I'm dusting off an hold drive and unfortunately forget the password. I'm going to run a word list against it using TrueCrack however I'm a little confused on how to extract the volume header to run tc against.
The first sector of the disk contain the MBR (446 bit MBR + 4 byte partition table). The MBR is obviously a truecrypt MBR due to the fact that I get prompted for a password. I assume that the TC MBR code tries the password against the very first bytes of the active partition.
I may be wrong because when I pulled out the disk I got an error stating "Failure to read disk 0 sector 62". The documentation above also makes it seem like more than just the first 512 bytes are used.
My goal is to simply DD the volume header (or whatever I need) off of the drive and run Truecrack against it.