1

With VeraCrypt, one can fully encrypt a non-system drive. I'm wondering if there's a way to run hashcat against such a drive. (Bonus points for a Windows solution.)

1

The procedure should be the same as for TrueCrypt, as documented in the hashcat FAQ.

You'll need to extract the first 512 bytes of the target volume, save them as a file, and use that file as the hashcat target. (Boot drives require pulling the 512 bytes starting later in the drive, but non-boot drives can be treated like file-level containers, pulling the first 512 bytes.)

On Windows, you can use dd for windows to do so. Use dd --list to determine the drive ID for the drive, and then:

dd if=\\.\Volume{volume-guid} of=c:\temp\veracrypt-target.img bs=512 count=1

and:

hashcat -a 3 -w 3 -m 137xx c:\temp\veracrypt-target.img

(with the hashcat command modified to match your attack type).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.