Volume on disk not accessible

Win XP SP3.

On my second hdd I have 3 partitions, one of which I created to use
with TrueCrypt. This appears as Z: and it's just under 10GB.

It's worked fine for months, but suddenly I cannot access it, either
with TrueCrypt, or even with XPs disk management program to reformat
it (I suspect it will even prevent me from deleting it)! In both cases
I get an error message saying that the volume in use by some other
program, but I cannot find out what. I've excluded Z: from the real
time scanner in Avast, and also excluded it from my Genie Timeline
Backup monitoring (it was never in there anyway). The XP disc
management program reports the volume as healthy but full (presumably
because it's encrypted with TrueCrypt.

How can I find out what's using this volume?

I have a backup of the data that's in this volume, so don't mind
"taking a hammer to it" if necessary, although I'd really like to find out what's happened so that I can maybe trust using TrueCrypt again!

Thanks, David

 

I would first start out bye doing the Read&Rum me first.To check to make sure there are no viruses.http://forums.majorgeeks.com/showthread.php?t=35407

 

Bit of confusion here. If you have a disk partition Z, visible in My Computer, then that is not your TrueCrypt drive, it is the partition in which your TrueCrypt drive is located. TrueCrypt drives are not visible in My Computer or in Disk Management until mounted, at which point they are assigned a new drive letter, different from all physical drives/partitions. The TrueCrypt drive is actually just an encrypted file which can only be opened by TrueCrypt and your TrueCrypt password, and it would seem that your TrueCrypt file has become corrupt or has been deleted. There is no point at all in creating a separate partition to hold a TrueCrypt drive as it is, as I have said, just a file and can be located on any existing partition. That's why it's never appeared in your Genie Timeline Manager.

As you have a backup of the data it's probably best to create a new TrueCrypt drive and password and restore your backup to it.

 

Earthling,

With TrueCrypt you can either "Create an encrypted file container" or "Encrypt a non-system partition/drive". I did the latter. I used Easeus partition manager to create a new partition on my D: drive (in addition to two existing partitions). This partition appears as Z: in file manager etc. I then used TrueCrypt to encrypt this new partition. Now you can still see Z: in file manager but you can't access it or even access it's properties.

When I want to use it I then have to use TrueCrypt to mount it as a new drive letter (an unused one, eg T: ), and then use T: as if it were a normal drive, eg in file manager.

This has worked with absolutely no problem for months, the just suddenly stopped.

I know I can create another new partition, but I still want to get rid of the old one, and try and understand why this happened.

My firewall and AV are all up to date and reporting no problems, and everything else is working, so I think a virus is very unlikely, but will run the "Read&Run" process when all else fails.

 

OK, thanks for the explanation. Don't use TrueCrypt myself and was reading across from Cryptainer, but clearly there are differences.

I rather thought that a reboot would clear the 'in use' situation and enable you to do whatever you want with Z. Is that not now so? If not then the program using the drive - TrueCrypt I would think - is autostarting, so removing it from the startup list and rebooting should fix it.

The only clues you might get as to what went wrong would be in Event Viewer but I rather suspect you are never going to know

 

I believe Truecrypt uses a driver. If it starts when windows loads, then maybe that is why the error comes up as being used by another program. Do you have %windir%\SYSTEM32\DRIVERS\truecrypt.sys?

http://www.truecrypt.org/docs/truecrypt-system-files

Can you uninstall Truecrypt in Add/Remove programs. This would probably remove the driver and give you the chance to delete the partition.

If you cannot do that run Autoruns and see if the truecrypt.sys file in under the Driver tab. Uncheck but do not delete. Then reboot. You may be able to delete the partition then. Then go back and recheck the driver again.

If that does not work, try deleting the partition using an offline partition manager like Partition Wizard bootable version.

 

Hi tgell, and others.

Yup, there is a driver shown in AutoRuns, though nothing shows up in services.msc. I've disabled the entry in AutoRuns and rebooted, but still get the message saying that the volume is in use.

I've since checked the TrueCrypt Forums, and it seems that this "volume in use" problem turns up quite a bit. There's lots of discussion, but no one seems to know why, or how to solve the problem (apart from deleting and starting over).

So if anyone else reads this and has any ideas?

Thanks to all for your replies so far.