| Author | Message | ||
     Dan Thompson Username: dan Registered: N/A |
I have noticed that under certain conditions WinHex is unable to open a mounted TrueCrypt volume, whereas other hex editors that I have tested may still be able to do so. A TrueCrypt volume can be mounted (and will thus be providing on-the-fly decryption of its contents) even if it no longer contains a functional filesystem. The decrypted contents of such a volume can be explored with various other data-recovery programs and hex editors, but WinHex is frequently unable to open a logical volume in this condition because of its damaged filesystem. Selecting the Physical Media that the volume is stored on is not useful in this situation, as this will only show a large block of encrypted data. I wish it were possible to select the logical volume itself as a Physical drive, as this would not require it to have a working filesystem. Can anything be done that would allow WinHex to open a mounted TrueCrypt volume in this condition? | ||
| Alfons Kramer Username: admin3 Registered: 4-2004 |
> WinHex is frequently unable to open a logical volume in this condition because of its damaged filesystem. To open a logical volume and the presence of a file system are completely independent - or at least should be. To my knowledge this hold true for WinHex. So what are the symptoms of not-being-able-to-open-it? There is an alternate way to open a logical volume. Log in as an ordinary user (or use Vista) and open the volume with WinHex. This time there will be no access to the sector level. This gives a totally different view to the volume. | ||
| Dan Thompson Username: dan Registered: N/A |
Using WinHex 15.1 SR-6 (registered), here is the sequence of events and error messages: 1) Mount a TrueCrypt volume to Drive V. (The mounted volume contains an intentionally damaged NTFS filesystem). 2) WinHex: Tools / Open Disk / Logical Drive Letters / (select drive V) 3) Respond to the following error messages: "The file or directory is corrupted and unreadable" (click OK) Error #10 Cannot access "Drive V:" (click OK) "You may want to open the "physical" medium instead, and then from there the partition." (As per your suggestion I tried logging in as non-admin and got the same results). I think it's kind of odd that various other programs can explore these volumes and that WinHex cannot. Hopefully there will be a solution, as I greatly prefer using WinHex for this type of work. (I should mention that I have not yet tested this scenario using the latest version of WinHex. Perhaps I should try that and report back, in case the problem has already been solved.) | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
In v15.4 SR-8 it will be possible to open volumes mounted as drive letters even if they are not formatted with a valid file system. |