2

Is there a way to know a VeraCrypt volume/header is intact? is there a way to know what hash algorithm was used?

I have a VeraCrypt volume that I can't log into. I think the password should have worked so I am wondering if it's intact? Is there any way to know?

And is there a way to know what hash algorithm was used?

2 Answers 2

1

If you're certain you're entering the right password, but VeraCrypt is saying "incorrect password or not a volume", it's likely that you have a corrupted volume header. If the first 512 bytes of the volume are corrupted, the only way to recover is with a backup of the volume header. Those 512 bytes contain the information necessary to build the volume encryption keys that are used to encrypt/decrypt the data. Even if you have the correct password, you cannot recover the data without an intact header.

There is no secondary copy of the volume header within the volume itself - this would break the deniability property of the volume by providing distinguishability.

Tools like TestCrypt can help you if the volume will decrypt but the filesystem inside is corrupted, i.e. the volume mounts successfully but you can't read the disk, but if you can't get it to mount then unfortunately you are out of luck without a volume header backup.

If you do happen to have an older copy of the volume somewhere, you should be able to just take the first 512 bytes of that backup and write it over the first 512 bytes of the corrupted volume. This only works if you have a copy of the exact same volume, and if you haven't changed the password since the backup copy was taken.

You cannot tell which hash algorithm was used for key derivation. Even VeraCrypt itself does not know. When you type in a password, VeraCrypt performs key derivation with every possible hash function that is supported, and then tries each one until it successfully decrypts the volume header.

0

It's part of the design of VeraCrypt to be unable to detect a volume header, and thus you cannot verify it without knowing the passphrase (see VeraCrypt Volume Format Specification).

If the hash and crypto algorithm is not specified, VeraCrypt has to try all combinations of those to find out whether there is an actual encrypted volume or not. Only if a volume header could be detected (i.e. decrypted), it can be verified.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .