Jump to content











Photo
- - - - -

Vista + TrueCrypt


  • Please log in to reply
3 replies to this topic

#1 viksra

viksra
  • Members
  • 3 posts
  •  
    United States

Posted 28 March 2010 - 12:04 AM

Hey,

So, my computer won't boot into Windows Vista anymore (it's the only OS I had installed). I installed a bunch of Windows Updates (about 10 or so) and restarted the computer. I inserted a USB thumb drive into the computer and my CPU shot up to 100%. I mention installing the updates & the USB thumb drive because I'm not 100% sure which one is causing this problem, but I'm leaning more towards the USB thumb drive being the cause. I'm not entirely sure though because I have read on other forums that people had the same issue that I'm about to explain (without TrueCrypt though) after they installed Windows Updates. Anyways, after the CPU shot up to 100%, I noticed that there were 3 new processes in the task manager 1.) Ktypua.exe 2.) Kb1.exe 3.) Koarau.exe. I tried "ending task" on each of these processes, but none of them would let me kill them, even after rebooting 2 or 3 times. Then, Windows crashed (it froze because of high CPU), I got a blue screen with (STOP: 0x0000007F (0x00000008, 0x80151000, 0x00000000, 0x00000000) and I had to restart, and a blue screen would flash after the loading screen (STOP: c000021a {Fatal System Error} The initial session process or system process terminated unexpectedly with a status of 0x00000000 (0xc0000001 0x0010034c). The system has been shut down.) and then the computer powered off by itself. I ran Startup Repair in System Recovery Options, and it said "boot sector for system disk partition is corrupt." "Repair action: boot sector repair" "Result: failed. Error code = 0x490". Then I read online to try this in cmd:
bootrec /fixmbr
bootrec /fixboot
I tried those, and then the loading screen no longer continued to show and I could no longer access "system recovery options" window. In BIOS, the computer shuts off when [the worm] detects that the cursor selection is over the field to change the password. Anyways, I'm now able to get back to the "system recovery options" window, but the windows loader screen no longer shows up (says "Windows" with a little progression bar).

I've got TrueCrypt installed on my system, and my computer has 2 partitions.
Harddisk 0 149 GB
\Device\Harddisk0\Partition1 142 GB
\Device\Harddisk0\Partition2 6.2 GB

Partition1 is Drive C:
Partition2 is Drive D:

I was able to run TestDisk and it says:
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63
Partition Start End Size in sectors
1 * HPFS - NTFS 0 1 1 18641 254 63 299483667

Boot sector:
Status: Bad

Backup sector:
Status: Bad

Sectors are not identical.

A valid NTFS Boot sector must be present in order to access any data; even if the partition is not bootable.

So, how do I first get Windows to recognize the C: drive in cmd, so that I can use TrueCrypt to permanently decrypt the C: drive? Right now the computer isn't even recognizing that Windows is installed because TrueCrypt is showing the drive as just RAW data...

I want to recover my files!

#2 viksra

viksra
  • Members
  • 3 posts
  •  
    United States

Posted 04 April 2010 - 10:49 PM

bump

#3 viksra

viksra
  • Members
  • 3 posts
  •  
    United States

Posted 02 February 2013 - 02:45 PM

3 years later, and still no response?



#4 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 13751 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 02 February 2013 - 03:29 PM

3 years later, and still no response?

Maybe because you are exposing a very particular problem, somehow failing to expose/explain the issue with clarity, AFTER having possibly made the situation worse AND from what you wrote there are no ways to recover known to man.   :(

 

It is very possible that by running either of 

bootrec /fixmbr
bootrec /fixboot

you hosed for good the system (besides the damage already done by what I cannot but think being a virus/trojan of some kind you injected in the system through the USB stick).

 

The "standard" way to recover (rescue) a corrupted Truecrypt volume is to use the aptly named Truecrypt rescue disk:

http://www.truecrypt.../?s=rescue-disk

which contains a dd-like copy of the first track of your hard disk, typically first 63 sectors, I would assume that if you have not such a disk you have no way to recover. :unsure:

 

So the question is: do you have the Truecrypt rescue disk (actually disc) for that system? :dubbio:

 

:cheers:

Wonko






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users