1

I'm dusting off an hold drive and unfortunately forget the password. I'm going to run a word list against it using TrueCrack however I'm a little confused on how to extract the volume header to run tc against.

https://www.truecrypt71a.com/documentation/technical-details/truecrypt-volume-format-specification/

The first sector of the disk contain the MBR (446 bit MBR + 4 byte partition table). The MBR is obviously a truecrypt MBR due to the fact that I get prompted for a password. I assume that the TC MBR code tries the password against the very first bytes of the active partition.

I may be wrong because when I pulled out the disk I got an error stating "Failure to read disk 0 sector 62". The documentation above also makes it seem like more than just the first 512 bytes are used.

My goal is to simply DD the volume header (or whatever I need) off of the drive and run Truecrack against it.

1

The TrueCrypt MBR does not do any password checking, as it'd be impossible to implement code for AES, Twofish, Serpent, SHA512, RIPEMD-160, Whirlpool, and PBKDF2 all in the space of 446 bytes in real mode. All the MBR does is load the rest of the bootloader (this is called a staged bootloader). The bootloader is what is responsible for providing you with a prompt, checking the password, and finishing boot.

The URL you linked for the volume format is only for the volume itself, which does not include the MBR. It most likely starts at the TrueCrypt partition, not the very beginning of the disk.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.