Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Help! I created a hidden partition within a harddrive encrypted using truecrypt, and instead of creating a second partition, it seems to have deleted all of my data instead. what did i do wrong? I simply followed the instructions on creating a hidden partition. my only mistake was using the same password as the outer partition. however, it still should have opened the normal partition, since truecrypt tries to open that first, but all im getting is an empty harddrive. it had some data on it that i would rather not lose.

how can i delete the partition, or at least make truecrypt see the top partition, instead of going to the hidden partition?

edit: i changed the password to the outer partition, but the harddrive is still empty. i can access the hidden partition with the old password, but it is not formatted

share|improve this question
3  
What does this have to do with security? For support with random applications please ask the respective vendor/community support. –  pepe Aug 4 '11 at 17:59
1  
truecrypt encrypts data. i would imagine cryptography is a part of security. however, since im not asking about individual algorithms, this question doesnt belong in crypto.stackexchange. i would ask in the truecrypt forums, but their registration requirements are a bit tough to get through. –  calccrypto Aug 4 '11 at 18:06
2  
Pepe, I think this may bear on security; the answer is tied into the steganographic nature of Truecrypt "hidden" partitions and some of the inescapable weaknesses they introduce. –  gowenfawr Aug 4 '11 at 18:34
3  
This is an "application support" question - not a "security" question, despite the application in question being one that primarily serves security purposes. I'm glad to see that there was a good answer provided here, but this sort of question generally belongs on Super User. –  Iszi Aug 4 '11 at 20:31
1  
" all im getting is an empty harddrive. it had some data on it that i would rather not lose." -- why don't you just restore from back-up? –  DanBeale Aug 4 '11 at 21:02
show 4 more comments

2 Answers

up vote 6 down vote accepted

Based on what you say, I believe that you formatted your outer partition when creating the inner "hidden" partition. If I recall how Truecrypt works correctly, there is no metadata that allows it to look at a container and say "Oh, this has a hidden partition" in it. If that metadata existed, then others could tell a hidden partition was there, and it wouldn't be hidden.

As a result, when you enter the password to mount a partition, it applies that password. Bad passwords unlock nothing. The "outer" password unlocks the outer partition, and the info for that partition is all that Truecrypt sees. The "inner" password unlocks the hidden partition, and the info for that partition is all that Truecrypt sees.

I think that what happened is that Truecrypt created the inner partition, then went to open it for formatting, but because of the way hidden partitions work, it just tried the password which happened to unlock the outer partition instead, since they both used the same password. And it then proceeded to format that outer partition, thinking it was the hidden partition and not knowing any better.

Condolences.

Also, you should know: the last time I checked, you could not modify contents of an outer partition without possibly corrupting the inner partition (again, obviously, if the outer partition knew which blocks were "hidden", they wouldn't be hidden, would they?) So you shouldn't store things you actually use (add files, edit files, etc) in the outer half of a hidden partition pair.

[edit] It's also possible you're mounting the "hidden" partition when you're trying to mount the outer, and that's why it appears empty. Check the filesystem size and see if it matches the outer or inner size that you set. If this is the case, your data probably still exists, but you have to get to it, better to ask at truecrypt forums for that.

share|improve this answer
    
the partition size is the larger partition. when i type the old password, i get the hidden smaller partition –  calccrypto Aug 4 '11 at 19:24
    
Regarding the edit: At no time during the process posted by @calccrypto would they have been able to '[mount] the "hidden" partition when [they're] trying to mount the outer'. Since TrueCrypt tries to mount the outer partition first, the hidden partition can never be mounted while the passwords are the same. So, what calccrypto is seeing when they 'try to mount the outer' partition is exactly that - the outer partition, every time. –  Iszi Aug 5 '11 at 17:59
add comment

@gowenfawr seems to be correct here, but let me try to clarify exactly what's happened.

First, some quotes from TrueCrypt's own documentation on Hidden Volumes:

The password for the hidden volume must be substantially different from the password for the outer volume.

and

TrueCrypt first attempts to decrypt the standard volume header using the entered password. If it fails, it loads the area of the volume where a hidden volume header can be stored

Now, here's what (I believe) happened in your case, step-by-step:

  1. You created, formatted, and stored data on a TrueCrypt volume, which for the sake of this walk-through we'll call "OuterVolume". Also, for the sake of this walk-through, we'll say you used (please, don't ever) "Password1" as the password. And, let's say you decided to store this within a file called "MyVolume.tc".
  2. Then, you attempted to create and format a Hidden Volume which, for the sake of this walk-through, we'll call "HiddenVolume". You created HiddenVolume within OuterVolume and used "Password1" as the password.

Here's where things got borked. When TrueCrypt went to open HiddenVolume to format it, this is what (I believe) happened. This may have been step-by-step as you executed it, or some of it may have just happened in the background:

  1. When attempting to open HiddenVolume for its initial formatting, you pointed TrueCrypt at MyVolume.tc and gave it the password of Password1.
  2. TrueCrypt attempted to decrypt the first volume header (which would be the one for OuterVolume) with the given password.
  3. Since Password1 is also valid for OuterVolume at this point, the header decryption was successful and TrueCrypt stopped looking for other headers. It then used the key to finish decryption of OuterVolume.
  4. With OuterVolume having been mounted, but you believing it was HiddenVolume, OuterVolume was then formatted and HiddenVolume was left untouched.

Now, to explain what's happening after the password change:

  1. For the sake of this walkthrough, you changed the password to OuterVolume, to "Password2".

  2. You attempted to mount MyVolume.tc with Password2, and succesfully opened OuterVolume. Now you see that OuterVolume was formatted earlier, when you thought you were formatting HiddenVolume.

  3. Then, you attempt to mount MyVolume.tc with Password1. Since TrueCrypt can no longer decrypt the first header (for OuterVolume) with this password, it now moves to look for the space where a Hidden Volume's header might be.

  4. TrueCrypt successfully decrypts HiddenVolume with Password1, and now you see an unformatted volume because, after all, HiddenVolume was never itself formatted.

It should be clear by now, that all of the data previously stored in OuterVolume is more than likely lost forever. I know of no software (though it's imaginable, I doubt it exists or is within the realm of common affordability) that can perform any sort of undelete on an encrypted volume, let alone one which has been re-keyed. If you would still like to work with HiddenVolume without nuking MyVolume.tc entirely, you just need to make sure that the keys for OuterVolume and HiddenVolume are significantly different and then reformat HiddenVolume. Additionally, TrueCrypt recommends:

To the outer volume, (before creating the hidden volume within it) you should copy some sensitive-looking files that you actually do NOT want to hide.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.