0

I have a drive which is showing signs of bad sectors. Errors are "Current Pending Sector Count" and "Uncorrectable Sector Count". Crystal Disk Info did that buzz sound which I really hate. Next thing, my system froze. So I yanked the USB from its port, which, I know I shouldn't have done. Doing this unfroze everything however, using Truecrypt to try and attempt to mount the drive has become impossible now. It just renders TrueCrypt non responsive.

So I'm thinking maybe the only way for me to recover data is to do a quick format of the drive (which I haven't done yet, mind) and try and rescue the data using data recovery software?

I probably know the answer to this, so before I commit to it, will it work?

I have backups already, but the way the files was re-arranged on this drive is the reason why I want to recover it.

Hennes
  • 64,768
  • 7
  • 111
  • 168
chickensweaters
  • 1
  • 1
  • Data recovery software wouldn't recover Truecrypt encrypted data, and a quick format would only destroy everything. Why can't you use Truecrypt to mount it again? What error are you getting? – harrymc Feb 10 '21 at 20:20
  • Attempts to mount the drive only makes Truecrypt non responsive. The errors are "Current Pending Sector Count" and "Uncorrectable Sector Count". I've updated the question. – chickensweaters Feb 10 '21 at 20:35
  • Nope. Its an external drive. – chickensweaters Feb 10 '21 at 20:46
  • The idea is to create the Truecrypt Rescue Disk which might help. – harrymc Feb 10 '21 at 20:47
  • Alright. I'll give it a shot. – chickensweaters Feb 10 '21 at 20:50
  • Note that if you have more than a few pending, reallocated or uncorrectable sectors, your disk is dying fast, and destroying your data with it. that your disk is an encrypted volume makes individual file recovery impossible, so hopefully you can get enough data off to make the volume mountable again in truecrypt. – Frank Thomas Feb 10 '21 at 23:20
  • Your going to do a quick format on an encrypted drive? The only data that could be recovered if you do that is encrypted data. Don’t do that, doing that, will make it impossible to decrypt the drive. The only way the drive can be decrypted is if the TrueCrypt header isn’t lost. One doesn’t do file recovery on an encrypted drive unless it’s unlocked or decrypted before hand (although decryption process would rewrite data making that nearly impossible) – Ramhound Feb 11 '21 at 01:12

1 Answers1

2

PLEASE DON'T FORMAT THE DRIVE. Quick formatting the drive has only 2 possible outcomes - making data recovery an order of magnitude more difficult or impossible.

(Unless you are going to take the drive to a company that specialises in recovery), the appropriate steps are -

  1. Stop using the drive now - except for to attempt recovery.
  2. Get another drive which is the same size or larger then the existing one.
  3. Do a bitcopy of the failing drive as best you can - The typical goto solution is to use ddrescue. This will allow multiple attempts, and is designed to recover as much data as possible.
  4. Once you have the bitcopy, you can then target fixing the problem with truecrypt, which likely means decrypting the device and doing an fsck on the resulting filesystem, or running data recovery on that. (The ideal, of-course, is to make a clone of the clone - so you can have multiple attempts - but that requires 2 new drives)

Your proposed strategy is likely to put a lot of extra stress on the drive compounding the rate at which it fails, and a quick format will likely make it harder to recover the container and its encryption header - and without this encryption header, its game over.

davidgo
  • 68,623
  • 13
  • 106
  • 163