Recover truecrypted NTFS HDD after quick format without rescue disk

formatntfstruecrypt

The whole external hard disk NTFS partition was encrypted using TrueCrypt.
I accidentally run quick format on it. I can still mount this partition using truecrypt after restoring volume header but can't access it.
Is there any way to get my data back including folder structure without rescue disk?

Best Answer

Recovering the directory layout

I would recommend trying TestDisk, a free and open source tool that was designed to help recover broken filesystems and trashed boot sectors. Mount the drive in TrueCrypt first, and do all of your work on the decrypted drive.

It sounds like your best bet may be to try to recover the partition's MFT, or Master File Table (the rough equivalent of a Linux filesystem's superblock). A backup is stored; however, I don't know if a quick format erases the backup as well.

Getting individual files back

If the directory structure is toast, you may still be able to use an undelete tool such as Recuva, which is freeware, to recover your files. You won't get the directory structure, but if you have something really important you need back, you can sift through whatever Recuva finds.

Preventing this from happening

I bet I know how this happened... You plugged in the drive and Windows claimed that it wasn't formatted (because it is encrypted and looks like gibberish to Windows), and you accidentally let it. Regardless of whether or not this is what happened, this still really annoys me.

You need to prevent Windows from associating that partition with a drive letter, which will prevent it from trying to format it. With your disk plugged in (but not mounted in TrueCrypt), fire up the built-in Windows partition editor (hit Start, type partition, and choose "Create and format hard disk partitions"). Select your encrypted partition in the diagram, and right-click it and choose "Change Drive Letter and Paths." Remove all the letters associated with the partition, confirm, and you should be set!