hashcat Forum
Recover Veracrypt Password - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Recover Veracrypt Password (/thread-11064.html)



Recover Veracrypt Password - kasuky1590 - 10-13-2022

Hi Everyone,

I know that there are some similar questions here, but I need to be sure that I am doing things right.

My problem is that I encrypted my USB driver using Veracrypt with a password and a PIM.
I wrote them on a piece of paper but unfortunately, I lost the paper.
I remember the PIM but it was impossible to remember the password completely.
Actually, I am not sure of the length of the password.

First of all, I extracted the encrypted key (the first 512 bytes) using the following command

Code:
dd if=/dev/sdg1 of=encrypted/target_hash.tc bs=512 count=1

And I have been using the following command to get the password

Code:
sudo hashcat -a 3 -w 1 -m 13721 target_hash.tc [pattern] --force --veracrypt-pim=[PIM]

This has taken a lot of time, but I am not sure if the parameters in the command above are right.

Also, I would like to know if there is a way to get a copy of the USB drive. If I was not able to get the password, I would like to get a copy to use at another time.

Thanks.


RE: Recover Veracrypt Password - marc1n - 10-14-2022

delete --force in command line is not recommended, you may get erroneous results.


RE: Recover Veracrypt Password - Snoopy - 10-14-2022

to get a complete image of your usb stick, assuming it is still sdg[1], the 1 is just the first partition of your usb device

when susing older versions of dd you have to remove status=progress (this helps to see how much data is already copied)

dd if=/dev/sdg of=fullusb.dd bs=512 status=progress

this will make a full 1:1 copy of your usb stick, image size = usb-stick size, so 4gb usb will result in 4gb dd image


RE: Recover Veracrypt Password - JimYu - 03-21-2023

delete --force
and use --veracrypt-pim-start [PIM] --veracrypt-pim-stop [PIM]