Truecrypt format dismounted particion.

Micael David

Honorable
May 12, 2013
7
0
10,510
Hello, i started to use to newest version of truecrypt in vista home 32 bit, i created a normal encrypted volume within empty particion. The problem is that when the particion is dismounted and i click on it, it says:"the particion is only available after format". What happens is that if forensics choose format, then the data would be recoverable with apropriate software since they can choose to go for a quick format. Maybe im doing something wrong, i really apreciate your help on this one guys, thank you.


My best regards,

Micael Liberal
 
Solution
No, it won't be recoverable.
When creating a TC volume, whole partition gets encrypted. This encrypted partition when examined closer looks like garbage. You can read it on low-level, but what you get is some random stuff. Only truecrypt can read this garbage knowing your passphrase and/or keyfile data.
For Windows this hdd space looks like an unformatted space, thus it offers you the possibility to format it.
When you do, using quick format for example, fresh, empty filesystem of your choice will be created on it. It shows empty and even if you can read data from it on the low level, you get the same 'garbage' created at the beginning.
After formatting partition where you previously created TC volume, it will not be...

Bejusek

Distinguished
Sep 4, 2009
29
0
18,610
No, it won't be recoverable.
When creating a TC volume, whole partition gets encrypted. This encrypted partition when examined closer looks like garbage. You can read it on low-level, but what you get is some random stuff. Only truecrypt can read this garbage knowing your passphrase and/or keyfile data.
For Windows this hdd space looks like an unformatted space, thus it offers you the possibility to format it.
When you do, using quick format for example, fresh, empty filesystem of your choice will be created on it. It shows empty and even if you can read data from it on the low level, you get the same 'garbage' created at the beginning.
After formatting partition where you previously created TC volume, it will not be mountable/decryptable for TC any longer.
 
Solution

Micael David

Honorable
May 12, 2013
7
0
10,510
Thank you for your reply. So lets get this straight, i did a quick format on the particion(its not a system particion) and now im able to enter the particion, but the volume its destroyed like you said, i cant no longer mount or dismount it. And for the data inside, even though its a quick format, there is no way for the forensics to recover it due to the fact that the content was scrambled? My question is pertinent because i always go 7 passes on deleted files to make them unrecoverable and the quick format isnt enough, but now that you explained i see that it doesnt matters because the content was encrypted, am i right?
 

Micael David

Honorable
May 12, 2013
7
0
10,510


I apreciate your help once again, cheers.