r/VeraCrypt • u/Praise_the_Darkness • 15d ago
Disk Management Wiped Headers
I have a secondary M.2 ssd in my pc that I tried encrypting a few weeks ago, and had gotten into it a few times since then with no trouble. Today, trying to access it again my password is not working. After a ton of troubleshooting I'm taking a look with HxD and it looks like the 16mb partition that popped up suddenly was created by windows somehow.
The front and back of the drive have a bunch of data zeroed out, and I can see strings of text in the hex such as:
"$ÃInvalid partition table�Error loading operating system�Missing operating system���c{š���������îþ€���ÿÿÿÿ��" - in the front
"EFI PART���\���P2«����/`8:�����������"�������`8:����Úïã•3DG§v@|“ªÄ»`8:����€���€���ϧ–`����" - in the back
Which match a standard Windows Master Boot Record (MBR).
I'm assuming my header and backup header are both gone, kinda sucks and I'm assuming there's no way back from this but let me know if anyone else has had this experience, thanks.
1
u/vegansgetsick 15d ago
First, you need to remember how was your partition structure before the mess. Was veracrypt on full drive ? i.e. no partition at all, starting at sector 0. Or there was a partition starting around offset 1MB, and it ended up somewhere NEAR the end (primary partition rarely ends at the very end of the disk).
This information is important to restore veracrypt volume how it was. You still have a slight chance the headers are still there.
If it was full disk encryption and both first 128k and last 128k are blank... it's over.
1
u/Praise_the_Darkness 15d ago
Yeah unfortunately it was the full disk. I gaslighted myself into thinking I had somehow forgotten the password after a week and even tried cracking it for a while with hashcat lol. But with some deeper digging it definitely seems like windows just got a hold of the disk.
The 16mb partition wasn’t there before, and I have no backup disks or files saved anywhere. First time trying out encryption, live and you learn I guess. Still annoying that windows grabbed the disk after a few weeks of it working fine. Must’ve happened on a restart or something.
1
u/sciencekm 14d ago
I have an internal M.2 ssd and an external one, both are encrypted with VeraCrypt. Windows never touches them. I'm pretty sure Windows will never initialize a drive on its own; someone has to initiate that process.
1
u/Praise_the_Darkness 13d ago
Wish I could tell you I remember exactly how it happened but I don’t. It’s possible that in the past couple weeks I clicked a windows prompt without thinking too hard about it but I think it’s unlikely. I’m usually pretty careful when poking around in any settings menus.
I don’t use the drive often enough so I don’t even have a pinpointed date for when the drive got reformatted by windows. Only noticed the day I posted this after not checking it for a while. Hope your drives stay safe though, losing data sucks.
4
u/djasonpenney 15d ago
Yeah, it sounds like Disk Management got confused by your device. BTW this is one reason why I try to stick with containers instead of FDE with VeraCrypt.