2

For my studies, I am required to do an investigation on a fictional criminal VMWare image. The image is suspected of participating in DDoS attacks and other illegal activities. On this PC TrueCrypt is installed. Along with TrueCrypt, The image has Mozilla Thunderbird installed with a OpenPGP security module.

I made a raw memory.dmp of the RAM memory in the image to perform analysis. Using aeskeyfind I got several results.

michael@cf15:~/Documents/Volatility$ aeskeyfind memory.dmp b4ce75c857163e668818d0d76c46bad2 ccf865429e42144a9dce839b036c3f7c 51c35f7f0b79e7d1e6d5345d2a291ac8 Keyfind progress: 100%

This command shows me that there are 3 AES keys present in the RAM. Using -v (verbose mode) I can see that they're all 128bits.

What exactly can someone undertake when they found these private keys unencrypted on the disk? As the OpenPGP asks for a 2048 RSA-key, I think the keys are connected to hidden TrueCrypt volumes.

Can a attacker use these keys to gain access to volumes without having the appropriate passphrase?

Improve this question

2 Answers 2

Reset to default
2

You can try to decrypt things using these keys :)

First of all I would try to decrypt the hard disk (TrueCrypt) using the keys.

Regarding OpenPGP you should know that the 2048-bit RSA key is only used to decrypt a symmetric key, which can be used to decrypt the message. It's a matter of performance. You you can try decrypting the message with one of the above keys.

Improve this answer
0

It seems you are asking how to use the key to decrypt the Truecrypt volume with the key.

This should point you in the right direction.

Improve this answer
1
  • Thanks for the suggestion, however they won't let the source code go on identifying the TrueCrypt volumes.
    – MichaelP
    Apr 1, 2014 at 17:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .