For my studies, I am required to do an investigation on a fictional criminal VMWare image. The image is suspected of participating in DDoS attacks and other illegal activities. On this PC TrueCrypt is installed. Along with TrueCrypt, The image has Mozilla Thunderbird installed with a OpenPGP security module.
I made a raw memory.dmp of the RAM memory in the image to perform analysis. Using aeskeyfind I got several results.
michael@cf15:~/Documents/Volatility$ aeskeyfind memory.dmp b4ce75c857163e668818d0d76c46bad2 ccf865429e42144a9dce839b036c3f7c 51c35f7f0b79e7d1e6d5345d2a291ac8 Keyfind progress: 100%
This command shows me that there are 3 AES keys present in the RAM. Using -v (verbose mode) I can see that they're all 128bits.
What exactly can someone undertake when they found these private keys unencrypted on the disk? As the OpenPGP asks for a 2048 RSA-key, I think the keys are connected to hidden TrueCrypt volumes.
Can a attacker use these keys to gain access to volumes without having the appropriate passphrase?