+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Misc (https://hashcat.net/forum/forum-15.html)
+--- Forum: General Talk (https://hashcat.net/forum/forum-33.html)
+--- Thread: Veracrypt question (/thread-5699.html)
Veracrypt question - kiara - 07-25-2016
hi every1
i was looking at hash example https://hashcat.net/wiki/doku.php?id=example_hashes
and veracrypt wasnt there.
can some one explain on how to get the hash/ *tc*(for veracryptfile..) file from a container\full disk encryption?
for truecrypt, the location was the first 512 bytes of the hdd disk sector.
i dont know how if it is the same case of veracrypt.
would be great if some one could please clarified this. thanks!
RE: Veracrypt question - philsmd - 07-25-2016
Yeah, it's exactly the same procedure for veracrypt (like it is for truecrypt "hashes", also see https://hashcat.net/wiki/frequently_asked_questions#how_do_i_extract_the_hashes_from_truecrypt_volumes)
And yes, you are right, the sample veracrypt "hash(es)" are missing from the example hashes wiki page... it would be very nice if someone could provide those with password "hashcat" (shouldn't be impossible of course, but a little bit of work since there are several algorithms selectable for veracrypt too).
RE: Veracrypt question - kiara - 07-25-2016
i will found time and i will try to do it myself.
mean while, i have an encrypted hdd which i dont know what program were being use to encrypt it, i thought maybe it was veracrypt but from what u are saying it is not.
any idea how could like figure out which program were used , like reading specify sectors.
RE: Veracrypt question - neo79 - 07-25-2016
usualy the first sector should tell you, I cant remember how I did it but I guess there is some tool to read from sector 0, it showed up for drivecrypt.
RE: Veracrypt question - kiara - 07-25-2016
im running linux, their is dd to watch the sectors.
the question is which sector should i look for to find it
RE: Veracrypt question - bigblacknose - 12-13-2016
(07-25-2016, 05:56 PM)kiara Wrote: im running linux, their is dd to watch the sectors.
the question is which sector should i look for to find it
Isn't it just like something like this:
dd if=disk.dd of=disk.hash skip=62 bs=512 count=1 ?
If it is the last sector of the first track as in TC?
// BigBlackNose
RE: Veracrypt question - royce - 05-15-2017
Follow-up - there are at least now non-boot VeraCrypt examples on the example hashes wiki page.
https://hashcat.net/wiki/doku.php?id=example_hashes