+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: How to find out veracrypt hash type (/thread-8511.html)
How to find out veracrypt hash type - LainShot - 07-26-2019
Hi All,
does anyone know how to find out the hash type for a veracrypt physical volume, I have the bin file for the firstÂ
512 bytes however I am getting Hash '64.bin': Insufficient entropy exception. I think this is due to the fact that I am not using the correct hash type but I am struggling to find out how to find it out.
Thanks for any advice
Iain
RE: How to find out veracrypt hash type - philsmd - 07-26-2019
The FAQ over here https://hashcat.net/wiki/doku.php?id=frequently_asked_questions#how_do_i_extract_the_hashes_from_veracrypt_volumes clearly says that you need to extract the last 512 bytes
Quote:in case of a physical disk you need to copy the last 512 bytes of the *first logical volume*.
therefore you got very lucky that hashcat prevented you from cracking the wrong bytes (because it has a sanity check that makes sure the data is sufficiently random == entropy check)
RE: How to find out veracrypt hash type - mkcon - 07-26-2019
Sorry, but i doubt that the FAQ entry is correct:
From https://www.veracrypt.fr/en/VeraCrypt%20Volume%20Format%20Specification.html:
Quote:The format of file-hosted volumes is identical to the format of partition/device-hosted volumes (however, the "volume header", or key data, for a system partition/drive is stored in the last 512 bytes of the first logical drive track).
Thus a physical volume / device is identical to a file file hosted container. The hash is in the first 512 bytes.
Only for system encryption the hash is in the last 512 bytes of the first track (i.e. sector 62). The first volume usually starts after that at sector 63 (old) or 2048 (newer systems).