2

I have a computer with a TrueCrypt full disk encryption and I can't remember the password.

I have a pretty good idea of what the password is, meaning I know the words and numbers and symbols used in it but I can't get it right, spent over an hour trying different combinations.

I could make a dictionary that would crack the password and I know how to do this with TrueCrack our Hash Cat on Kali Linux with a normal TrueCrypt file container, but I just can't get it to jive with this fisk with FDE.

I'm not stuck on using these methods.

What's the easiest way to crack it with a dictionary attack?

1
  • 1
    To those that voted to close this question for being unclear, perhaps the current answer makes the question clearer? It is simply, "I know how to do a dictionary attack against a file, but how do I do it against FDE?"
    – TTT
    Sep 19, 2016 at 14:29

1 Answer 1

4

In Unix, everything is a file! Just use the partition with your encrypted data as the filename. So if for example your encrypted partition is /dev/sdb3 just use

truecrack -t /dev/sdb3 -w passwords_file

But actually you only need the first 512 byte of the partition to crack the password! Just copy them to a file and use this file for truecrack or hashcat.

dd if=/dev/sdb3 of=~/header_sdb3 bs=512 count=1 conv=noerror,sync

Then you can use the file ~/header_sdb3 to crack the password!

If you need a complete step-by-step tutorial, try this

1
  • Yes, cleared everything up and worked like a charm, thanks!
    – clownfish
    Sep 19, 2016 at 19:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .