Windows cannot recover master file table (TrueCrypt)

Mackan2009

n00b
Joined
Jul 22, 2009
Messages
4
Hello!

I bought a new HD a few weeks ago. I partioned it in Windows Vista x64 to one big partition (1000 GB). Then I used TrueCrypt to encrypt the volume. Worked fine, but earlier today Windows was acting weird, the mouse started to freeze at random, so I turned off the computer using Start>Shut Down (I did not force the power off). Then I moved the disk to a Windows Server 2003 x86 server where it should be, I mounted the disk fine. But when I double click it in "My Computer" I get:

"E:\ is not accessible
The disk structure is corrupted and unreadable."

The disk listed in "My Computer" has "Local Disk (E:)" as volume label, and it is blank under "Total Size" and "Free Space".

I tried bringing it back to Vista, where I can't even access it or get the error message. If I start cmd and type "e:" to change to the disk it just waits forever and nothing happens. If I go to "My Computer" in Vista the Window stops responding and show nothing. The mouse started freezing at random also, something that it does not do when I don't have the disk plugged into Vista (without the disk plugged in I can also access My Computer).

So I moved the disk back to Windows Server 2003, made a backup of the volume header and then mounted it and clicked on "Repair Filesystem" from TrueCrypt. Also later tried running "chkdsk e: /F" from cmd. This is what I got from both those cases:

"The type of the file system is NTFS.
Volume label is STORAGE.
Corrupt master file table. Windows will attempt to recover master file table from disk.

Windows cannot recover master file table. CHKDSK aborted."

What do I do now? The files are critical on the disk, and the only reason they AREN'T backed up is because I've had problems with the server and had to use the disk on vista.

I found this:

http://www.cgsecurity.org/wiki/Recover_a_TrueCrypt_Volume#Corrupted_Standard_Volume_filesystem

It's a small tutorial of how to fix the problem I'm having with an application named "TestDisk", however when I ran it I became unsure of what to actually select. First of all the interface isn't that great, it's DOS-like. Second, the tutorial says "None" should be selected for partition type, but a note inside the programs says "Do NOT select 'None' for media with only one partition. It's very rare for a drive to be 'Non-partitioned'." My HD has one partition, and I have encrypted that partition with TrueCrypt, so I shouldn't select "None"? Maybe the tutorial on the wiki was written for when you encrypt the disk without any partition? Has anybody used TestDisk before and know what I should do?

Please help, I swear to God I will be a better person if you see me through this. If the content of the drive is lost an entire months work is gone by a lot of people (many man-hours).

If you have any questions what-so ever, maybe I have been unclear, please let me know. Thank you for your time!
 
I tried to scan the disk with "R-Studio" and got a bunch of Cyclic Redundancy Check errors, which is leading me to believe that the disk itself is broken somehow. So what I need now is some kind of tool that makes an image of the disk and skips faults like CRC errors, then I might be able to mount that image in TrueCrypt and recover some files. Anyone have knowledge of such a program? Or thoughts on something else I should try?
 
It is a Western digital WD7500AACS Caviar Green Hard drive.

I'll be restoring a old backup I have. Thanks for the interest though.
 
Does the slave system have Truecrypt installed (the on you're trying to recover the data on? ).

If your answer is no, install it and try again
 
Does the slave system have Truecrypt installed (the on you're trying to recover the data on? ).

If your answer is no, install it and try again

If the MFT on the physical disk is missing/damaged the likelyhood of recovering the TC image is prety much zero. Some programs can search the deleted but non-overwritten data for headers of common file types such as jpegs, mp3s, avi, etc. But as far as i know the entirety of the data for a TC container is encryped and looks like noise.
 
R.I.P Hard Drive

I scanned the disk using GetDataBack, got a bunch of errors about that it could not be read sometimes, but you could continue. It found around 200000 "file starts" (I think it was) so it seemed promising. Six hours later it was done and showed... no results. Well that didn't work, I thought and started TrueCrypt to format the drive. But the drive was not mounted anylonger. Nor could I mount it, it wasn't in the list. Windows' "Disk Management" gave no trace of the disk neither. It was gone.

Rebooted and after a little while extra time it said "IDE Channel 2 Master : " and nothing more. Usually it says "None" if nothing is plugged in on that channel but here it said "". It found something but couldn't decide what the heck it is.

I'll have to send this disk back, shouldn't be this way after only a couple of weeks.

The end.
 
Back
Top