+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Recover Veracrypt Password (/thread-11064.html)
Recover Veracrypt Password - kasuky1590 - 10-13-2022
Hi Everyone,
I know that there are some similar questions here, but I need to be sure that I am doing things right.
My problem is that I encrypted my USB driver using Veracrypt with a password and a PIM.
I wrote them on a piece of paper but unfortunately, I lost the paper.
I remember the PIM but it was impossible to remember the password completely.
Actually, I am not sure of the length of the password.
First of all, I extracted the encrypted key (the first 512 bytes) using the following command
Code:
dd if=/dev/sdg1 of=encrypted/target_hash.tc bs=512 count=1And I have been using the following command to get the password
Code:
sudo hashcat -a 3 -w 1 -m 13721 target_hash.tc [pattern] --force --veracrypt-pim=[PIM]This has taken a lot of time, but I am not sure if the parameters in the command above are right.
Also, I would like to know if there is a way to get a copy of the USB drive. If I was not able to get the password, I would like to get a copy to use at another time.
Thanks.
RE: Recover Veracrypt Password - marc1n - 10-14-2022
delete --force in command line is not recommended, you may get erroneous results.
RE: Recover Veracrypt Password - Snoopy - 10-14-2022
to get a complete image of your usb stick, assuming it is still sdg[1], the 1 is just the first partition of your usb device
when susing older versions of dd you have to remove status=progress (this helps to see how much data is already copied)
dd if=/dev/sdg of=fullusb.dd bs=512 status=progress
this will make a full 1:1 copy of your usb stick, image size = usb-stick size, so 4gb usb will result in 4gb dd image
RE: Recover Veracrypt Password - JimYu - 03-21-2023
delete --force
and use --veracrypt-pim-start [PIM] --veracrypt-pim-stop [PIM]