+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Detect veracrypt algorithm (/thread-11092.html)
Detect veracrypt algorithm - miazurue - 10-28-2022
Hi, is this possible to somehow detect if VeraCrypt drive was encrypted with SHA512 or SHA256? I'm so stupid that I created VeraCrypt drive with my only copy of childhood photos and not only forgot password but also which of those two algorithm did I choose as VeraCrypt doesn't need to specify this information, it can detect algorithm automatically.
I hope someday I'll have enough GPU power or money to crack it, or maybe I'll figure out proper mask, but at this moment I have to do twice as much work because I don't know which algorithm it was, so is there a way to know?
I've got another question not directly related with hashcat but maybe somebody knows answer - this drive was set to 200GB but actually there was maybe 10GB of data, is it possible to somehow trim the drive to 10GB? I tried to do it with sample drive (just copying first N megabytes below maximum size) but it didn't work, veracrypt (or windows, I'm not sure) said that the drive is corrupted. Maybe the data is spread across whole size, but it would be weird, I rather suppose there is some kind of footer at the end of the data which should be also added to the trimmed data.
RE: Detect veracrypt algorithm - b8vr - 10-28-2022
(10-28-2022, 06:12 PM)marc1n Wrote: If you have a hash, the hashcat will recognize your encryption type https://hashcat.net/wiki/doku.php?id=frequently_asked_questions#how_do_i_extract_the_hashes_from_veracrypt_volumes
What? No, that is not what it says.
You can't tell on veracrypt how it was encrypted. What you get, when you retrieve a "hash", is not really a hash. It's just 512 bytes of data formatted as a hash (if using the new modes).
Of those 512 bytes, the first 64 - I think it's 64 - bytes is a salt. The rest is a header, but the header itself is encrypted, so it's not possible to retrieve any encryption from it.
RE: Detect veracrypt algorithm - Arch Stanton - 11-09-2022
They have so many tools, but check Elcomsoft - pretty sure earlier this year in a blog post or something they released a free hash extractor utility. IIRC it identifies the hash type.