutorials all of which describe setting up lvm from fresh on empty disks. Unfortunately non mention how to 'install' new a drive that was previously set up with lvm. I have had a go anyway and may have now lost my data. Here's what I've ended up with (the partition in question is sdd1):
Code:
[root@localhost ~]# pvdisplay --- Physical volume --- PV Name /dev/sdd1 VG Name vg02
[code]....
I've tried mounting with other fstypes, but all give the same error.
I'm trying to fix my girlfriend's computer which is running OS X, which will boot but doesn't work beyond the login screen. I've removed the hard drive and can access most of the files, but she encrypted her home directory with "Filevault" and I think her home directory automatically mounts from some image somewhere. She does remember her password, but I'm not really sure where the encrypted files are on the hard drive and I'm not sure how to unencrypt them.I was thinking of trying to boot the external hard drive in some kind of virtual machine, but I don't know how to do that either.
I'm testing my ability to recover a failed disk on a three disk software RAID 5 setup.
I have used a 10.04 alternate install disk to setup a three disk RAID 5 array according to this: [URL]. This is for a RAID1 setup. I followed it exactly except that I performed the steps on three drives rather than two and selected RAID5 instead of RAID1. Each disk is 500GB and has a 26 GB swap partition and the remaining space on each disk set as / with the boot flag on.
I installed the OS on my array and everything boots without a problem. After I booted up I started a terminal and ransudo dpkg-reconfigure mdadm to set the boot degraded to true and rebooted.
Next, I shut down the computer, disconnected the power on drive 1 (sdb) and then tried to boot. I get this (not verbatim):
Quote:
mdadm: CREATE user root not found mdadm: CREATE group disk not found raid5: raid level 5 set md0 active with 2 out of 3 devices, algorithm 2 mdadm: /dev/md0 has been started with 2 drives (out of 3)
[Code].....
*then a list of common problems and then:
ALERT! /dev/disk/by-uuid/bunchanumbersnad letters does not exist. Dropping to a shell
Then it dumps me to initramfs. MD0 is the swap partition. At this point I don't know what the heck to do. I'm skating on the edge of noobidity and this is pretty much over my head.
I want to use this server as a virtual machine server and the desired behavior would be that, if a hard drive should fail, the server would alert me via email and continue to run in a degraded state.
Is it even possible to install the OS on the array and run it degraded? Given the desired behavior, should I be looking at something other than RAID5? My client is broke so I'm trying to avoid a hardware RAID if I can do it.
Installed Truecrypt onto openSUSE 11.3 (KDE) and noticed that Truecrypt needed to be started as root.Modified visudo using YAST asusername ALL = NOPASSWD: /usr/bin/truecryptHowever, when copying files from my backup drive into the Truecrypt partition, there is an access problem (couldn't remember actual error message)In Konsole , updated visudo to username ALL = (ALL) NOPASSWD: /usr/bin/truecrypt Copying is allowed and working fine.Question:1. What is the difference between the above two visudo setting?2. How to updated visudo to the second setting in YAST?3. How to change the editor for visudo in konsole using nano instead of vi?
I'm on the latest Ubuntu OS on my netbook trying to make a USB Startup Disk. I have a 1GB USB and a 500GB hard drive plugged in to then netbook. I run the USB Startup Disk program, and it tells me I need to format the USB drive. Okay, so I press format, only to realize that I'm formatting the 500GB hard drive.However, when I pressed format it give me an error saying the disk could not be mounted. I did something on Disk Utility and now I have a FAT32 system on the hard drive with nothing in it. Now my ultimate question is, am I able to recover the data that was on the hard drive?The hard drive was formatted in HFS+, it was a Mac-formatted hard drive. Will I need to use a Mac in order to try to restore my files?
OK, was trying to make a live-usb boot partition on my 1.5TB HD; in doing so clicked a 'wipe disk' button.
A second later I realised what I'd done, clicked cancel (frantically), tried to unmount the drive but was told 'volume busy'. In a panic, unplugged the drive. Unsurprisingly, the drive is now a mess.
I'd had 1 30G FAT32 partition (empty) at sdd1, 1 1.5TB ext4 partition with about 500G of data at sdd2. Now according to gparted I have an unrecognised filesystem type; according to the 'Disk Utility' I have an unmountable 1.5TB FAT32 drive.
I know NOTHING about data recovery. If it's just a case of running a couple of magic 'check & fix' programs then I should be OK, but anything else and I'll have to take it to more skilled friends.
I was trying to fix some hardware on my laptop and i ended up mucking the whole thing up. The HDD seems to fine though. I have it in a external HDD enclosure and it's plugged into my mothers desktop through usb.I'm trying to print some files I have, but my home directory on the external HDD is encrypted.
I was installing Ubuntu to the internal disk in my main machine, with all external drives unplugged for safety - then discovered I had accidentally chosen the external drive and it wasn't unplugged. (Seeing three drives not two listed as installation targets should have tipped me off, but I guess my IQ was low that day.)The external drive, in compliance with Murphy's Law, was my backup drive with all vital current files.The last few months of work gone.Now the drive shows only the stuff I normally expect in / on any Linux machine. It mounts showing as ext4, but the disk was (I'm 98.5% sure) originally ext3.However, the installation did not finish.Whatever files got copied, clobbered only a fraction of the disk. df reports only 1% of the space used.Maybe the bulk of my valuable files are okay, and could be recovered with some tool?
There are other questions on this site about file recovery, but many are for Microsoft Windows, or for malfunctioning disks, or some other situation. I'm on Linux with a physically healthy external disk. I'm fairly sure that the more recent and more important files are in multiple copies on that disk, so if one copy is clobbered there's hope to get the second copy.
I recently bought 320 GB Trancend external hard disk and working fine days back.Earlier i could copy from and to the hard disk with out any issue. I dont know what happened after that now i am not able to write any files in to the external hard disk. This is not NTFS formatted device. here is some of the out put from terminal.
Code: sundar@sundar-sundar:~$ fdisk -l Disk /dev/sda: 120.0 GB, 120034123776 bytes
I have two internal harddisk. Harddisk 1 has ubuntu, fedora installed and harddisk 2 has ubuntu installed. I normally connect either one, and use it. How can i always keep connect both harddisks, and at the start, select from which harddisk to boot? Or it's not possible?
is there a way to write/unpack .qcow2 hard disk image directly to real hard drive in Linux?(I know it's possible to unpack .qcow2 to .raw and then dd to drive, but I'd like to skip .raw since its large)
I created a thread about a problem a I had with my hard disk clicking whilst idle little while ago and I may now have stumbled upon a possible solution. The strange thing with the problem is that Ubuntu/Kubuntu didn't cause this problem but Opensuse 11.2 does.
I installed Fedora 13 to have a glimpse of what all the fuss was about and noticed that I had the same problem (hard disk clicking whilst idle ~ every 20 secs or so). Now there's a wiki on this subject and a few bug reports: [url]
Problem Description
Some ATA harddrives perform very frequent head unloads under Linux significantly shortening their lifespans. Root cause
The inactivity timer for head unload is configured too aggressively either via ATA APM (Advanced Power Management) feature or other non-standard means. Such aggressive settings are very fragile to changes in IO pattern and under Linux many such drives unload their heads only to re-load them shortly. Note that this relentless unloading/reloading cycle can also be triggered under Windows by installing programs which can alter the IO pattern (e.g. certain vaccine programs which runs in background).
Now two of the listed models with this problem are basically identical to my model (Dell Inspiron 1520) and basically share the same hardware: Dell Vostro 1500 and XPS 1520.
The workaround listed is to:
set APM to 254
Furthermore, there is a script: Storage-Fixup which can also be downloaded from opensuse software search. Indeed there is a report of this for a Vostro 1500: Gmane Loom
The report suggests looking at: Disk Power Management - openSUSE which lists a method to create a configuration file to management disk power management:
My question is whether I could download the storage-fixup rpm [url] has a description of it and it can be found: Software.openSUSE.org) and install it to (hopefully) solve the issue or should I follow the method given in: Disk Power Management - openSUSE
ran out of space in my /home dir. Have a second hard drive to install and would like to designate it as additional space for /home. I do not want to mount it as a dir inside my home I would like it to simply work as though my /home simply has more space available to it.
