2

I have a computer with a TrueCrypt full disk encryption and I can't remember the password.

I have a pretty good idea of what the password is, meaning I know the words and numbers and symbols used in it but I can't get it right, spent over an hour trying different combinations.

I could make a dictionary that would crack the password and I know how to do this with TrueCrack our Hash Cat on Kali Linux with a normal TrueCrypt file container, but I just can't get it to jive with this fisk with FDE.

I'm not stuck on using these methods.

What's the easiest way to crack it with a dictionary attack?

|improve this question
  • 1
    To those that voted to close this question for being unclear, perhaps the current answer makes the question clearer? It is simply, "I know how to do a dictionary attack against a file, but how do I do it against FDE?" – TTT Sep 19 '16 at 14:29
4

In Unix, everything is a file! Just use the partition with your encrypted data as the filename. So if for example your encrypted partition is /dev/sdb3 just use

truecrack -t /dev/sdb3 -w passwords_file

But actually you only need the first 512 byte of the partition to crack the password! Just copy them to a file and use this file for truecrack or hashcat.

dd if=/dev/sdb3 of=~/header_sdb3 bs=512 count=1 conv=noerror,sync

Then you can use the file ~/header_sdb3 to crack the password!

If you need a complete step-by-step tutorial, try this

|improve this answer
  • Yes, cleared everything up and worked like a charm, thanks! – clownfish Sep 19 '16 at 19:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.