Passcovery. Just solve a lost password problem > Help Desk > Knowledgebase

How can I organize a password search for full TrueCrypt devices/partitions?

Rating (Votes): Article rated 3.2/5.0 (20)

To mount attack on TrueCrypt volume you're need just one sector - 512 bytes. For TrueCrypt volumes stored in files it's first sector of the file. For non-system volumes -- first sector of encrypted drive. For TrueCrypt/Whole Disk Encryption the sector you're need is usually placed at offset 0x7C00, i.e. last sector of first track of the drive.

Right now Passcovery Suite (current version is 2.1) is not supporting extracting of sectors from drives (although it's in planned future features), so you're need to use 3rd party utilities to do this. After sector will be copied/extracted you can mount attack on it as with regular file.

Also, if you've used TrueCrypt/WDE and have backup .iso image, you can use this image with offset 0x14C00 (HEX) to mount attack. 0x14C00 is “0xD000 (size of header/boot loader in .iso) + 0x7C00 == (63 – 1) * 512 (last sector of first track).

Of course it's highly recommended to firstly test program with known password/volume to make sure you're using correct offsets.

Was this article helpful? YES / NO
Related articles Recovering a password for a TrueCrypt disk
Offsets for recovery of passwords for TrueCrypt
TrueCrypt Password Recovery using Passcovery Suite Command Line

Powered by Help Desk Software HESK, in partnership with SysAid Technologies