Sepero Hacker: June 2012

In Linux, unencrypting a truecrypt volume as "unmounted" will create a temporary file like this

/tmp/.truecrypt_aux_mnt1/volume

Recently when trying to run fsck or e2fsck on a corrupted truecrypt volume, I was presented with this

# fsck.ext4 -p /tmp/.truecrypt_aux_mnt1/volume
/tmp/.truecrypt_aux_mnt1/volume: recovering journal
fsck.ext4: unable to set superblock flags on /tmp/.truecrypt_aux_mnt1/volume


/tmp/.truecrypt_aux_mnt1/volume: ********** WARNING: Filesystem still has errors **********

Most websites will tell you to recover using a separate super block, but that is likely not the problem here. The problem is that fsck.ext4 can't properly fix an ext4 image file directly. The file must be mounted with losetup, and then it can be checked properly.

# losetup -f /tmp/.truecrypt_aux_mnt1/volume
# fsck.ext4 /dev/loop0e2fsck 1.42 (29-Nov-2011)
/dev/loop0: recovering journal
Setting free inodes count to 15549549 (was 15549553)
Setting free blocks count to 19290620 (was 19290665)

After mounting the image to a loopback device you can see that fsck was successful. To unmount the image from the loopback device, run