VeraCrypt Rescue Disk

• If the VeraCrypt password prompt is unexpectedly missing at startup (for example, Windows shows a boot error or Automatic Repair instead), the VeraCrypt Boot Loader may be damaged. In EFI boot mode, VeraCrypt's entry in the firmware boot menu may also have been changed or removed. The VeraCrypt Rescue Disk can help restore access to your encrypted Windows installation. You will still need the correct password. An intentionally hidden password prompt or a custom boot message alone does not indicate damage.

  EFI boot mode:

  If the firmware displays Secure Boot Violation or a similar security rejection, or rejects the rescue USB under Secure Boot, follow the recovery instructions in EFI Secure Boot first. Restoring files does not change the firmware trust policy.

  Use lowercase menu letters with Caps Lock off. The rescue menu uses the firmware keyboard layout; if this is US, the key labelled , on a French AZERTY keyboard produces m.

  1. Disconnect unrelated USB storage devices and external disks. Boot from the VeraCrypt rescue USB created for your encrypted Windows installation.
  2. Select Restore VeraCrypt loader binaries to system disk (press r). If Select EFI boot volume: appears, identify the volume belonging to the Windows installation being recovered from the listed device paths and type its number explicitly. The [Boot] marker identifies candidates, including other bootable devices. If you cannot identify the correct volume, stop before restoring. A single candidate is selected automatically.
  3. Wait for the message VeraCrypt Loader restored to disk successfully. Returning to the rescue menu is normal. This operation does not display the password prompt or restart the computer.
  4. To start the restored loader directly, select Boot VeraCrypt loader from system disk (press b) if that option is present. Otherwise, remove the rescue USB and restart your computer. The VeraCrypt password prompt should then appear.

  If a normal restart still bypasses VeraCrypt, boot from the rescue USB again and select Restore VeraCrypt loader to boot menu (press m). If prompted, choose the same EFI boot volume used for r. This places VeraCrypt first in the firmware boot order, ahead of any other boot manager. Once the rescue menu returns without an error, remove the USB and restart again.

  If no suitable EFI boot volume is found, the rescue menu reports Not Ready. If a restoration or direct boot attempt reports an error, record the message before attempting another recovery action.

  After Windows starts, follow After recovery below to update the loader if needed and create a new Rescue Disk.

  MBR legacy boot mode:

  Disconnect unrelated external disks before booting the Rescue Disk. MBR repair writes to the first disk listed by the BIOS (drive 0). Confirm that this is the encrypted system disk before accepting Modify drive 0? (y/n).

  In the Rescue Disk screen, select Repair Options > Restore VeraCrypt Boot Loader. Press Y to confirm the action. When VeraCrypt Boot Loader restored. appears, press a key to return to the repair menu. Remove the Rescue Disk and restart your computer. The VeraCrypt password prompt should then appear.

• If the VeraCrypt Boot Loader is frequently damaged (for example, by inappropriately designed activation software) or if you do not want the VeraCrypt boot loader to reside on the hard drive (for example, if you want to use an alternative boot loader/manager for other operating systems), you can boot directly from the VeraCrypt Rescue Disk (as it contains the VeraCrypt boot loader too) without restoring the boot loader to the hard drive. For EFI boot mode, just insert your Rescue Disk into a USB port, boot your computer on it and then select Boot VeraCrypt loader from rescue disk on the Rescue Disk screen. For MBR legacy boot mode, you need to insert the Rescue Disk in your CD/DVD drive and then enter your password in the Rescue Disk screen.

  On EFI rescue media created by VeraCrypt versions 1.19 through 1.26.24, this menu option starts the loader from the system disk instead of the rescue USB. Recreate the Rescue Disk with a current VeraCrypt version to use the corrected rescue boot path.

• If you repeatedly enter the correct password but VeraCrypt says that the password is incorrect, it is possible that the master key or other critical data are damaged. The VeraCrypt Rescue Disk allows you to restore them and thus to regain access to your encrypted system and data (however, note that you will still have to enter the correct password then). For EFI boot mode, select Restore OS header keys in the Rescue Disk screen. For MBR legacy boot mode, select instead Repair Options > Restore key data (volume header). Then enter your password, press 'Y' to confirm the action, remove the Rescue Disk from the USB port or CD/DVD drive, and restart your computer.
  
  Note: This feature cannot be used to restore the header of a hidden volume within which a hidden operating system resides (see the section Hidden Operating System). To restore such a volume header, click Select Device, select the partition behind the decoy system partition, click OK, select Tools > Restore Volume Header and then follow the instructions.
  
  WARNING: By restoring key data using a VeraCrypt Rescue Disk, you also restore the password that was valid when the VeraCrypt Rescue Disk was created. Therefore, whenever you change the password, you should destroy your VeraCrypt Rescue Disk and create a new one (select System -> Create Rescue Disk). Otherwise, if an attacker knows your old password (for example, captured by a keystroke logger) and if he then finds your old VeraCrypt Rescue Disk, he could use it to restore the key data (the master key encrypted with the old password) and thus decrypt your system partition/drive
• If Windows is damaged and cannot start after typing the correct password on VeraCrypt password prompt, the VeraCrypt Rescue Disk allows you to permanently decrypt the partition/drive before Windows starts. For EFI boot, select Decrypt OS in the Rescue Disk screen. For MBR legacy boot mode, select instead Repair Options > Permanently decrypt system partition/drive. Enter the correct password and wait until decryption is complete. Then you can e.g. boot your MS Windows setup CD/DVD to repair your Windows installation. Note that this feature cannot be used to decrypt a hidden volume within which a hidden operating system resides (see the section Hidden Operating System).
  
  Note: Alternatively, if Windows is damaged (cannot start) and you need to repair it (or access files on it), you can avoid decrypting the system partition/drive by following these steps: If you have multiple operating systems installed on your computer, boot the one that does not require pre-boot authentication. If you do not have multiple operating systems installed on your computer, you can boot a WinPE or BartPE CD/DVD or a Linux Live CD/DVD/USB. You can also connect your system drive as a secondary or external drive to another computer and then boot the operating system installed on the computer. After you boot a system, run VeraCrypt, click Select Device, select the affected system partition, click OK , select System > Mount Without Pre-Boot Authentication, enter your pre-boot-authentication password and click OK. The partition will be mounted as a regular VeraCrypt volume (data will be on-the-fly decrypted/encrypted in RAM on access, as usual).
• In case of MBR legacy boot mode, your VeraCrypt Rescue Disk contains a backup of the original content of the first drive track (made before the VeraCrypt Boot Loader was written to it) and allows you to restore it if necessary. The first track typically contains a system loader or boot manager. In the Rescue Disk screen, select Repair Options > Restore original system loader.

In EFI boot mode with Secure Boot enabled, the VeraCrypt Rescue Disk uses a Microsoft UEFI CA-signed bootloader set trusted by the computer's active Secure Boot db when the Rescue Disk is created. The 2023 VeraCrypt loader set requires both Microsoft UEFI CA 2023 and Microsoft Option ROM UEFI CA 2023, while the 2011 loader set requires Microsoft Corporation UEFI CA 2011. If firmware or Secure Boot db entries are later changed, create a new VeraCrypt Rescue Disk. A Rescue Disk created on a computer that trusts only one Microsoft UEFI CA generation may not Secure-Boot on a different computer that trusts only the other generation.

On EFI systems, the VeraCrypt service refreshes the installed loader at Windows startup, session logon or unlock, resume from sleep, and shutdown when automatic loader repair is enabled. Changes to the boot entry follow the options in System > Settings.

After recovery: An older Rescue Disk can replace the installed loader with an older version or a different Secure Boot certificate set. Run the installer for the installed VeraCrypt version in Repair/Reinstall mode if you used older rescue media or disabled automatic loader repair. Run it also after manually changing firmware Secure Boot trust entries. Then create a new Rescue Disk using System > Create Rescue Disk and check it using System > Verify Rescue Disk. Restart once without the Rescue Disk to confirm that normal startup works.

If your VeraCrypt Rescue Disk is damaged, you can create a new one by selecting System > Create Rescue Disk. To find out whether your VeraCrypt Rescue Disk is damaged, insert it into a USB port (or into your CD/DVD drive in case of MBR legacy boot mode) and select System > Verify Rescue Disk.